feat(licensing): generate deterministic dependency license inventory (#495 merge-result promotion) - #506

Merged

seonghobae merged 156 commits into

mainfrom

merge-ready/pr-495-064d5656

Aug 29, 2026

Commits on Aug 23, 2026

test(licensing): require deterministic dependency inventory
seonghobae
committed
6ca44bb
test(licensing): reject ambiguous lockfile evidence
seonghobae
committed
db11628
feat(licensing): generate exact lockfile license inventory
seonghobae
committed
db9262f
test(licensing): validate the repository lockfile
seonghobae
committed
be8c078
feat(licensing): expose dependency inventory command
seonghobae
committed
8a1ab14
test(coverage): own dependency inventory source
seonghobae
committed
0712eb2
docs(licensing): align policy graph with protected truth
seonghobae
committed
c68fd9d
test(licensing): require locale-independent inventory order
seonghobae
committed
c54a49f
fix(licensing): use locale-independent inventory ordering
seonghobae
committed
21d5033
test(licensing): bind inventory to the actual lock path
seonghobae
committed
6cc2609
fix(licensing): bind exact input path in inventory
seonghobae
committed
25165a8
test(licensing): cover malformed inventory boundaries
seonghobae
committed
efca994
refactor(licensing): remove unreachable package-path branch
seonghobae
committed
58cef0d
test(licensing): define covered CLI boundaries
seonghobae
committed
8e49b1b
refactor(licensing): expose testable CLI boundaries
seonghobae
committed
4b0adec
test(licensing): exercise production CLI defaults
seonghobae
committed
b9b146c
test(acquisition): require dependency license evidence in data room
seonghobae
committed
e35eaab
feat(acquisition): bind dependency license inventory evidence
seonghobae
committed
f24e63b
test(release): require license inventory before data-room manifest
seonghobae
committed
f2b60e2
feat(release): generate license inventory before data-room manifest
seonghobae
committed
4ad0554
test(licensing): prevent env redirection of release evidence
seonghobae
committed
5445071
fix(licensing): pin release inventory to canonical paths
seonghobae
committed
0f8086a
test(licensing): exercise canonical CLI evidence paths
seonghobae
committed
95e4ca2
test(licensing): reject symlinked evidence output
seonghobae
committed
ba093ec
fix(licensing): refuse symlinked inventory output
seonghobae
committed
8fc000c
test(licensing): reject symlinked lockfile input
seonghobae
committed
f6a6fb7
fix(licensing): refuse symlinked lockfile input
seonghobae
committed
2f62973
test(licensing): reject ambiguous lockfile package paths
seonghobae
committed
f5c3fe1
fix(licensing): validate canonical lockfile package paths
seonghobae
committed
8482729
test(licensing): reject symlinked canonical output parent
seonghobae
committed
b5aaee6
fix(licensing): reject symlinked canonical output parent
seonghobae
committed
d22b927
test(licensing): cover nested release parent redirect
seonghobae
committed
9223658
test(licensing): reject hard-linked evidence output
seonghobae
committed
9b361fe
fix(licensing): replace output with exclusive regular identity
seonghobae
committed
0359e56
fix(licensing): preserve protected-truth contract wording
seonghobae
committed
2e98cdf
fix(licensing): classify malformed lockfiles before duplicate scan
seonghobae
committed
4829226
test(licensing): reject invalid UTF-8 lockfile bytes
seonghobae
committed
643b8bd
fix(licensing): reject invalid UTF-8 lockfile bytes
seonghobae
committed
fd17025
test(licensing): reject lockfile BOM normalization
seonghobae
committed
b4f34d8
fix(licensing): preserve BOM bytes through strict decode
seonghobae
committed
7f8ea91
test(acquisition): require license inventory before final audit
seonghobae
committed
b07aa86
fix(acquisition): regenerate license evidence before final audit
seonghobae
committed
66d673e
feat(licensing): converge current protected main
seonghobae
committed
4925e0c
test(licensing): reject custom symlinked evidence parents
seonghobae
committed
6d5a6f8
fix(licensing): reject symlinked evidence parent chains
seonghobae
committed
90820b7
test(licensing): reject padded dependency identities
seonghobae
committed
af782ab
fix(licensing): require canonical dependency identities
seonghobae
committed
1678a26
test(licensing): reject malformed dependency flags
seonghobae
committed
00d4b29
fix(licensing): fail closed on malformed dependency flags
seonghobae
committed
f650505
test(licensing): reject symlinked lockfile parents
seonghobae
committed
5f9105a
fix(licensing): reject symlinked lockfile parents
seonghobae
committed
7432823
test(licensing): reject control-character dependency identities
seonghobae
committed
8dc6028
fix(licensing): reject control-character dependency identities
seonghobae
committed
c7be943
test(licensing): bound dependency lockfile evidence reads
seonghobae
committed
d7977cf
fix(licensing): bound dependency lockfile evidence reads
seonghobae
committed
6d535cf
test(licensing): reject Unicode identity spoofing
seonghobae
committed
28c881c
fix(licensing): reject Unicode identity spoofing
seonghobae
committed
6ab9ca9
test(licensing): reject spoofed package-path authority
seonghobae
committed
8883ce2
fix(licensing): reject spoofed package-path authority
seonghobae
committed
13420ce
test(licensing): reject ambiguous lockfile source paths
seonghobae
committed
b5cd9d4
fix(licensing): reject ambiguous lockfile source paths
seonghobae
committed
a07d654
test(licensing): reject ambiguous dependency package paths
seonghobae
committed
65e1d76
fix(licensing): reject ambiguous dependency package paths
seonghobae
committed
291cb31
test(licensing): preserve devOptional classification
seonghobae
committed
8954d2c
fix(licensing): preserve devOptional classification
seonghobae
committed
edee977
docs(licensing): align dependency classification evidence
seonghobae
committed
9014834
test(licensing): preserve bundled dependency authority
