Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pass license to OCI image metadata #51

Open
joonas-fi opened this issue Jan 25, 2024 · 2 comments
Open

Pass license to OCI image metadata #51

joonas-fi opened this issue Jan 25, 2024 · 2 comments
Labels
enhancement New feature or request

Comments

@joonas-fi
Copy link
Member

joonas-fi commented Jan 25, 2024

Cannot take this from GitHub's API because:

  1. Vendor lock-in
  2. It is not built for current revision
    • Thus on commit where we'd be changing the license, the built image could still be built with the outdated license info.

Idea: have this knowledge be stored in turbobob.json (based on autodetection?) along with some digest of the LICENSE file so we could detect if info is outdated.

@joonas-fi joonas-fi added the enhancement New feature or request label Jan 25, 2024
@joonas-fi joonas-fi changed the title Pass license from OCI image metadata Pass license to OCI image metadata Jan 27, 2024
@joonas-fi
Copy link
Member Author

It is not built for current revision

OTOH the approach is ok for https://github.com/docker/metadata-action so could be OK for us until we have time to implement more robust way?

@joonas-fi
Copy link
Member Author

This is being worked on in branch: https://github.com/function61/turbobob/tree/feature/license-metadata-and-detector

The above mentioned autodetection adds ~ 12 MB to binary size.

=> make license autodetection a container and only have container launch interface between Turbo Bob and the detector so we don't have to force-ship something that gets ran relatively rarely.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant