check-dependencies.sh (1906B)
1 #!/usr/bin/env bash 2 set -euo pipefail 3 4 cd "$(dirname "${BASH_SOURCE[0]}")/.." 5 6 require_command() { 7 command -v "$1" >/dev/null 2>&1 || { 8 echo "error: missing required command: $1" >&2 9 exit 1 10 } 11 } 12 13 require_command cargo 14 require_command cargo-audit 15 require_command jq 16 17 lockfiles=(Cargo.lock fuzz/Cargo.lock src-tauri/Cargo.lock) 18 for lockfile in "${lockfiles[@]}"; do 19 cargo audit --file "$lockfile" 20 done 21 22 manifests=(Cargo.toml fuzz/Cargo.toml src-tauri/Cargo.toml) 23 metadata_file="$(mktemp)" 24 trap 'rm -f "$metadata_file"' EXIT 25 26 for manifest in "${manifests[@]}"; do 27 cargo metadata --locked --format-version 1 --manifest-path "$manifest" | 28 jq -r '.packages[] | [.name, (.license // "MISSING"), (.source // "LOCAL")] | @tsv' 29 done | sort -u > "$metadata_file" 30 31 policy_failed=false 32 while IFS=$'\t' read -r package license source; do 33 case "$source" in 34 LOCAL|registry+https://github.com/rust-lang/crates.io-index) ;; 35 *) 36 echo "error: dependency ${package} uses unapproved source ${source}" >&2 37 policy_failed=true 38 ;; 39 esac 40 41 if [ "$license" = "MISSING" ]; then 42 echo "error: dependency ${package} has no declared license" >&2 43 policy_failed=true 44 continue 45 fi 46 47 license_tokens="$(printf '%s\n' "$license" | 48 sed -E 's/[()\/]/ /g; s/(^|[[:space:]])(AND|OR|WITH)([[:space:]]|$)/ /g')" 49 for license_token in $license_tokens; do 50 case "$license_token" in 51 0BSD|Apache-2.0|BSD-1-Clause|BSD-2-Clause|BSD-3-Clause|BSL-1.0|CC0-1.0|ISC|LGPL-2.1-or-later|MIT|MIT-0|MPL-2.0|NCSA|Unicode-3.0|Unlicense|Zlib|LLVM-exception) ;; 52 *) 53 echo "error: dependency ${package} uses unapproved license token ${license_token} (${license})" >&2 54 policy_failed=true 55 ;; 56 esac 57 done 58 done < "$metadata_file" 59 60 if [ "$policy_failed" = "true" ]; then 61 exit 1 62 fi 63 64 echo "Dependency audit, source policy, and license policy passed for all manifests."