We’ve recently added support for vetting Dart and Flutter dependencies to IPLab, the service that manages licence data for the Eclipse Dash License Tool.
IPLab
IPLab is the combination of an issue tracker on the Eclipse Foundation’s GitLab instance and a collection of services that automatically review, manage, and disseminate licence information for third party content leveraged by Eclipse open source projects. The IPLab issue tracker also serves as the Eclipse Foundation’s Intellectual Property Team’s work queue.
For committers, making use of this new support starts with the Eclipse Dash License Tool.
Eclipse Dash License Tool
The Eclipse Dash License Tool is used to vet third party content used by their Eclipse open source project. It doesn’t actually know how to find dependencies; rather, it knows how to find the licences of dependencies.
This is mostly true. The Eclipse Dash License Tool has a Maven plugin that leverages the standard Maven dependency resolution mechanism to find dependencies, and then does its magic to identify their licences. The tool has built-in support for a few lock file formats (e.g., package.lock and yarn.lock files), which suggests that the tool understands dependencies, but, again, it doesn’t actually know how to find dependencies, it just knows how to process a list of them expressed in various formats. In the general case, we leverage support provided by package managers to get the list of dependencies and then use the Eclipse Dash License Tool to process that list.
Vetting Dart Dependencies
The Eclipse Dash License Tool knows nothing about Dart. But, fortunately, dart knows everything about Dart, and you can use it to get the entire transitive closure of dependencies from your Dart build.
To get the licence information for the dependencies of your Dart build, start by getting the list of dependencies:
$ dart pub deps --no-dev --style=list
- async 2.11.0
- collection 1.18.0
- crypto 3.0.3
- http 1.2.2
- http_parser 4.1.0
- meta 1.15.0
- path 1.9.0
- source_span 1.10.0
- string_scanner 1.2.0
- typed_data 1.3.2
$ _
Using a bit of sed regular expression magic, you can convert this into a format supported by the Eclipse Dash License Tool. Dart (and Flutter) builds get their dependencies from the pub.dev software repository, so you can create ClearlyDefined identifiers for each entry using pub as the type and pub.dev as the source:
$ dart pub deps --no-dev --style=list \
| sed -n 's|^- \([a-zA-Z0-9_]*\) \(.*\)$|pub/pub.dev/-/\1/\2|p'
pub/pub.dev/-/async/2.11.0
pub/pub.dev/-/collection/1.18.0
pub/pub.dev/-/crypto/3.0.3
pub/pub.dev/-/http/1.2.2
pub/pub.dev/-/http_parser/4.1.0
pub/pub.dev/-/meta/1.15.0
pub/pub.dev/-/path/1.9.0
pub/pub.dev/-/source_span/1.10.0
pub/pub.dev/-/string_scanner/1.2.0
pub/pub.dev/-/typed_data/1.3.2
$ _
Note that ClearlyDefined doesn’t currently support pub.dev, so these identifiers are meaningless to ClearlyDefined. The Eclipse Dash License Tool knows that ClearlyDefined doesn’t support this type, so it won’t bother querying that service.
The final step is to pipe this into the Eclipse Dash License Tool so that it can work its magic.
$ dart pub deps --no-dev --style=list \
| sed -n 's|^- \([a-zA-Z0-9_]*\) \(.*\)$|pub/pub.dev/-/\1/\2|p' \
| java -jar org.eclipse.dash.licenses-1.1.1-SNAPSHOT.jar -
[main] INFO Querying Eclipse Foundation for license data for 10 items.
[main] INFO Found 0 items.
[main] INFO License information could not be automatically verified for the following content:
[main] INFO
[main] INFO pub/pub.dev/-/async/2.11.0
[main] INFO pub/pub.dev/-/collection/1.18.0
[main] INFO pub/pub.dev/-/crypto/3.0.3
[main] INFO pub/pub.dev/-/http/1.2.2
[main] INFO pub/pub.dev/-/http_parser/4.1.0
[main] INFO pub/pub.dev/-/meta/1.15.0
[main] INFO pub/pub.dev/-/path/1.9.0
[main] INFO pub/pub.dev/-/source_span/1.10.0
[main] INFO pub/pub.dev/-/string_scanner/1.2.0
[main] INFO pub/pub.dev/-/typed_data/1.3.2
[main] INFO
[main] INFO This content is either not correctly mapped by the system, or requires review.
$ _
This is not an especially hopeful result. The Eclipse Dash License Tool found no licence information at all! But, you can ask it to initiate the IP due diligence vetting on your behalf:
$ dart pub deps --no-dev --style=list \
| sed -n 's|^- \([a-zA-Z0-9_]*\) \(.*\)$|pub/pub.dev/-/\1/\2|p' \
| java -jar org.eclipse.dash.licenses-1.1.1-SNAPSHOT.jar - -review -project automotive.kuksa -token $GITLAB_TOKEN
[main] INFO Querying Eclipse Foundation for license data for 10 items.
[main] INFO Found 0 items.
[main] INFO License information could not be automatically verified for the following content:
[main] INFO
[main] INFO pub/pub.dev/-/async/2.11.0
...
[main] INFO
[main] INFO This content is either not correctly mapped by the system, or requires review.
[main] INFO A review is required for pub/pub.dev/-/async/2.11.0.
[main] INFO A review request was created https://gitlab.eclipse.org/eclipsefdn/emo-team/iplab/-/work_items/31076 .
...
$ _
I’ve clipped out most of the output so that we can focus on the one example.
By adding the -review switch, the Eclipse Dash License Tool will create an issue in the Eclipse Foundation’s IPLab repository for each dependency that requires vetting (the tool will only create the first 100 issues when the list is long, and will not open duplicates when open issues already exist for an item in the list). The review feature only works for Eclipse committers; any issues that are created by non-committers are closed automatically. The review feature also requires that the project’s id be provided via the -project switch; if you’re not sure what value to use here, ask your project leads, your PMC, or the EMO. You must also pass an API token on the Eclipse Foundation’s GitLab instance via the -token switch..
The review process is mostly automated. Eighty percent of all review requests are automatically completed and approved in few minutes, and then take a few more minutes to be made available to the tool. If you wait an hour or so after submitting a review request, you will likely observe the results of the review.
By way of expectation management, some requests require manual intervention from the IP Team. Depending on workload, this can take anywhere from a few hours to a few days. Your patience is appreciated, but if you feel that it’s taking too long, you can bump the issue by adding a comment.
If you have questions about this support, have trouble using the tool, or have insight that will help us identify and vet Dart and Flutter Dependencies, please open an issue or reach out to EMO.
