1 //! Checks the licenses of third-party dependencies by inspecting vendors.
3 use std::collections::{BTreeSet, HashMap, HashSet};
6 use std::process::Command;
8 use serde::Deserialize;
11 const LICENSES: &[&str] = &[
18 "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT", // wasi license
24 /// These are exceptions to Rust's permissive licensing policy, and
25 /// should be considered bugs. Exceptions are only allowed in Rust
26 /// tooling. It is _crucial_ that no exception crates be dependencies
27 /// of the Rust runtime (std/test).
28 const EXCEPTIONS: &[&str] = &[
29 "mdbook", // MPL2, mdbook
30 "openssl", // BSD+advertising clause, cargo, mdbook
31 "pest", // MPL2, mdbook via handlebars
32 "arrayref", // BSD-2-Clause, mdbook via handlebars via pest
33 "thread-id", // Apache-2.0, mdbook
34 "toml-query", // MPL-2.0, mdbook
35 "is-match", // MPL-2.0, mdbook
36 "cssparser", // MPL-2.0, rustdoc
37 "smallvec", // MPL-2.0, rustdoc
38 "rdrand", // ISC, mdbook, rustfmt
39 "fuchsia-cprng", // BSD-3-Clause, mdbook, rustfmt
40 "fuchsia-zircon-sys", // BSD-3-Clause, rustdoc, rustc, cargo
41 "fuchsia-zircon", // BSD-3-Clause, rustdoc, rustc, cargo (jobserver & tempdir)
42 "cssparser-macros", // MPL-2.0, rustdoc
43 "selectors", // MPL-2.0, rustdoc
44 "clippy_lints", // MPL-2.0, rls
45 "colored", // MPL-2.0, rustfmt
46 "ordslice", // Apache-2.0, rls
47 "cloudabi", // BSD-2-Clause, (rls -> crossbeam-channel 0.2 -> rand 0.5)
48 "ryu", // Apache-2.0, rls/cargo/... (because of serde)
49 "bytesize", // Apache-2.0, cargo
50 "im-rc", // MPL-2.0+, cargo
51 "adler32", // BSD-3-Clause AND Zlib, cargo dep that isn't used
52 "constant_time_eq", // CC0-1.0, rustfmt
53 "utf8parse", // Apache-2.0 OR MIT, cargo via strip-ansi-escapes
54 "vte", // Apache-2.0 OR MIT, cargo via strip-ansi-escapes
55 "sized-chunks", // MPL-2.0+, cargo via im-rc
56 "bitmaps", // MPL-2.0+, cargo via im-rc
57 // FIXME: this dependency violates the documentation comment above:
58 "fortanix-sgx-abi", // MPL-2.0+, libstd but only for `sgx` target
59 "dunce", // CC0-1.0 mdbook-linkcheck
60 "codespan-reporting", // Apache-2.0 mdbook-linkcheck
61 "codespan", // Apache-2.0 mdbook-linkcheck
64 /// Which crates to check against the whitelist?
65 const WHITELIST_CRATES: &[CrateVersion<'_>] =
66 &[CrateVersion("rustc", "0.0.0"), CrateVersion("rustc_codegen_llvm", "0.0.0")];
68 /// Whitelist of crates rustc is allowed to depend on. Avoid adding to the list if possible.
