Skip to content

OSADL project-license check improvements #11996

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sschuberth wants to merge 3 commits into
base: main
Choose a base branch
from
Open

OSADL project-license check improvements #11996

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
499a8b6
test(evaluator): Use more varying licenses for OSADL tests
sschuberth Jun 5, 2026
da44e0f
refactor(evaluator): Rename the existing OSADL rule
sschuberth Jul 27, 2023
2f04914
docs(evaluator): Add a Mermaid diagram for OSADL checks
sschuberth Jun 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions evaluator/src/main/resources/rules/project-license.mmd
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
graph TD
Root["my-oss-project (outbound license)"]

Root --> Core[core:1.2.0]
Root --> Utils[utils:3.0.1]

Core --> Auth[auth:2.1.0]
Core --> Database[database:4.0.0]
Utils --> JSON[json:1.1.5]

Auth --> Crypto[crypto:1.0.2]
Database --> Pool[pool:2.5.0]

classDef default fill:#5CB85C,stroke:#333,stroke-width:1px,color:#fff;
classDef root fill:#4A90E2,stroke:#333,stroke-width:2px,color:#fff;

class Root root;

Core -- inbound license --> Root
Utils -. inbound license .-> Root
Auth -. inbound license .-> Root
Database -. inbound license .-> Root
JSON -. inbound license .-> Root
Crypto -. inbound license .-> Root
Pool -. inbound license .-> Root
6 changes: 3 additions & 3 deletions .../src/main/resources/rules/osadl.rules.kts → ...resources/rules/project-license.rules.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@
//
// Use this rule like:
//
// $ ort evaluate -i scanner/src/funTest/resources/scanner-integration-all-pkgs-expected-ort-result.yml --rules-resource /rules/osadl.rules.kts
// $ ort evaluate -i scanner/src/funTest/resources/scanner-integration-all-pkgs-expected-ort-result.yml --rules-resource /rules/project-license.rules.kts

import org.ossreviewtoolkit.evaluator.osadl.Compatibility
import org.ossreviewtoolkit.evaluator.osadl.CompatibilityMatrix
Expand All @@ -37,7 +37,7 @@ val ruleSet = ruleSet(ortResult, licenseInfoResolver) {
val licenseView = LicenseView.CONCLUDED_OR_DECLARED_AND_DETECTED

// Define a rule that is executed for each dependency.
dependencyRule("OSADL_MATRIX_COMPATIBILITY") {
dependencyRule("OSADL_PROJECT_LICENSE_DEPENDENCY_RULE") {

@fviernau fviernau Jun 12, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In ort-config we always use the same name for the outer rule and the innder rule, and outer and inner always correspond to the "same" rule.

Should we follow this pattern here too?

Imho this is less misleading, as currently this is IIUC semantically just one rule, and no potentially flagged violation would ever use "OSADL_PROJECT_LICENSE_DEPENDENCY_RULE" as the source.

What do you think?

// Requirements for the rule to trigger a violation.
require {
-isExcluded()
Expand All @@ -49,7 +49,7 @@ val ruleSet = ruleSet(ortResult, licenseInfoResolver) {
val outboundLicenses = projectLicenseInfo.licenses.map { it.license }

// Define a rule that is executed for each license of the dependency.
licenseRule("OSADL_PROJECT_LICENSE_COMPATIBILITY", licenseView) {
licenseRule("OSADL_PROJECT_LICENSE_RULE", licenseView) {

@fviernau fviernau Jun 12, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't get the idea why the new name is better.

The intention is to check if license in any dependency is compatible with the project license. So, the name before fit better?