seonghobae
committed
3bf3821
fix(licensing): preserve bundled dependency authority
seonghobae
committed
5c8489b
chore(licensing): converge protected OIDC trust
seonghobae
committed
d3285d3
docs(licensing): record bundled dependency authority
seonghobae
committed
65d4b5e
test(licensing): preserve install-script authority
seonghobae
committed
6b6d7e3
fix(licensing): preserve install-script authority
seonghobae
committed
5166412
test(licensing): preserve dependency platform authority
seonghobae
committed
293cdb4
fix(licensing): preserve dependency platform authority
seonghobae
committed
fee5408
docs(licensing): record dependency runtime applicability evidence
seonghobae
committed
2bc835a
test(licensing): cover platform authority fail-closed branches
seonghobae
committed
066b48f
test(licensing): reject credential-bearing resolved artifacts
seonghobae
committed
c6a9784
fix(licensing): reject credential-bearing resolved artifacts
seonghobae
committed
d1f70bc
test(licensing): fail closed on opaque resolved artifacts
seonghobae
committed
de730b7
fix(licensing): require inspectable resolved artifact URIs
seonghobae
committed
6eee6c5
test(licensing): reject compact signed-URL credential keys
seonghobae
committed
04c5658
fix(licensing): reject compact signed-URL credentials
seonghobae
committed
c1297d1
docs(licensing): bind resolved artifacts to credential-free authority
seonghobae
committed
3b5ca1d
test(licensing): reject git and fragment credential leakage
seonghobae
committed
a340d4d
fix(licensing): reject git and fragment credential leakage
seonghobae
committed
4a2ba84
docs(licensing): document resolved credential boundaries
seonghobae
committed
c13b96b
test(licensing): require canonical resolved URI identity
seonghobae
committed
c6baed6
fix(licensing): enforce canonical resolved URI roundtrip
seonghobae
committed
5c823ad
test(licensing): reject compact credential query keys
seonghobae
committed
f28bd0c
fix(licensing): reject camel-case credential query keys
seonghobae
committed
0ce5437
test(licensing): require npm integrity algorithms
seonghobae
committed
eec955c
test(licensing): restore canonical identity scope
seonghobae
committed
fba3343
test(licensing): reject compact lowercase credential keys
seonghobae
committed
b5b3930
fix(licensing): reject compact credential query keys
seonghobae
committed
f8a2d7b
test(licensing): reject nested fragment credentials
seonghobae
committed
2b9ca10
fix(licensing): reject nested fragment credentials
seonghobae
committed
9f88f5f
test(licensing): reject encoded fragment credentials
seonghobae
committed
9e92dcf
test(licensing): fail closed on malformed fragment escapes
seonghobae
committed
ef7db03
fix(licensing): inspect encoded fragment credentials
seonghobae
committed
2f2afb3
test(licensing): preserve encoded literal percent
seonghobae
committed
9120b26
test(licensing): reject recursively encoded credential keys
seonghobae
committed
a104d51
fix(licensing): reject recursively encoded credential authority
seonghobae
committed
63e30bc
test(licensing): reject punctuated credential keys
seonghobae
committed
6bd4305
fix(licensing): reject punctuated credential parameters
seonghobae
committed
5eeda68
test(licensing): cover benign nested fragment query
seonghobae
committed
f40420c
test(licensing): reject credentials hidden in nested artifact URLs
seonghobae
committed
c57294b
fix(licensing): reject nested artifact credential parameters
seonghobae
committed
7b2b896
test(licensing): reject credentials in nested artifact authority
seonghobae
committed
598b8f3
fix(licensing): reject nested artifact URL credentials
seonghobae
committed
80e56af
test(licensing): reject nested credential assignments
seonghobae
committed
b3aa8f3
fix(licensing): reject nested credential assignments
seonghobae
committed
3621bac
test(licensing): preserve credential-like nested path text
seonghobae
committed
b5c4eba
fix(licensing): scope nested assignment scan to non-URL values
seonghobae
committed
618edf7
test(licensing): cover recursive benign nested decode
seonghobae
committed
3886de9
test(licensing): reject token-shaped artifact paths
seonghobae
committed
9dc2c19
fix(licensing): reject token-shaped artifact paths
seonghobae
committed
0ec3e10
test(licensing): exercise encoded token path rejection
seonghobae
committed
6bb429f
test(licensing): reject strong tokens in benign query values
seonghobae
committed
3023285
fix(licensing): reject strong tokens in resolved values
seonghobae
committed
4ed493b
test(licensing): reject strong tokens in artifact fragments
seonghobae
committed
4f26bc6
fix(licensing): reject strong tokens in artifact fragments
seonghobae
committed
28d7699
test(licensing): reject strong npm tokens in resolved authority
seonghobae
committed
85c0021
fix(licensing): reject strong npm tokens in resolved authority
seonghobae
committed
2ab5581
test(licensing): reject duplicate platform authority
seonghobae
committed
f9bd0bf
fix(licensing): reject duplicate platform authority
seonghobae
committed
60d6d7e
test(licensing): reject recursively nested credential values
seonghobae
committed
666d33f
fix(licensing): reject recursively nested credential values
seonghobae
committed
85b9f8d
test(licensing): bound nested credential inspection
seonghobae
committed
3b0d1b8
fix(licensing): bound nested credential inspection
seonghobae
committed
bc7d80f
refactor(licensing): bound nested inspection iteratively
seonghobae
committed
07073b0
test(licensing): cover opaque nested query authority
seonghobae
committed
3925296
test(licensing): reject credential URLs nested in fragments
seonghobae
committed
1507ce2
test(licensing): require structured package integrity authority
seonghobae
committed
a7dcc70
fix(licensing): validate package integrity authority
seonghobae
committed
7c51620
chore(licensing): converge current protected main
seonghobae
committed
b23b170

