legal: add bounded third-party notices - #47
Merged
Conversation
|
Warning Review limit reached
Next review available in: 24 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (20)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
eXPerience83
marked this pull request as ready for review
July 31, 2026 21:47
Owner
Author
|
@coderabbitai review Please review the current exact HEAD. The scope boundary in the PR description is intentional: report correctness, packaging, notice-preservation and CI issues, but do not expand this change into a general Docker/shell/package-manager acquisition parser. |
38 tasks
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== HEAD and base =='
git status --short
git branch --show-current
git log -1 --format='%H%n%P%n%s'
git diff --stat "$(git merge-base HEAD origin/main)" HEAD
echo '== Changed files =='
git diff --name-status "$(git merge-base HEAD origin/main)" HEAD
echo '== Repository files relevant to notices/build/CI =='
fd -HI -t f . | rg '(^|/)(versions\.env|Dockerfile[^/]*|.*notice.*|.*license.*|.*sbom.*|.*workflow.*|.*test.*|.*check.*)$|^\.github/workflows/'Length of output: 3305 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="$(git merge-base HEAD origin/main)"
for f in \
versions.env \
third_party/inventory.json \
scripts/validate-third-party-inventory.sh \
scripts/copy-runtime-notices.sh \
scripts/print-locked-runtime-artifacts.py \
scripts/remote-dev-notices.sh \
images/base/Dockerfile \
images/codex/Dockerfile \
.github/workflows/build-amd64.yml \
third_party/README.md \
third_party/optional-agents.md
do
echo
echo "===== $f ====="
nl -ba "$f"
done
echo
echo '===== README changes ====='
git diff --unified=80 "$base" HEAD -- README.md README.es.md
echo
echo '===== executable modes ====='
git diff --summary "$base" HEAD
echo
echo '===== inventory parsed summary ====='
jq -r '
. as $root |
"top-level keys: " + (keys | join(", ")),
(.components[] | [.id, .version_key, .notice_source, (.notices // [] | join(","))] | `@tsv`)
' third_party/inventory.jsonLength of output: 1286 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="$(git merge-base HEAD origin/main)"
for f in \
versions.env \
third_party/inventory.json \
scripts/validate-third-party-inventory.sh \
scripts/copy-runtime-notices.sh \
scripts/print-locked-runtime-artifacts.py \
scripts/remote-dev-notices.sh \
images/base/Dockerfile \
images/codex/Dockerfile \
.github/workflows/build-amd64.yml \
third_party/README.md \
third_party/optional-agents.md
do
printf '\n===== %s =====\n' "$f"
awk '{printf "%6d\t%s\n", NR, $0}' "$f"
done
echo
echo '===== README changes ====='
git diff --unified=80 "$base" HEAD -- README.md README.es.md
echo
echo '===== executable modes ====='
git diff --summary "$base" HEAD
echo
echo '===== inventory parsed summary ====='
jq -r '
"top-level keys: " + (keys | join(", ")),
(.components[] | [.id, .version_key, .notice_source, (.notices // [] | join(","))] | `@tsv`)
' third_party/inventory.jsonLength of output: 65496 🏁 Script executed: #!/bin/bash
set -euo pipefail
for f in \
mise.lock \
mise.toml \
scripts/build-local.sh \
scripts/validate-version-pins.sh \
scripts/runtime-smoke-test.sh \
scripts/smoke-test.sh \
.github/workflows/publish-amd64.yml \
.github/workflows/publish-edge-amd64.yml \
.github/workflows/publish-pr-candidate-amd64.yml
do
printf '\n===== %s =====\n' "$f"
awk '{printf "%6d\t%s\n", NR, $0}' "$f"
done
echo
echo '===== Build and notice references ====='
rg -n -C 4 \
-e 'docker build' \
-e 'build-arg' \
