From 63e48ee5ca9f12fde898e345baec2e9127dd09ab Mon Sep 17 00:00:00 2001 From: Jake Shadle Date: Wed, 6 Mar 2024 11:16:06 +0100 Subject: [PATCH] Add workaround for Pixar license being lame (#626) The Pixar license is an almost exact copy of Apache-2.0, but doesn't actually have enough changes compared to the Apache-2.0 license to be fuzzy matched if the apache license text has the appendix at the end removed (eg, doesn't even have Pixar in the title), so this PR just adds a workaround specifically for this case. Resolves: #625 --- CHANGELOG.md | 3 + src/licenses.rs | 10 +- src/licenses/gather.rs | 33 +++- tests/licenses.rs | 42 +++++ .../licenses__forces_apache_over_pixar.snap | 53 ++++++ tests/test_data/so-annoying/Cargo.lock | 7 + tests/test_data/so-annoying/Cargo.toml | 5 + tests/test_data/so-annoying/LICENSE-APACHE | 177 ++++++++++++++++++ tests/test_data/so-annoying/LICENSE-PIXAR | 173 +++++++++++++++++ tests/test_data/so-annoying/src/lib.rs | 1 + 10 files changed, 502 insertions(+), 2 deletions(-) create mode 100644 tests/snapshots/licenses__forces_apache_over_pixar.snap create mode 100644 tests/test_data/so-annoying/Cargo.lock create mode 100644 tests/test_data/so-annoying/Cargo.toml create mode 100644 tests/test_data/so-annoying/LICENSE-APACHE create mode 100644 tests/test_data/so-annoying/LICENSE-PIXAR create mode 100644 tests/test_data/so-annoying/src/lib.rs diff --git a/CHANGELOG.md b/CHANGELOG.md index 937cd84ce..be72c7bbe 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] - ReleaseDate +### Fixed +- [PR#626](https://github.com/EmbarkStudios/cargo-deny/pull/626) resolved [#625](https://github.com/EmbarkStudios/cargo-deny/issues/625) by explicitly checking that a license identified as Pixar was actually (probably) the Pixar license, instead of a normal Apache-2.0 license. + ## [0.14.15] - 2024-02-28 ### Added - [PR#618](https://github.com/EmbarkStudios/cargo-deny/pull/618) added metadata notes to diagnostics when a license is rejected, as well as removing span information for accepted licenses unless the log level is `info` or higher to make the diagnostic clearer by default. diff --git a/src/licenses.rs b/src/licenses.rs index b9c378684..3682d15c4 100644 --- a/src/licenses.rs +++ b/src/licenses.rs @@ -230,7 +230,7 @@ fn evaluate_expression( ), ); - let mut notes = Vec::new(); + let mut notes = krate_lic_nfo.notes.clone(); for ((reason, accepted), failed_req) in reasons.into_iter().zip(expr.requirements()) { if accepted && ctx.log_level < log::LevelFilter::Info { @@ -241,6 +241,8 @@ fn evaluate_expression( if let Some(id) = failed_req.req.license.id() { notes.push(format!("{} - {}:", id.name, id.full_name)); + let len = notes.len(); + if id.is_deprecated() { notes.push(" - **DEPRECATED**".into()); } @@ -256,7 +258,13 @@ fn evaluate_expression( if id.is_copyleft() { notes.push(" - Copyleft".into()); } + + if len == notes.len() { + notes.push(" - No additional metadata available for license".into()); + } } else { + // This would only happen if askalono used a newer license list than spdx, but we update + // both simultaneously notes.push(format!("{} is not an SPDX license", failed_req.req)); } } diff --git a/src/licenses/gather.rs b/src/licenses/gather.rs index eb6b7ea16..f93dbc8fe 100644 --- a/src/licenses/gather.rs +++ b/src/licenses/gather.rs @@ -130,6 +130,7 @@ struct LicensePack { struct GatheredExpr { synthesized_toml: String, failures: Vec