feat: use score_sbom for license handling by umaucher · Pull Request #430 · eclipse-score/persistency

umaucher · 2026-09-22T11:24:09Z

Replace the hand-rolled dash_license_checker setup (including the filtered_cargo_lock workaround and the license_check.sh aggregator) with the score_sbom tool (v0.1.1) from the S-CORE bazel registry.

The new //:sbom_* targets generates SPDX 2.3 and CycloneDX 1.6 SBOMs for the KVS library, covering:

third-party dependency inventory (name, version, SHA-256, PURL)
Rust crate licenses/suppliers via crates.io API (auto_crates_cache)
Python dependency licenses via dash-license-scan (python_lockfiles path)
first-party code license propagation stays with the repository license (Apache-2.0)
Old dash-based license check targets are removed.

Add a separate testonly SBOM covering build and test tooling, kept apart from the product SBOM. Covers the docs build, unit and CIT test suites, and the test-related Python lockfile.

github-actions · 2026-09-22T11:24:42Z

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run --lockfile_mode=error //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.7.0) and connecting to it...
INFO: Invocation ID: 65bb2cfa-4d38-4169-af0f-4c7d3458145d
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Loading: 
Loading: 2 packages loaded
Loading: 2 packages loaded
    currently loading: 
Loading: 2 packages loaded
    currently loading: 
Loading: 2 packages loaded
    currently loading: 
Loading: 2 packages loaded
    currently loading: 
Loading: 2 packages loaded
    currently loading: 
Analyzing: target //:license-check (3 packages loaded, 0 targets configured)
Analyzing: target //:license-check (3 packages loaded, 0 targets configured)

Analyzing: target //:license-check (74 packages loaded, 10 targets configured)

Analyzing: target //:license-check (90 packages loaded, 10 targets configured)

Analyzing: target //:license-check (90 packages loaded, 10 targets configured)

Analyzing: target //:license-check (146 packages loaded, 2502 targets configured)

Analyzing: target //:license-check (149 packages loaded, 3286 targets configured)

Analyzing: target //:license-check (149 packages loaded, 3286 targets configured)

Analyzing: target //:license-check (149 packages loaded, 3286 targets configured)

Analyzing: target //:license-check (157 packages loaded, 6531 targets configured)

Analyzing: target //:license-check (159 packages loaded, 8546 targets configured)

Analyzing: target //:license-check (165 packages loaded, 9802 targets configured)

Analyzing: target //:license-check (165 packages loaded, 9802 targets configured)

Analyzing: target //:license-check (166 packages loaded, 9802 targets configured)

Analyzing: target //:license-check (170 packages loaded, 11814 targets configured)

Analyzing: target //:license-check (175 packages loaded, 11865 targets configured)

INFO: Analyzed target //:license-check (176 packages loaded, 11991 targets configured).
[1 / 7] [Prepa] Expanding template license.check.license_check
INFO: From Generating Dash formatted dependency file ...:
INFO: Successfully converted 50 packages from Cargo.lock to bazel-out/k8-fastbuild/bin/formatted.txt
[14 / 16] [Prepa] JavaToolchainCompileBootClasspath external/rules_java+/toolchains/platformclasspath.jar
INFO: Found 1 target...
Target //:license.check.license_check up-to-date:
  bazel-bin/license.check.license_check
  bazel-bin/license.check.license_check.jar
INFO: Elapsed time: 34.258s, Critical Path: 2.41s
INFO: 16 processes: 12 internal, 3 processwrapper-sandbox, 1 worker.
INFO: Build completed successfully, 16 total actions
INFO: Running command line: bazel-bin/license.check.license_check ./formatted.txt <args omitted>
usage: org.eclipse.dash.licenses.cli.Main [-batch <int>] [-cd <url>]
       [-confidence <int>] [-ef <url>] [-excludeSources <sources>] [-help] [-lic
       <url>] [-project <shortname>] [-repo <url>] [-review] [-summary <file>]
       [-timeout <seconds>] [-token <token>]

github-actions · 2026-09-22T11:33:15Z

The created documentation from the pull request is available at: docu-html

PandaeDo · 2026-10-01T13:09:52Z

 )

-dash_license_checker(
-    src = ":filtered_cargo_lock",


There's no licence gate left for Rust. Licences now come from what publishers declare on crates.io, not from Dash/IP approval, and sbom-tool doesn't fail on any licence. Something still needs to gate this: Dash, or a policy check on the SBOM output.

"gate" is back (no more review needed with the filter and the updated Cargo.lock) the updated cicd-workflows/.github/workflows/license-check.yml workflow has a "workaround" for the missing secret so actually the dash tool is now really triggered (but no automatic review, only commend) ... ❗ the update only gets effective after merge so the current run still fails

The updated Cargo.lock is much closer: down from ~40 version mismatches to 2 compared to what Bazel builds.

Crate: libc Cargo.lock: 0.2.189 Bazel: 0.2.186 (pinned exactly in score_crates for QNX 8)
Crate: lazy_static Cargo.lock: 1.5.0 Bazel: 1.5.1

Could you align these two? Otherwise Dash checks a libc version we don't ship. Regarding a "correct" Cargo.lock: score_crates v0.0.12 now ships its own Cargo.lock (score-crates #69), which could serve as the reference, although it covers all S-CORE crates, not only ours.

On "gate": the shared workflow (also the new d2083d5) never fails the job; the exit code only switches the comment between "Passed" and "Needs Review", and without a DASH token there is no IP-team review request. That's the same as on main, so no regression from this PR, but it's a report rather than a merge gate.

Where this should go long-term needs a broader discussion: eclipse-dash/dash-licenses#533. The Eclipse IP team is investigating a move to an Eclipse Apoapsis/ORT-based solution, with Dash/IPLab to be retired eventually over a deprecation period of years. Similarly, https://github.com/bazelbuild/rules_license (used in #432) states that active development has moved to https://github.com/bazel-contrib/supply-chain, and score_sbom doesn't consume rules_license providers yet. I'd suggest we take the gate question and the target toolchain (Dash → ORT, rules_license → supply-chain) to cicd-workflows / the tooling community, and keep this PR to the libc / lazy_static fix.

explicite synced versions in 08b3115

Replace the hand-rolled dash_license_checker setup (including the filtered_cargo_lock workaround and the license_check.sh aggregator) with the score_sbom tool (v0.1.1) from the S-CORE bazel registry. The new //:sbom target generates SPDX 2.3 and CycloneDX 1.6 SBOMs for the KVS library, covering: - third-party dependency inventory (name, version, SHA-256, PURL) - Rust crate licenses/suppliers via crates.io API (auto_crates_cache) - Python dependency licenses via dash-license-scan (python_lockfiles path) - first-party code license propagation stays with the repository license (Apache-2.0) Old dash-based license check targets are removed. Signed-off-by: Uwe Maucher <205777204+umaucher@users.noreply.github.com>

Add a separate testonly SBOM covering build and test tooling, kept apart from the product SBOM because build-time dependencies are not product/runtime dependencies. Covers the docs build, unit and CIT test suites, and the test-related Python lockfile. Pip repositories are represented authoritatively by python_lockfiles, so their generated Bazel aliases are excluded to avoid duplicate components. Make the test targets referenced by the root test suites public (rust_kvs tests, cit_cpp, cit_rust) so the SBOM can pull them in. Remove python_lockfiles from the product SBOM: the only Python lockfile in the repo is test-related, so it belongs to the build-tools inventory. Signed-off-by: Uwe Maucher <205777204+umaucher@users.noreply.github.com>

Keep the CI license command effective while SBOM-based license policy remains under review.

Use the current reusable workflow implementation for reliable license-check status reporting.

Signed-off-by: Uwe Maucher <205777204+umaucher@users.noreply.github.com>

- Use the @score_tools cr_checker in //tools, as on main since #476. It checks every tracked file that has a template. No srcs or extensions lists. - Keep tools/copyright_exclusions.txt. Drop the root cr_checker_exclusion file. - Pass //:Cargo.lock to dash_license_checker with file_type cargo, as on main since #430. The score_tooling converter already drops path crates. - Drop the filtered_cargo_lock genrule and the PROJECT_CONFIG load. - Export Cargo.lock to //tools. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

umaucher requested review from PandaeDo, antonkri and vinodreddy-g as code owners September 22, 2026 11:24