-e 'NPM_VERSION|NODE_VERSION|PYTHON_VERSION|UV_VERSION' \
-e 'remote-dev-notices' \
-e 'copy-runtime-notices' \
-e 'BUILD-VERSIONS|CODEX-BUILD' \
scripts .github/workflows images README.md third_party
echo
echo '===== Dockerfile change only ====='
git diff --unified=20 "$(git merge-base HEAD origin/main)" HEAD -- images/base/Dockerfile images/codex/Dockerfile .github/workflows/build-amd64.ymlLength of output: 126601 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Repository-preserved notice integrity =='
while IFS=$'\t' read -r relative url; do
local_file="third_party/$relative"
tmp="$(mktemp)"
printf '%s\n' "-- $relative"
if curl --fail --silent --show-error --location --retry 2 \
--connect-timeout 10 --max-time 60 "$url" -o "$tmp"; then
local_sha="$(sha256sum "$local_file" | awk '{print $1}')"
upstream_sha="$(sha256sum "$tmp" | awk '{print $1}')"
printf 'repository=%s\nupstream=%s\n' "$local_sha" "$upstream_sha"
if [[ "$local_sha" != "$upstream_sha" ]]; then
echo 'MISMATCH'
else
echo 'MATCH'
fi
else
echo 'UPSTREAM FETCH FAILED'
fi
rm -f "$tmp"
done < <(
jq -r '.components[].notices[]
| select(.source == "repository")
| [.path, .reviewed_from]
| `@tsv`' third_party/inventory.json
)
echo
echo '== PR checks =='
gh pr checks 47 --repo eXPerience83/remote-dev-containers || true
echo
echo '== Recent PR workflow runs =='
gh run list --repo eXPerience83/remote-dev-containers \
--branch "$(git branch --show-current)" --limit 15 \
--json databaseId,displayTitle,event,headSha,status,conclusion,url \
--jq '.[] | [.databaseId, .displayTitle, .event, .headSha, .status, (.conclusion // "none"), .url] | `@tsv`' || trueLength of output: 1687 🏁 Script executed: #!/bin/bash
set -euo pipefail
pairs="$(mktemp)"
jq -r '.components[].notices[]
| select(.source == "repository")
| [.path, .reviewed_from]
| `@tsv`' third_party/inventory.json > "$pairs"
echo '== Repository-preserved notice integrity =='
while IFS=$'\t' read -r relative url; do
local_file="third_party/$relative"
tmp="$(mktemp)"
printf '%s\n' "-- $relative"
if curl --fail --silent --show-error --location --retry 2 \
--connect-timeout 10 --max-time 60 "$url" -o "$tmp"; then
local_sha="$(sha256sum "$local_file" | awk '{print $1}')"
upstream_sha="$(sha256sum "$tmp" | awk '{print $1}')"
printf 'repository=%s\nupstream=%s\n' "$local_sha" "$upstream_sha"
[[ "$local_sha" == "$upstream_sha" ]] && echo 'MATCH' || echo 'MISMATCH'
else
echo 'UPSTREAM FETCH FAILED'
fi
rm -f "$tmp"
done < "$pairs"
rm -f "$pairs"
echo
echo '== PR checks =='
gh pr checks 47 --repo eXPerience83/remote-dev-containers || true
echo
echo '== PR workflow runs =='
gh run list --repo eXPerience83/remote-dev-containers \
--commit 40e2d65a1594a30118c765891dcb7796557add69 --limit 15 \
--json databaseId,displayTitle,event,headSha,status,conclusion,url \
--jq '.[] | [.databaseId, .displayTitle, .event, .headSha, .status, (.conclusion // "none"), .url] | `@tsv`' || trueLength of output: 1726 🏁 Script executed: #!/bin/bash
set -euo pipefail
pairs="$(mktemp)"
jq -r '.components[].notices[]
| select(.source == "repository")
| [.path, .reviewed_from]
| `@tsv`' third_party/inventory.json > "$pairs"
echo '== Repository-preserved notice integrity =='
while IFS=$'\t' read -r relative url; do
local_file="third_party/$relative"
tmp="$(mktemp)"
printf '%s\n' "-- $relative"
if curl --fail --silent --show-error --location --retry 2 \
--connect-timeout 10 --max-time 60 "$url" -o "$tmp"; then
python - "$local_file" "$tmp" <<'PYTHON'
import hashlib
import sys
def digest(path: str) -> str:
