gcloud: build-time assert that the bundle LICENSE stays Apache (inbox#284) - #437
gcloud: build-time assert that the bundle LICENSE stays Apache (inbox#284)#437bryan-minimal wants to merge 1 commit into
Conversation
…x#284) Resolves the #284 gcloud verify item: the bundle's own LICENSE declares Apache-2.0 for the CLI and its source; the ToS language in it governs use of GCP services, not redistribution of the CLI - so public-cache redistribution is fine. Tom's suggestion: guard that conclusion at build time - if Google ever ships the bundle under different terms, the build fails loudly and the redistribution question gets re-audited rather than silently shipping. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe gcloud build script now verifies that the extracted ChangesGCloud license verification
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
Folded into #434 (the in-flight gcloud 576.0.0 bump) via cherry-pick — the assert rides the rebuild the version bump already pays for. Same change, one rebuild instead of two. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/gcloud/build.sh`:
- Around line 17-20: Update the license validation grep in the build script to
require the canonical “Apache License, Version 2.0” marker or an equivalent
authoritative SPDX identifier, rather than the generic “Apache License” text.
Preserve the existing failure message and exit behavior when the specific
Apache-2.0 declaration is absent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 6d2b4c79-9e1d-4d56-967c-9a4c3a96a04a
📒 Files selected for processing (1)
packages/gcloud/build.sh
| grep -q "Apache License" google-cloud-sdk/LICENSE || { | ||
| echo "gcloud bundle LICENSE no longer mentions the Apache License — re-audit redistribution (gominimal/inbox#284)" >&2 | ||
| exit 1 | ||
| } |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Check for Apache License 2.0 specifically.
The PR objective is to detect any change away from Apache-2.0, but grep -q "Apache License" also passes licenses or notices that mention Apache License without declaring Version 2.0. Match the canonical Apache License, Version 2.0 marker (or an equivalent authoritative SPDX marker) so a changed license cannot bypass the re-audit.
Proposed fix
-grep -q "Apache License" google-cloud-sdk/LICENSE || {
+grep -Fq "Apache License, Version 2.0" google-cloud-sdk/LICENSE || {📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| grep -q "Apache License" google-cloud-sdk/LICENSE || { | |
| echo "gcloud bundle LICENSE no longer mentions the Apache License — re-audit redistribution (gominimal/inbox#284)" >&2 | |
| exit 1 | |
| } | |
| grep -Fq "Apache License, Version 2.0" google-cloud-sdk/LICENSE || { | |
| echo "gcloud bundle LICENSE no longer mentions the Apache License — re-audit redistribution (gominimal/inbox#284)" >&2 | |
| exit 1 | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/gcloud/build.sh` around lines 17 - 20, Update the license validation
grep in the build script to require the canonical “Apache License, Version 2.0”
marker or an equivalent authoritative SPDX identifier, rather than the generic
“Apache License” text. Preserve the existing failure message and exit behavior
when the specific Apache-2.0 declaration is absent.
Resolves the #284 gcloud verify item: the bundle's own LICENSE declares
Apache-2.0 for the CLI and its source; the ToS language in it governs use of
GCP services, not redistribution of the CLI - so public-cache redistribution
is fine. Tom's suggestion: guard that conclusion at build time - if Google
ever ships the bundle under different terms, the build fails loudly and the
redistribution question gets re-audited rather than silently shipping.
Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Summary by CodeRabbit