umaucher deployed to workflow-approval September 22, 2026 11:24 — with GitHub Actions Active

umaucher marked this pull request as draft September 22, 2026 11:24

umaucher force-pushed the um_sbom_tool2 branch from 71adca4 to 66b5c7a Compare September 22, 2026 16:05

umaucher had a problem deploying to workflow-approval September 22, 2026 16:05 — with GitHub Actions Error

umaucher mentioned this pull request Sep 22, 2026

fix: issues related score modules and bazel caching eclipse-score/sbom-tool#12

Merged

umaucher marked this pull request as ready for review September 23, 2026 15:15

umaucher marked this pull request as draft September 23, 2026 15:15

PandaeDo had a problem deploying to workflow-approval September 25, 2026 08:14 — with GitHub Actions Error

umaucher force-pushed the um_sbom_tool2 branch from 6ccf003 to 15be60c Compare September 28, 2026 11:42

umaucher had a problem deploying to workflow-approval September 28, 2026 11:43 — with GitHub Actions Error

umaucher force-pushed the um_sbom_tool2 branch from 15be60c to 8362b09 Compare September 28, 2026 12:07

umaucher deployed to workflow-approval September 28, 2026 12:07 — with GitHub Actions Active

umaucher force-pushed the um_sbom_tool2 branch from 8362b09 to 970e173 Compare September 29, 2026 11:51

umaucher deployed to workflow-approval September 29, 2026 11:51 — with GitHub Actions Active

umaucher marked this pull request as ready for review September 30, 2026 08:49

umaucher force-pushed the um_sbom_tool2 branch from 970e173 to 5723bea Compare October 1, 2026 08:47

umaucher deployed to workflow-approval October 1, 2026 08:47 — with GitHub Actions Active

arkjedrz reviewed Oct 1, 2026

View reviewed changes

Comment thread score/kvs/rust_kvs/BUILD

PandaeDo requested changes Oct 1, 2026

View reviewed changes

umaucher deployed to workflow-approval October 1, 2026 15:42 — with GitHub Actions Active

umaucher force-pushed the um_sbom_tool2 branch from 232f65c to 7c53427 Compare October 2, 2026 10:58

umaucher deployed to workflow-approval October 2, 2026 10:58 — with GitHub Actions Active

PandaeDo had a problem deploying to workflow-approval October 6, 2026 06:41 — with GitHub Actions Error

umaucher added 5 commits October 6, 2026 10:01

fix: restore Rust license check gate

18fb413

Keep the CI license command effective while SBOM-based license policy remains under review.

ci: update shared license-check workflow

b75abdf

Use the current reusable workflow implementation for reliable license-check status reporting.

fix: sync Cargo.lock with Bazel crate versions

08b3115

Signed-off-by: Uwe Maucher <205777204+umaucher@users.noreply.github.com>

umaucher force-pushed the um_sbom_tool2 branch from d992d60 to 08b3115 Compare October 6, 2026 08:02

umaucher deployed to workflow-approval October 6, 2026 08:02 — with GitHub Actions Active

PandaeDo approved these changes Oct 6, 2026

View reviewed changes

PandaeDo added this pull request to the merge queue Oct 6, 2026

Merged via the queue into eclipse-score:main with commit 2ca623a Oct 6, 2026
29 of 32 checks passed

dcalavrezo-qorix mentioned this pull request Oct 7, 2026

Roll out SBOM generation to all S-CORE modules eclipse-score/score#3314

Open

1 of 10 tasks

Navigation Menu

Repository navigation

feat: use score_sbom for license handling - #430

feat: use score_sbom for license handling#430
PandaeDo merged 5 commits into
eclipse-score:mainfrom
umaucher:um_sbom_tool2

umaucher commented Sep 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

PandaeDo Oct 1, 2026

Uh oh!

umaucher Oct 1, 2026 •

edited

Loading

Uh oh!

PandaeDo Oct 6, 2026

Uh oh!

umaucher Oct 6, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

umaucher commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

License Check Results

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

PandaeDo Oct 1, 2026

Choose a reason for hiding this comment

Uh oh!

umaucher Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

PandaeDo Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

umaucher Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

umaucher commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

umaucher Oct 1, 2026 •

edited

Loading