Remixware Now Checks Rust Crates for Build Scripts and Fixes Licence Misreads

Remixware 0.5 does two things. It reads licences more carefully, so a licence that asks something of you no longer passes as one that asks less. And the dependency gate now covers Rust, plus the part of a Go dependency that runs on your build machine.

The licence work started from three known misreads. The SIL Open Font License begins its grant with the same words as MIT, so a font under it came out as MIT-0, which asks for nothing. A BSD text whose third clause says “may not be used to endorse or promote” instead of “Neither the name of” came out as BSD-2-Clause. And a project with LICENSE-MIT and LICENSE-APACHE was always read as a choice of the two, even when a short LICENSE file said the library is under one and the documentation under the other.

Fixing those, we read every text of the SPDX License List with the detector, 794 of them, and looked for any that came out asking less than it does. More turned up. The Functional Source License read as MIT or Apache, though it isn’t open source. Sleepycat, which asks for your source, read as BSD-3. Old Creative Commons NonCommercial texts read as plain CC-BY. A few BSD variants that add their own terms read as the base licence: TOSL and TMate ask for the complete source code, and the No-Nuclear and No-Military ones rule out a field of use.

All of those are fixed now. Of the 794 texts, none is read as a licence that asks less than it does. The texts Remixware can’t place are left for review, and a copy under one of them needs its notice kept, so check fails until the notice is there. On real code, the vendored go-difflib in coyim now reads as BSD-3-Clause, which is what it is.

Rust: Cargo.lock and Build Scripts

remixware deps now reads Cargo.lock. A new crate that isn’t on your allow list fails, as it does for npm, Go and Python. With --online, Remixware downloads each added or updated crate from crates.io and checks for a build script or a procedural macro. Both run code on the machine that compiles them, so they’re reported the same way as an npm install script.

The image above is ripgrep’s commit adding its grep-index crate. Both new crates, fst and redb, have build scripts. On the commit “deps: update everything”, 10 of the 29 added or updated crates run code when compiled, among them anyhow, libc, serde_json and proc-macro2. Running that much code isn’t wrong. The point is that the gate shows you which crates do it, and an allow rule with install_scripts: true accepts each one once, with a reason.

A crate from git or another registry can’t be looked up, so it counts as running code, as git requirements already do for pip. A crate that keeps its version but changes where it comes from, say a crates.io crate patched to a fork, is not-checked.

Go: Native Code

Go modules run no code when they’re built, but they can bring C code compiled with cgo, prebuilt objects or SWIG files. With --online, Remixware reads each added or updated module from the Go module proxy and reports those as native-code. It reads build constraints and file names the way go build does, for Linux, macOS and Windows. So go-sqlite3 is flagged, and golang.org/x/sys, whose cgo is only for AIX and GNU Hurd, isn’t. native-code reports without failing unless you add it to fail_on.

Review

An independent review went through the release in two rounds and found 20 problems. The most serious was that a licence the detector couldn’t place let a copy pass check with no notice at all. Others were ways a crate source change or a cgo file could go unseen. Every one has a test that failed before the fix. A workflow checks the online parts against the real crates.io and Go module proxy.

Download 0.5.0, and see the reference for every rule. The GitHub Action is at softdevstudio/[email protected].