Audit release licenses and provenance (#104)

tools/ci-matrix/src/lib.rs

@@ -14,10 +14,12 @@ use std::time::{SystemTime, UNIX_EPOCH};
 mod api_surface;
 mod dependency;
 mod documentation;
+mod provenance;
 
 pub use api_surface::{audit_api_surface, write_api_baseline};
 pub use dependency::audit_dependencies;
 pub use documentation::{audit_documentation, write_documentation_report};
+pub use provenance::{audit_provenance, write_provenance_reports};
 
 pub const MATRIX_PATH: &str = "ci/release-matrix.json";
 const WORKFLOW_PATH: &str = ".gitea/workflows/release-matrix.yml";

tools/ci-matrix/src/main.rs

@@ -1,6 +1,6 @@
 use metacrate_ci_matrix::{
-    audit, audit_api_surface, audit_dependencies, audit_documentation, load, run, workspace_root,
-    write_api_baseline, write_documentation_report,
+    audit, audit_api_surface, audit_dependencies, audit_documentation, audit_provenance, load, run,
+    workspace_root, write_api_baseline, write_documentation_report, write_provenance_reports,
 };
 use std::path::{Path, PathBuf};
 
@@ -85,9 +85,16 @@ fn execute() -> Result<(), Box<dyn std::error::Error>> {
             audit_api_surface(&root, &evidence)?;
             println!("API/SemVer surface: ok ({})", evidence.display());
         }
+        Some("provenance-report") if arguments.next().is_none() => {
+            write_provenance_reports(&root)?;
+            println!("provenance and distribution reports: updated");
+        }
+        Some("provenance-audit") => {
+            provenance_audit_command(&root, arguments)?;
+        }
         _ => {
             return Err(
-                "usage: ci-matrix audit | run PROFILE --evidence FILE | dependency-audit --evidence FILE | documentation-report | documentation-audit --evidence FILE | api-baseline-write | api-audit --evidence FILE"
+                "usage: ci-matrix audit | run PROFILE --evidence FILE | dependency-audit --evidence FILE | documentation-report | documentation-audit --evidence FILE | api-baseline-write | api-audit --evidence FILE | provenance-report | provenance-audit --evidence FILE"
                     .into(),
             );
         }
@@ -95,6 +102,28 @@ fn execute() -> Result<(), Box<dyn std::error::Error>> {
     Ok(())
 }
 
+fn provenance_audit_command(
+    root: &Path,
+    mut arguments: impl Iterator<Item = String>,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let flag = arguments
+        .next()
+        .ok_or("provenance-audit requires --evidence FILE")?;
+    let evidence = arguments
+        .next()
+        .ok_or("provenance-audit requires --evidence FILE")?;
+    if flag != "--evidence" || arguments.next().is_some() {
+        return Err("usage: ci-matrix provenance-audit --evidence FILE".into());
+    }
+    let evidence = absolute_or_rooted(root, &evidence);
+    audit_provenance(root, &evidence)?;
+    println!(
+        "license and provenance surface: ok ({})",
+        evidence.display()
+    );
+    Ok(())
+}
+
 fn absolute_or_rooted(root: &Path, value: &str) -> PathBuf {
     let path = PathBuf::from(value);
     if path.is_absolute() {

tools/codegen/src/lib.rs

@@ -2109,7 +2109,9 @@ fn validate_inventory(inventory: &Inventory) -> Result<(), String> {
         validate_relative(&input.reference_path)?;
         validate_relative(&input.vendored_path)?;
         validate_hash(&input.sha256)?;
-        if input.license != "BSD-3-Clause" || !input_ids.insert(&input.id) {
+        if !matches!(input.license.as_str(), "BSD-3-Clause" | "CC-BY-SA-3.0")
+            || !input_ids.insert(&input.id)
+        {
             return Err(format!("invalid or duplicate input {}", input.id));
         }
     }