69 const WHITELIST: &[Crate<'_>] = &[
71 Crate("aho-corasick"),
72 Crate("annotate-snippets"),
78 Crate("backtrace-sys"),
85 Crate("chalk-engine"),
86 Crate("chalk-macros"),
89 Crate("compiler_builtins"),
92 Crate("crossbeam-deque"),
93 Crate("crossbeam-epoch"),
94 Crate("crossbeam-queue"),
95 Crate("crossbeam-utils"),
103 Crate("fortanix-sgx-abi"),
104 Crate("fuchsia-zircon"),
105 Crate("fuchsia-zircon-sys"),
113 Crate("kernel32-sys"),
114 Crate("lazy_static"),
119 Crate("log_settings"),
125 Crate("miniz_oxide"),
126 Crate("miniz_oxide_c_api"),
130 Crate("parking_lot"),
131 Crate("parking_lot_core"),
133 Crate("polonius-engine"),
135 Crate("proc-macro2"),
137 Crate("quick-error"),
140 Crate("rand_chacha"),
145 Crate("rand_xorshift"),
146 Crate("redox_syscall"),
147 Crate("redox_termios"),
149 Crate("regex-syntax"),
150 Crate("remove_dir_all"),
151 Crate("rustc-demangle"),
153 Crate("rustc-rayon"),
154 Crate("rustc-rayon-core"),
155 Crate("rustc_version"),
159 Crate("semver-parser"),
161 Crate("serde_derive"),
163 Crate("stable_deref_trait"),
165 Crate("synstructure"),
171 Crate("thread_local"),
173 Crate("unicode-normalization"),
174 Crate("unicode-script"),
175 Crate("unicode-security"),
176 Crate("unicode-width"),
177 Crate("unicode-xid"),
178 Crate("unreachable"),
179 Crate("utf8-ranges"),
181 Crate("version_check"),
185 Crate("winapi-build"),
186 Crate("winapi-i686-pc-windows-gnu"),
187 Crate("winapi-util"),
188 Crate("winapi-x86_64-pc-windows-gnu"),
193 // Some types for Serde to deserialize the output of `cargo metadata` to.
195 #[derive(Deserialize)]
200 #[derive(Deserialize)]
202 nodes: Vec<ResolveNode>,
205 #[derive(Deserialize)]
208 dependencies: Vec<String>,
211 /// A unique identifier for a crate.
212 #[derive(Copy, Clone, PartialOrd, Ord, PartialEq, Eq, Debug, Hash)]
213 struct Crate<'a>(&'a str); // (name)
215 #[derive(Copy, Clone, PartialOrd, Ord, PartialEq, Eq, Debug, Hash)]
216 struct CrateVersion<'a>(&'a str, &'a str); // (name, version)
219 pub fn id_str(&self) -> String {
220 format!("{} ", self.0)
224 impl<'a> CrateVersion<'a> {
225 /// Returns the struct and whether or not the dependency is in-tree.
226 pub fn from_str(s: &'a str) -> (Self, bool) {
227 let mut parts = s.split(' ');
228 let name = parts.next().unwrap();
229 let version = parts.next().unwrap();
230 let path = parts.next().unwrap();
232 let is_path_dep = path.starts_with("(path+");
234 (CrateVersion(name, version), is_path_dep)
237 pub fn id_str(&self) -> String {
238 format!("{} {}", self.0, self.1)
242 impl<'a> From<CrateVersion<'a>> for Crate<'a> {
243 fn from(cv: CrateVersion<'a>) -> Crate<'a> {
248 /// Checks the dependency at the given path. Changes `bad` to `true` if a check failed.
250 /// Specifically, this checks that the license is correct.
251 pub fn check(path: &Path, bad: &mut bool) {
253 let path = path.join("../vendor");
254 assert!(path.exists(), "vendor directory missing");
255 let mut saw_dir = false;
256 for dir in t!(path.read_dir()) {
260 // Skip our exceptions.
261 let is_exception = EXCEPTIONS.iter().any(|exception| {
262 dir.path().to_str().unwrap().contains(&format!("vendor/{}", exception))
268 let toml = dir.path().join("Cargo.toml");
269 *bad = !check_license(&toml) || *bad;
271 assert!(saw_dir, "no vendored source");
274 /// Checks the dependency of `WHITELIST_CRATES` at the given path. Changes `bad` to `true` if a
277 /// Specifically, this checks that the dependencies are on the `WHITELIST`.
278 pub fn check_whitelist(path: &Path, cargo: &Path, bad: &mut bool) {
279 // Get dependencies from Cargo metadata.
280 let resolve = get_deps(path, cargo);
282 // Get the whitelist in a convenient form.
283 let whitelist: HashSet<_> = WHITELIST.iter().cloned().collect();
285 // Check dependencies.
