CI:

This repository contains a set of rules and tools for

• declaring metadata about packages, such as
  • the licenses the package is available under
  • the canonical package name and version
  • copyright information
  • ... and more TBD in the future
• gathering license declarations into artifacts to ship with code
• applying organization specific compliance constraints against the set of packages used by a target.
• producing SBOMs for built artifacts.

These is for learning about the problem space, and our approach to solutions. Concrete specifications will always appear in checked in code rather than documents.

• License Checking with Bazel.
• OSS Licenses and Bazel Dependency Management
• Adding OSS license declarations to Bazel