Address various issues through the use of Cargo deny. #862
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Licensing compliance enforcement (needs to be reviewed). * Banning the use of OpenSSL altogether, to prevent problems with dynamic libraries. CI/CD still needs to be addressed here. Also, there is a package that is GPL 3.0 and therefore we cannot use it. This package is pulled in by `chrome_headless` and therefore we should remove that.
NikolaMilosa
approved these changes
Sep 5, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
CI/CD still needs to be addressed here.
Also, there is a package that is GPL 3.0 and therefore we cannot use it. This package is pulled in by
chrome_headlessand therefore we should remove that (to my understanding the screenshotting functionality doesn't currently work anyway). If we really want that, we should consider rearchitecting that functionality to be a separate program that gets invoked viaexecve()from the qualifier and takes the screenshots autonomously during qualification; that way, that program does not force the entire code base to link with the GPL librarychrome_headlessincludes, which is incompatible with the qualifier code. We will then obviously have to add a screenshot-program-specific exception for that one indeny.toml, which is a nice self-referential reference, so that we can deny while we deny.