ed
a8ae11d3a8
scripts/audit_license_cve.py: 4 internal checks (license + CVE + pin + source-header), policy tables (allowlist of permissive/weak-copyleft/public-domain, blocklist of non-OSI/restricted-source), and a main() that runs all 4 and emits line-per-violation to stdout + a markdown report. Tests (26 unit + integration) cover license classifier (16 variants across MIT, BSD, Apache, LGPL, MPL, CC0, WTFPL, GPL, AGPL, SSPL, BSL, Commons Clause, Elastic, Anti-996, Hippocratic, unknown), pin check (3), source-header check (3), license check via importlib.metadata (1), CVE check via subprocess pip-audit (2), and a smoke test of the main loop (1). No new pip deps in the project: pure stdlib (importlib.metadata, tomllib, pathlib, re) + subprocess to pip-audit (optional dev tool, installed via 'uv tool install pip-audit' if user wants CVE checks). Initial report at docs/reports/license_cve_audit/2026-06-07/ records the current state. The Phase 2 commit will apply the fixes (tilde-pin, delete requirements.txt); the Phase 3 commit will add --strict mode + baseline file for CI.
34 lines
1.3 KiB
TOML
34 lines
1.3 KiB
TOML
# Track state for license_cve_audit_20260607
|
|
# Updated by Tier 2 Tech Lead as tasks complete
|
|
|
|
[meta]
|
|
track_id = "license_cve_audit_20260607"
|
|
name = "License & CVE Audit (Dependency Compliance)"
|
|
status = "active"
|
|
current_phase = 0
|
|
last_updated = "2026-06-07"
|
|
|
|
[phases]
|
|
phase_1 = { status = "pending", checkpointsha = "", name = "Audit script + initial report" }
|
|
phase_2 = { status = "pending", checkpointsha = "", name = "Tilde-pin + lock regen + delete requirements.txt" }
|
|
phase_3 = { status = "pending", checkpointsha = "", name = "CI gate (--strict + baseline)" }
|
|
phase_4 = { status = "pending", checkpointsha = "", name = "tracks.md update" }
|
|
|
|
[verification]
|
|
audit_script_exists = false
|
|
license_check_passes = false
|
|
cve_check_optional_passes = false
|
|
pin_check_passes = false
|
|
source_header_check_passes = false
|
|
pyproject_tilde_pinned = false
|
|
requirements_txt_deleted = false
|
|
uv_lock_regenerated = false
|
|
strict_mode_implemented = false
|
|
baseline_file_committed = false
|
|
unit_tests_passing = false
|
|
|
|
[tasks]
|
|
t0_1 = { status = "completed", commit_sha = "", description = "Create state.toml" }
|
|
t0_2 = { status = "in_progress", commit_sha = "", description = "Create empty scripts/audit_license_cve.py" }
|
|
t0_3 = { status = "in_progress", commit_sha = "", description = "Create empty tests/test_audit_license_cve.py" }
|