mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-11-02 06:28:49 -06:00
34 lines
2.3 KiB
Markdown
34 lines
2.3 KiB
Markdown
# Source licensing self-check
|
|
|
|
Run `cargo xtask license-check` to validate the checked-out source, offline. The command
|
|
does not download assets, fetch models, inspect installers, or generate dependency notices.
|
|
It reuses `cargo xtask assets` for attribution, asset policy and locked dependency versions,
|
|
then checks the documents recorded in `LICENSES.toml`.
|
|
|
|
Each document has a repository-relative source, a unique portable logical destination and
|
|
the SHA-256 of its audited text. Destinations are validation metadata, not instructions to
|
|
copy files into packages. Required project documents and every asset's `licence_file` must
|
|
be mapped. Every dependency-bundled asset must have a document mapping matching its existing
|
|
`ATTRIBUTION.toml` licence expression. Foxit has an explicit required document. Licence
|
|
texts for egui's default fonts and CMaps are retained in `licenses/`, with their pinned
|
|
upstream origins recorded in the manifest. Existing font and asset texts stay in place.
|
|
|
|
Missing files, empty or invalid text, changed hashes, duplicate mappings, case-insensitive
|
|
destination collisions, parent-file conflicts and unsafe paths fail the check. Source
|
|
symlinks must resolve inside the checkout. OCR models need complete attribution and valid
|
|
hashes and destination names; the model binaries and downloaded licence texts need not be
|
|
present. The optional craft-fonts checkout remains governed by its own attribution and
|
|
the existing asset validator; this command does not audit that external checkout.
|
|
|
|
When changing attribution, edit `ATTRIBUTION.toml`, run `cargo xtask assets --write`. Generated attribution consistency remains checked only
|
|
by the existing asset validator. When changing licence or notice text, re-audit
|
|
its provenance before updating the corresponding hash. Do not replace a licence with
|
|
guessed terms or update a hash merely to silence a failure. `LICENSES.toml` is validated
|
|
with unknown fields rejected.
|
|
|
|
The existing Linux source-validation step in `.github/workflows/ci.yml` and `cargo xtask ci`
|
|
run `license-check` in place of `assets`; the asset validator runs once within that command.
|
|
This Stage 1 check establishes source-document consistency, not completed-package
|
|
compliance or legal sufficiency. Installer inspection, dependency-notice generation and
|
|
font-delivery packaging changes remain separate work.
|