Skip to content

fix: whitelist marisa-trie in central license check #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JarbasAl merged 1 commit into from
Jul 4, 2026
Merged

fix: whitelist marisa-trie in central license check #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/workflows/license-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,10 @@ jobs:
# 2. Central whitelist (one anchored alternation per package).
# tqdm — dual-licensed MPL-2.0 AND MIT; permissive via the MIT option,
# used as an unmodified imported library (pulled by huggingface_hub).
central = r"(?i:^tqdm([=<>!~ @;].*)?$)"
# marisa-trie — MIT AND (BSD-2-Clause OR LGPL-2.1-or-later); we elect the
# BSD-2-Clause option, used as an unmodified imported trie library
# (pulled transitively via langcodes/language_data).
central = r"(?i:^tqdm([=<>!~ @;].*)?$)|(?i:^marisa[-_]trie([=<>!~ @;].*)?$)"

# 3. Caller-supplied repo-specific excludes.
caller = (os.environ.get("CALLER_EXCLUDE") or "").strip()
Expand Down
3 changes: 2 additions & 1 deletion docs/license-whitelist.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ specific justification.
| Package | Declared license | Flagged category | Justification |
|---------|------------------|------------------|---------------|
| `tqdm` | `MPL-2.0 AND MIT` | WeakCopyleft | Dual-licensed. The MIT option makes it fully permissive to use as a library; the checker flags it only because of the MPL-2.0 component. We use `tqdm` as an unmodified, imported progress-bar dependency (pulled transitively by `huggingface_hub`, and thus by many OVOS ML repos) — no MPL-2.0 files are modified or redistributed, so the MIT terms govern and it is compatible with Apache 2.0 distribution. |
| `marisa-trie` | `MIT AND (BSD-2-Clause OR LGPL-2.1-or-later)` | WeakCopyleft | Dual-licensed. The checker flags the whole expression because of the LGPL-2.1-or-later option, but the license grants an explicit `BSD-2-Clause OR LGPL` choice — we elect the permissive BSD-2-Clause. We use `marisa-trie` as an unmodified, imported static-trie library (pulled transitively via `langcodes`/`language_data`, and thus by many OVOS repos that resolve language data) — no source is modified or redistributed, so the BSD-2-Clause terms govern and it is compatible with Apache 2.0 distribution. |

## Regex form

Expand All @@ -40,7 +41,7 @@ PCRE, anchored per package so it matches the exact distribution name (and is
case-insensitive, since the checker may normalise names):

```
(?i:^tqdm$)
(?i:^tqdm$)|(?i:^marisa[-_]trie$)
```

Adding a package means adding a `^name$` alternation here and in the workflow's
Expand Down