Private
Public Access
0
0
Files
manual_slop/tests
ed a8ae11d3a8 chore(audit): add license_cve audit script + initial report
scripts/audit_license_cve.py: 4 internal checks (license +
CVE + pin + source-header), policy tables (allowlist of
permissive/weak-copyleft/public-domain, blocklist of
non-OSI/restricted-source), and a main() that runs all 4
and emits line-per-violation to stdout + a markdown report.

Tests (26 unit + integration) cover license classifier (16
variants across MIT, BSD, Apache, LGPL, MPL, CC0, WTFPL,
GPL, AGPL, SSPL, BSL, Commons Clause, Elastic, Anti-996,
Hippocratic, unknown), pin check (3), source-header check
(3), license check via importlib.metadata (1), CVE check
via subprocess pip-audit (2), and a smoke test of the main
loop (1).

No new pip deps in the project: pure stdlib
(importlib.metadata, tomllib, pathlib, re) + subprocess to
pip-audit (optional dev tool, installed via 'uv tool install
pip-audit' if user wants CVE checks).

Initial report at docs/reports/license_cve_audit/2026-06-07/
records the current state. The Phase 2 commit will apply
the fixes (tilde-pin, delete requirements.txt); the Phase 3
commit will add --strict mode + baseline file for CI.
2026-06-07 15:07:46 -04:00
..
2026-03-05 17:13:59 -05:00
2026-05-10 15:14:54 -04:00
2026-05-20 07:51:58 -04:00
2026-03-05 16:37:30 -05:00
2026-03-05 17:13:59 -05:00
2026-03-05 16:37:30 -05:00
2026-03-07 20:32:59 -05:00
2026-03-06 22:03:59 -05:00
2026-03-05 17:13:59 -05:00
2026-03-12 19:08:51 -04:00
2026-03-05 15:10:53 -05:00
2026-03-12 19:08:51 -04:00
2026-03-12 19:08:51 -04:00
2026-05-20 07:51:58 -04:00
2026-05-20 07:51:58 -04:00
ok
2026-03-07 21:40:40 -05:00