// Requirements for the rule to trigger a violation.
require {
-isExcluded()
Expand Down
31 changes: 13 additions & 18 deletions evaluator/src/test/kotlin/EvaluatorTest.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,8 +112,8 @@ class EvaluatorTest : WordSpec({
}
}

"OSADL compliance rules" should {
val script = getResource("/rules/osadl.rules.kts")
"OSADL project-license rules" should {
val script = getResource("/rules/project-license.rules.kts")

"return no violation for compatible licenses" {
val compatibleOrtResult = ortResult {
Expand All @@ -130,14 +130,14 @@ class EvaluatorTest : WordSpec({
}

project("Maven:group:project-bar:1") {
license = "AGPL-3.0-only"
license = "GPL-3.0-only"

pkg("Maven:group:package-bar-direct:1") {
license = "AGPL-3.0-only"
license = "Apache-2.0"
}

pkg("Maven:group:package-bar-direct:2") {
license = "AGPL-3.0-or-later"
license = "MIT"
}
}
}
Expand All @@ -162,14 +162,14 @@ class EvaluatorTest : WordSpec({
}

project("Maven:group:project-bar:1") {
license = "AGPL-3.0-or-later"
license = "Apache-2.0"

pkg("Maven:group:package-bar-direct:1") {
license = "AGPL-3.0-only"
license = "GPL-3.0-only"
}

pkg("Maven:group:package-bar-direct:2") {
license = "AGPL-3.0-only"
license = "MIT"
}
}
}
Expand All @@ -182,16 +182,11 @@ class EvaluatorTest : WordSpec({
"'Maven:group:package-foo-transitive:1'. Software under a copyleft license such as the " +
"AGPL-3.0-only license normally cannot be redistributed under another copyleft license such " +
"as the AGPL-3.0-or-later license, except if it were explicitly permitted in the licenses.",
"The outbound license AGPL-3.0-or-later of project 'Maven:group:project-bar:1' is incompatible " +
"with the inbound license AGPL-3.0-only of its dependency " +
"'Maven:group:package-bar-direct:1'. Software under a copyleft license such as the " +
"AGPL-3.0-only license normally cannot be redistributed under another copyleft license such " +
"as the AGPL-3.0-or-later license, except if it were explicitly permitted in the licenses.",
"The outbound license AGPL-3.0-or-later of project 'Maven:group:project-bar:1' is incompatible " +
"with the inbound license AGPL-3.0-only of its dependency " +
"'Maven:group:package-bar-direct:2'. Software under a copyleft license such as the " +
"AGPL-3.0-only license normally cannot be redistributed under another copyleft license such " +
"as the AGPL-3.0-or-later license, except if it were explicitly permitted in the licenses."
"The outbound license Apache-2.0 of project 'Maven:group:project-bar:1' is incompatible with the " +
"inbound license GPL-3.0-only of its dependency 'Maven:group:package-bar-direct:1'. Software " +
"under a copyleft license such as the GPL-3.0-only license normally cannot be redistributed " +
"under a non-copyleft license such as the Apache-2.0 license, except if it were explicitly " +
"permitted in the licenses."
)
}

Expand Down
2 changes: 1 addition & 1 deletion integrations/jenkins/Jenkinsfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -851,7 +851,7 @@ pipeline {
RULES_OPTIONS=""

if [ "$USE_OSADL_RULES" = "true" ]; then
RULES_OPTIONS="$RULES_OPTIONS --rules-resource /rules/osadl.rules.kts"
RULES_OPTIONS="$RULES_OPTIONS --rules-resource /rules/project-license.rules.kts"
fi

if [ "$USE_CONFIG_RULES" = "true" -a -f "$ORT_CONFIG_DIR/evaluator.rules.kts" ]; then
Expand Down
2 changes: 1 addition & 1 deletion plugins/commands/evaluator/src/test/kotlin/EvaluateCommandTest.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ class EvaluateCommandTest : StringSpec({
}

"If a rules resource is specified, the default rules file should not be required" {
val args = "--check-syntax --rules-resource /rules/osadl.rules.kts".split(' ')
val args = "--check-syntax --rules-resource /rules/project-license.rules.kts".split(' ')

ortConfigDirectory.resolve(ORT_EVALUATOR_RULES_FILENAME) shouldNot exist()
shouldNotThrow<FileNotFoundException> {
Expand Down
Loading