Commits on Aug 28, 2026

test(licensing): reject dot-segment evidence path escapes
seonghobae
committed
4e65d6f
fix(licensing): reject non-canonical evidence paths
seonghobae
committed
52333fb
chore(licensing): converge protected main
seonghobae
committed
7cb56cd
test(licensing): reject normalized source-path aliases
seonghobae
committed
b62e872
fix(licensing): canonicalize retained source-path authority
seonghobae
committed
d6c76ee
test(licensing): reject non-repository source paths
seonghobae
committed
1341098
fix(licensing): require repository-relative source authority
seonghobae
committed
5dbb8d7
revert(licensing): preserve honest custom source-path authority
seonghobae
committed
21c0197
test(licensing): preserve special-file output authority
seonghobae
committed
475f49f
fix(licensing): refuse special-file output replacement
seonghobae
committed
454d0ab
test(licensing): reject weak SHA-1 integrity evidence
seonghobae
committed
6e2d90a
fix(licensing): reject SHA-1 integrity evidence
seonghobae
committed
9121b00
test(licensing): reject truncated SRI digest evidence
seonghobae
committed
2cc9b46
fix(licensing): validate SRI digest byte authority
seonghobae
committed
0c8725b
test(licensing): use real SRI fixture digests
seonghobae
committed
79ddf35
test(licensing): use real SRI in resolved authority fixtures
seonghobae
committed
2ec94fb
test(licensing): keep special-output fixture SRI valid
seonghobae
committed
8305187
test(licensing): use algorithm-sized modern SRI fixtures
seonghobae
committed
eb7f35a
test(licensing): keep intended-valid SRI fixtures valid
seonghobae
committed
20f7174
test(licensing): keep platform SRI fixture valid
seonghobae
committed
9e38a84

Commits on Aug 29, 2026

Merge 9e38a848448cb21b2fab7f323af0d3ebfdf1deb7 into 06c6b864d22576d94d538e3f143b9b48d38c2957
seonghobae
authored
064d565