diff --git a/requirements-lint.txt b/requirements-lint.txt index fe7c9ef..bfd8d50 100644 --- a/requirements-lint.txt +++ b/requirements-lint.txt @@ -128,64 +128,64 @@ diff-cover==10.5.1 \ # # pip install --dry-run --report - --only-binary=:all: --python-version 3.14 \ # --platform manylinux2014_x86_64 --target /tmp/x -r requirements-lint.txt -ast_serialize==0.8.0 \ - --hash=sha256:0485a25ef519c62e749ee3c1ad8070e591b380d67226349eb5a70b228dc1ac4a \ - --hash=sha256:057769b5921336eb2d9124f2a731b42ed05ffdac559b840dbdf6f3937cf153dc \ - --hash=sha256:1f9caa63fad8241257ae401b5ff0a64026c6adb36b8e86cbe8782d9ea505daf6 \ - --hash=sha256:252f883290d1cdb728eb7fe1d9a7221b88af5a329aae0bc91ddee4dafb820331 \ - --hash=sha256:2880350b13d3eae69a0d70bc1fb6c9bfaca4dbd0e20ba8cd1aa483080b56ff06 \ - --hash=sha256:293cc1c5bfa741f8e3fbe8175b9c07beee487c9a6fdbb25a5acad9f1df2d30a9 \ - --hash=sha256:2d39a56282cfcc0d8eeea37267c754be59c98d48505c23b1dae5c6011f3813dd \ - --hash=sha256:2efa40b068197d5efb62655b43baadb842ed71c4958cccd3e8b86a35726f0119 \ - --hash=sha256:31883542dd6c94d178f5db3d32fbd69c5eb88b3a7c018e7ac8cc0c45195ddbed \ - --hash=sha256:3926fa117b5e65019853a2969966d11c7175af377a3425991f3fe73784412405 \ - --hash=sha256:39e92ff8e8cb45947fe9007174b2950e1fb098e6abd00266a13cd3bcf6675068 \ - --hash=sha256:3a8660fe66667b76a6e9dccd1d33e66b229fde3b308db991c041609226c005b6 \ - --hash=sha256:3ccebbed24f1281062d5852353c72c47502955926cfcb8345ffb3a44d87ff3d3 \ - --hash=sha256:3d822605fa7bb326ef868d25fafced7fc660fa46d9b90c02ea86d5e2f5d325f7 \ - --hash=sha256:40a57b73731be45da4fa41430c4d5dc94a24b3a4faba7b9e069978c0402064ea \ - --hash=sha256:43dd6d596879bb1cb8a12cc9dae7bb10090a39a35883026c24f82488a195619a \ - --hash=sha256:485f1113af805e9e170b95ef993ca3fbd4f89c04bab25c58b4fc632d854801ab \ - --hash=sha256:4c38b915511e32bc718c49dbce98ff9af36bac0ad6a604f58000cd5e3aecdba7 \ - --hash=sha256:4ca7e6fd1ad845d1cc649dc2ecd499db2f8f46af5bf8da7b70dd858774cc038b \ - --hash=sha256:5075b9da3ef807eda752502446dfecea3b381c4900b7e27a5d5f4f899eb39951 \ - --hash=sha256:54f95b486018d262bcb387a9afd96f0da74508b442762b80c769454a6fbb3ee3 \ - --hash=sha256:6102f2f985c2e542be85cd857678ec9356fefa792b93cadfadd31139f5696f27 \ - --hash=sha256:6479d9722a4cd21b578f5478074c41e6169f04811996ec881655560f703a5bba \ - --hash=sha256:6c37c43e4004dfb42d321ddedc569dc17ff4259296f3af577c9ea46a809bc010 \ - --hash=sha256:6f18048fe9f6dd266bd577cdec48bdcecb74faaa01fe941324435483b013ed2a \ - --hash=sha256:77308ae6c5cf5264cc0f01a7c556ec77a9e68eb1f61b093534d698139fdc3b14 \ - --hash=sha256:861794565b06337005c1447ef23103a3d5a627d08bdc827870d00d0b28ef5f51 \ - --hash=sha256:86b8a1e6d90467345356098b040150e82fbc26d24a7a202224b13dc1f6264ca0 \ - --hash=sha256:8c9d537f59e936392cfd3597789d1390304dd659efc3c486ce7f40fb6b8a9f53 \ - --hash=sha256:8d53a23f27e1ed3a36b2d26fd2a1a6228c8e85a1ed62ff7cdb44bd610769f20a \ - --hash=sha256:9118ad3e369727060b2696fc4078f250ecffca4248ba87f537f55cea9f9dce06 \ - --hash=sha256:96abc072ad29db8d02194afd47d68987322622787daceae82398d7b69f3ba2e6 \ - --hash=sha256:9830ff7e764f74d9eefb01170c61a9f0fd2c027dac5fcb72e064decd57d56371 \ - --hash=sha256:9a2ef9cf12f2de4f1028c42c1dd7d775255e0fb3e5bb48896c97e35ef52366fe \ - --hash=sha256:9d187197d234aa45d6cfa2b096be5f666e8cc2e7eb3722d0ab8926293cf5720c \ - --hash=sha256:9da7330f3e235bf7da89b8d39205c6350fc0c08a85379743f2df9fff87d6d980 \ - --hash=sha256:a02cbed7d8bfdcdee88edaac12bd50d53d9953aaa2e1852ef078625be5f1c0b5 \ - --hash=sha256:a63bed264e818cd83eec11feed0f50aa162542b91132ef58afebc857182763a5 \ - --hash=sha256:ab0f9a59f7d63d0d441b56b9a818b273705264352d5115cfee12e940e816d958 \ - --hash=sha256:ac4f0a83c55a9b782f79ad55a5247b7db123c1db405959791c2ef886e9710c9f \ - --hash=sha256:b2a5978662fd4db463dfb4b974d2b10ac6430b98f5333aabc7051909df3561d0 \ - --hash=sha256:bd84d60bca7079e741be4ac5dbe237751a59d7f6f9f0126b11880d63822cbe16 \ - --hash=sha256:c85d8d18db5b2dfcb3b7e38a4d600ca35504c0ed8a6f75cd1c811e4ffe248a15 \ - --hash=sha256:d8b3c8eee4c1baef9d4e84d2a59a805501617127be42615cb48970b15b0892b6 \ - --hash=sha256:db1b957291bca08c7e72f43a12357b2948e20775d970e3fc3dac0aa3160ab725 \ - --hash=sha256:ddd3b61f45c132da66c5476b281891e08c1fd87fbdabe8a6973e1622efc85f06 \ - --hash=sha256:e0910c3442a75216dde0f102d854ba2aaa71d2482e0ee213630b9bf29584fba3 \ - --hash=sha256:e1bd223df0f6c96b396975fa604cb33bce53d9b4a0185490be4c4a289f7c9c87 \ - --hash=sha256:e7266307e5fba39836edb79def8608887af48820508bff3c5f2941e1e04d1534 \ - --hash=sha256:e94f9121d13fa36cbf21314783c77d05ae3a0868decd18cf5233fdcc6de49ac8 \ - --hash=sha256:f0190a33d7f97c65e9069f7a7f40499eea6b5cbe260c558378109caf20ce934b \ - --hash=sha256:f3186969ee66a9863b00acc6523ace44c56974eecb348a7ea4b228d9f0b80e19 \ - --hash=sha256:f359df4bd921918af8bebd142a376c77511d7151cc8ba852760b587b5a4a54f3 \ - --hash=sha256:f7cc5f10386994c0f4844f1e6d6a97127e9b478660eb6dec2b257644f0acab64 \ - --hash=sha256:fa70ed4dea0bb18b30a1789c77baa701d0ef30c474f2ccabdea61e25623a8827 \ - --hash=sha256:fdc0d5b18ff8fb364e87923e47c0a91d0d69dbcaeaa274591f7fd26892cc3a3a \ - --hash=sha256:ffa5e7cb08f96fed9121f77b224151e41caf88feab9d652bb46c78202b6fbeda +ast_serialize==0.11.1 \ + --hash=sha256:00adb748034c7b1938ec56925f9f6230ffcd9c56d47355fe32485df29b90b977 \ + --hash=sha256:021afb3482d27d1dace9c8999724a13083e96c7ece785e53e418bf5df3b50e0a \ + --hash=sha256:0bc94b81878a3f999fe4cdb606bf00ef7dff6b4f66d0e089b2cf7bfc00d59beb \ + --hash=sha256:110386eebccf200446d5f4dcc215f80866a5d3d3d054d3ced6ec1bf386cd3f02 \ + --hash=sha256:13903a3f212ab9e5d05a6c3f2337288f4f8f4c18e6ab3817417ae7a3d46dee14 \ + --hash=sha256:1e8d20700766171a8a17f89cf53d7bd9712c509460d28a51f7f98340577b78aa \ + --hash=sha256:20b3371c0403099cd55d59f4bcedb6d3994d9db3fa41711c648760a89ef2a575 \ + --hash=sha256:27eef0739e0110f5db1ff5dfa38b3dadfcb6f0c31975a2b412f9f2bd72139cea \ + --hash=sha256:2db9df3bca1431da25946ee8f2c50df01212e34e6029532bc90b92d05fa8d7a0 \ + --hash=sha256:2f8f33e416a4c7aad12ad757e895c676e953b4027b80b90718dccea83d45111a \ + --hash=sha256:311333c5f58f55fc04121be2c5adffa42a19e1038a43a2cef862fdf58c45bf4f \ + --hash=sha256:31df8649761d5cb6eb0de2209bd4a167c7477c0516147c70c0b2f5bddc7839bb \ + --hash=sha256:341dfc9e6b4e47e5c37e1b7257a77d39f407cf49a371ee90225ab624c2fe8b36 \ + --hash=sha256:38f7141881e783bccc362d201d7fd7437934216b669b9fef39febc2f63fd2d9b \ + --hash=sha256:3eebd3dd25a81839ac7d25b5f3fb3527f6141b35eca29f63d2613fe6254307fd \ + --hash=sha256:4ab6df9898600ff45149b86c12bb5aa3359cc71843ad99ad0c924d11392469ab \ + --hash=sha256:4dd7218870c203eff4533cfc04a39f29077d6789b20f5b746e7648fe5762a548 \ + --hash=sha256:57b7d52d1f5c92905cd648bda9efc83cac33097de1e5bb68de8feca9b5f7e87a \ + --hash=sha256:5c2358b341aca08bd2e1005713bc480bc06eee9f345b67fcb826829aa7b8d0d3 \ + --hash=sha256:651a7890558896c3e08089e51ab3b3a43710eab15b72ad861c400bc9a51923ba \ + --hash=sha256:65c836d1ab7af65e64a1dd73de82572566e838dd27529b1124eac0ac86f35e76 \ + --hash=sha256:68929da7fb1c7375f69641baac9519d5c41ee441cd09a591ea5dfc83107ffe6f \ + --hash=sha256:6a57e0e025e9dcee48e466b3cf909178e298d238148664e796fc0f60ded5e52e \ + --hash=sha256:6b43f5a9b9a8dd20ba3124914e63aa7d7427de761ac849081cda403c2112fda0 \ + --hash=sha256:74093ed682ba58456f0d4450da7fb62b826fddd97824d44fc4a81ca6e0bf9e23 \ + --hash=sha256:753afabcc4abf295f515ea33185cf997a1990b88a29d3a3336a9acf62ea85950 \ + --hash=sha256:7b524cb1b08e15db0f116075c39ab51674b6d3c8103ec1a59c8ca464be83e28a \ + --hash=sha256:7b9a6089f1337838492b217707e9a55d0b9b407fe9169a960fa12282abf2234c \ + --hash=sha256:82359d00ea808c260c327e43955c0190bb7baef152a01ae0b5c74d05387b9552 \ + --hash=sha256:8945557ed3015173dbf8d44184da9621add9162720acbc0ac4832b5a091b4e8a \ + --hash=sha256:8b54e44763a851c336ca137c60a2434511f0d155e0b924ef374bfbc8d8db8927 \ + --hash=sha256:8ca9e48edf246f09fd9bdb64fbd9cd8d18cd2a69ffc24d44891466e17595094f \ + --hash=sha256:98b8aba6bb682b9e8859c628382b4881c0600b28056d63c3168c227c449f3284 \ + --hash=sha256:9961abcb93bf03652ab09c00862a2396abacd57551c769ad34490a2ae508a61d \ + --hash=sha256:a015ede631eeb098a23de8ec0cfe11a1dd02159ab7a26bdc7c6bde2befbbc7b4 \ + --hash=sha256:a579ea6f473aab3958a64734194b22fbaec108ec45d994c28d3bd721e1e1da32 \ + --hash=sha256:aa8d0a9f6d02e7626cdf540555bc2f5313eabe803dcca04854fc628ddf4b1058 \ + --hash=sha256:aecb606f67f21fd1c0ffba1826470d2ee400e41b23881ad9a1b2157306865b1a \ + --hash=sha256:b391becd31e9889da438d388aac0362e3dfd222affbe45d920580c351486c787 \ + --hash=sha256:b77d6a2267227d68d8221cfca177f8c6d9f68019f3250401d0355d2638db9fb9 \ + --hash=sha256:b9cbed53bb8992b72e587dd47d0ca71703f5f715420f48ed57587c06c2fcd213 \ + --hash=sha256:b9e61143a5904f46daa0cde74ba60d3b7c0e3e000752ee138e2bc68e126a5803 \ + --hash=sha256:c1dc60251d93beff32d4147ecd4ccc518b0f022a900093f6f3021c2012416f0f \ + --hash=sha256:cc1a78b913f8665dda145999b1b4805ad2ef442ecbe3b819512cf7f95e70498a \ + --hash=sha256:cc5db2983805f6be786488aac8c5998d5b71965488d1b18c44d435a2205a5cb4 \ + --hash=sha256:d1ef9c478d8c8ca83499704d13e5ac32c840ed7ca7884aaaf716166aca5a2806 \ + --hash=sha256:daec16b026c5741950a00c708acdf698c4f17babbe4829dd8232324822e9514f \ + --hash=sha256:e209a797fdf8680d58d2e969a9ddb25058ea682f6cff59dbabc98d8aef4e0db1 \ + --hash=sha256:e47b9b028efbc0486263a49f782ad0ae3e879855fe5a2897b59feefb78e1c40c \ + --hash=sha256:e5a9c53e64732118ae8235d0e57eb90e2333e90ff749a1a7dca6f8bfdfa5200e \ + --hash=sha256:e68ac7d7fd1a5d42a3a6d726d7cc8a7e0c9987934f11c6a5162aa2cf68e81e24 \ + --hash=sha256:ed449d786b9032a7b85fcd6c2f7f54c4cd0e1e1ad254d396805ff922096bf08d \ + --hash=sha256:ef3950747f3a588f692cf4d6f2937eedd1a2d5e199f863af29e8ec7da78a4f36 \ + --hash=sha256:f35bb9ddeed4008c7d3e272dd1999885d712e1ce623b0a65ba8a8ed1d51c35cf \ + --hash=sha256:f7ca1557553fdab313999ad69156de154ff87152cae963698be2e765164bb6c0 \ + --hash=sha256:f9454960bbf185d33c669ccd5c9b76c96709a4542a95a65e27342c4d10dd8e20 \ + --hash=sha256:ff8ddc1453bfe7934292409c7b8e9f68b0a6cff4e4c12535e4b4a66fd83aca0c chardet==7.6.0 \ --hash=sha256:089e3bb81a0a07e94f15461ded9f9ee66d349615b1a9fd557d4de1003e2fc12e \ --hash=sha256:0ad9bc6dab4f338673353fa3f0dc96122f559aaf746087408106e2fcbf132fe8 \ diff --git a/tests/test_dependency_gate.py b/tests/test_dependency_gate.py index 7c26f2a..f672774 100644 --- a/tests/test_dependency_gate.py +++ b/tests/test_dependency_gate.py @@ -75,6 +75,16 @@ def test_an_exception_is_a_named_package_with_a_reason_beside_it(): check("the same licence on any other package still blocks", len(blocked) == 1 and blocked[0][0] == "denied", f"({blocked})") + # The other shape an entry covers: a licence GitHub could not determine at + # all. ast_serialize is MIT at its source and `null` in the review data, and + # the name must win before the unknown-licence rule gets to look. + blocked, passed = dependency_gate.split([_dep(name="ast_serialize", licence=None)]) + check("the named lint dependency passes with no licence in the data", + not blocked and len(passed) == 1, f"(blocked={blocked})") + blocked, _passed = dependency_gate.split([_dep(name="something-else", licence=None)]) + check("and no licence on any other package still blocks", + len(blocked) == 1 and blocked[0][0] == "unknown", f"({blocked})") + def test_a_compound_expression_is_judged_by_its_worst_half(): ok, _ = dependency_gate.split([_dep(licence="MIT OR Apache-2.0")]) diff --git a/tools/dependency_gate.py b/tools/dependency_gate.py index d011206..f1fa7b3 100644 --- a/tools/dependency_gate.py +++ b/tools/dependency_gate.py @@ -63,6 +63,22 @@ # first version to declare the expression this way. "pyinstaller": "build tool, and the shipped bootloader carries the " "PyInstaller bootloader exception (THIRD-PARTY-NOTICES.md)", + # GitHub reports `license: null` for ast_serialize, and the package is MIT + # in every place a person can look: the LICENSE file at the tag, + # `license = "MIT"` in its pyproject.toml and `license_expression: MIT` in + # the PyPI metadata. What is missing is the LEGACY `license` field and the + # trove classifier, which is all the dependency graph reads (the PEP 639 + # expression is not picked up), and the LICENSE file opens with a preamble + # about the bundled Ruff crates, which stops licensee matching it on the + # repository side too. A detection gap, then, not an unknown licence. + # + # It is also mypy's dependency in requirements-lint.txt: it runs on a + # runner, is never imported by the program and never reaches a user. + # Recorded on 2026-09-21, when 0.11.1 was the first version of it the gate + # ever saw (0.8.0 entered in #134 without appearing in that review at all). + "ast_serialize": "MIT at the source (LICENSE, pyproject.toml, PyPI " + "license_expression) that GitHub reads as null, and a " + "lint-only dependency of mypy that never ships", }