286 let mut visited = BTreeSet::new();
287 let mut unapproved = BTreeSet::new();
288 for &krate in WHITELIST_CRATES.iter() {
289 let mut bad = check_crate_whitelist(&whitelist, &resolve, &mut visited, krate, false);
290 unapproved.append(&mut bad);
293 if !unapproved.is_empty() {
294 println!("Dependencies not on the whitelist:");
295 for dep in unapproved {
296 println!("* {}", dep.id_str());
301 check_crate_duplicate(&resolve, bad);
304 fn check_license(path: &Path) -> bool {
306 panic!("{} does not exist", path.display());
308 let contents = t!(fs::read_to_string(&path));
310 let mut found_license = false;
311 for line in contents.lines() {
312 if !line.starts_with("license") {
315 let license = extract_license(line);
316 if !LICENSES.contains(&&*license) {
317 println!("invalid license {} in {}", license, path.display());
320 found_license = true;
324 println!("no license in {}", path.display());
331 fn extract_license(line: &str) -> String {
332 let first_quote = line.find('"');
333 let last_quote = line.rfind('"');
334 if let (Some(f), Some(l)) = (first_quote, last_quote) {
335 let license = &line[f + 1..l];
338 "bad-license-parse".into()
342 /// Gets the dependencies of the crate at the given path using `cargo metadata`.
343 fn get_deps(path: &Path, cargo: &Path) -> Resolve {
344 // Run `cargo metadata` to get the set of dependencies.
345 let output = Command::new(cargo)
347 .arg("--format-version")
349 .arg("--manifest-path")
350 .arg(path.join("../Cargo.toml"))
352 .expect("Unable to run `cargo metadata`")
354 let output = String::from_utf8_lossy(&output);
355 let output: Output = serde_json::from_str(&output).unwrap();
360 /// Checks the dependencies of the given crate from the given cargo metadata to see if they are on
361 /// the whitelist. Returns a list of illegal dependencies.
362 fn check_crate_whitelist<'a>(
363 whitelist: &'a HashSet<Crate<'_>>,
364 resolve: &'a Resolve,
365 visited: &mut BTreeSet<CrateVersion<'a>>,
366 krate: CrateVersion<'a>,
367 must_be_on_whitelist: bool,
368 ) -> BTreeSet<Crate<'a>> {
369 // This will contain bad deps.
370 let mut unapproved = BTreeSet::new();
372 // Check if we have already visited this crate.
373 if visited.contains(&krate) {
377 visited.insert(krate);
379 // If this path is in-tree, we don't require it to be on the whitelist.
380 if must_be_on_whitelist {
381 // If this dependency is not on `WHITELIST`, add to bad set.
382 if !whitelist.contains(&krate.into()) {
383 unapproved.insert(krate.into());
387 // Do a DFS in the crate graph (it's a DAG, so we know we have no cycles!).
388 let to_check = resolve
391 .find(|n| n.id.starts_with(&krate.id_str()))
392 .expect("crate does not exist");
394 for dep in to_check.dependencies.iter() {
395 let (krate, is_path_dep) = CrateVersion::from_str(dep);
397 let mut bad = check_crate_whitelist(whitelist, resolve, visited, krate, !is_path_dep);
398 unapproved.append(&mut bad);
404 fn check_crate_duplicate(resolve: &Resolve, bad: &mut bool) {
405 const FORBIDDEN_TO_HAVE_DUPLICATES: &[&str] = &[
406 // These two crates take quite a long time to build, so don't allow two versions of them
407 // to accidentally sneak into our dependency graph, in order to ensure we keep our CI times
412 let mut name_to_id: HashMap<_, Vec<_>> = HashMap::new();
413 for node in resolve.nodes.iter() {
414 name_to_id.entry(node.id.split_whitespace().next().unwrap()).or_default().push(&node.id);
417 for name in FORBIDDEN_TO_HAVE_DUPLICATES {
418 if name_to_id[name].len() <= 1 {
421 println!("crate `{}` is duplicated in `Cargo.lock`", name);
422 for id in name_to_id[name].iter() {
423 println!(" * {}", id);