value = hashlib.sha256()
with open(path, "rb") as handle:
for block in iter(lambda: handle.read(1024 * 1024), b""):
value.update(block)
return value.hexdigest()
local_digest = digest(sys.argv[1])
upstream_digest = digest(sys.argv[2])
print(f"repository={local_digest}")
print(f"upstream={upstream_digest}")
print("MATCH" if local_digest == upstream_digest else "MISMATCH")
PYTHON
else
echo 'UPSTREAM FETCH FAILED'
fi
rm -f "$tmp"
done < "$pairs"
rm -f "$pairs"
echo
echo '== PR checks =='
gh pr checks 47 --repo eXPerience83/remote-dev-containers || true
echo
echo '== PR workflow runs =='
gh run list --repo eXPerience83/remote-dev-containers \
--commit 40e2d65a1594a30118c765891dcb7796557add69 --limit 15 \
--json databaseId,displayTitle,event,headSha,status,conclusion,url \
--jq '.[] | [.databaseId, .displayTitle, .event, .headSha, .status, (.conclusion // "none"), .url] | `@tsv`' || trueLength of output: 3607 🏁 Script executed: #!/bin/bash
set -euo pipefail
upstream="$(mktemp)"
curl --fail --silent --show-error --location --retry 2 \
--connect-timeout 10 --max-time 60 \
'https://raw.githubusercontent.com/openai/codex/rust-v0.146.0/NOTICE' \
-o "$upstream"
echo '== Line counts and final bytes =='
python - "$upstream" third_party/components/codex/NOTICE <<'PYTHON'
from pathlib import Path
import sys
for name in sys.argv[1:]:
data = Path(name).read_bytes()
print(f"{name}: bytes={len(data)} lines={data.count(b'\\n')} final_bytes={data[-16:].hex()}")
PYTHON
echo
echo '== Unified content diff =='
diff -u "$upstream" third_party/components/codex/NOTICE || true
rm -f "$upstream"Length of output: 1301 🏁 Script executed: #!/bin/bash
set -euo pipefail
upstream="$(mktemp)"
curl --fail --silent --show-error --location --retry 2 \
--connect-timeout 10 --max-time 60 \
'https://raw.githubusercontent.com/openai/codex/rust-v0.146.0/NOTICE' \
-o "$upstream"
echo '== Line counts and final bytes =='
python - "$upstream" third_party/components/codex/NOTICE <<'PYTHON'
from pathlib import Path
import sys
for name in sys.argv[1:]:
data = Path(name).read_bytes()
line_count = data.count(bytes([10]))
print(f"{name}: bytes={len(data)} lines={line_count} final_bytes={data[-16:].hex()}")
PYTHON
echo
echo '== Unified content diff =='
diff -u "$upstream" third_party/components/codex/NOTICE || true
rm -f "$upstream"Length of output: 1465
The ✅ Action performedReview finished.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replace the placeholder third-party notice file with a deliberately bounded, declarative compliance layer for the software currently distributed by the Remote Dev images.
versions.env;remote-dev-noticesin both the base and final images;/usr/share/doc/<package>/copyrightpaths;Scope boundary
This PR is declarative by design. It does not attempt to discover every possible way software could be introduced through Docker, Bash, Python, npm, APT, Git, Cargo or another package manager.
A new pinned tool must add a version key to
versions.envand a matching inventory entry. CI compares those sets exactly. APT packages retain Ubuntu's package-provided notices and remain visible in the generated SBOM.The following are explicitly out of scope:
Maintenance behavior
A tool update must update the version pin, inventory entry and any changed repository-preserved notice in the same pull request. The normal diff remains the human review gate; automation does not silently approve changed legal text.
Validation
versions.env;remote-dev-notices --check;Replaces closed PR #43 with a clean implementation from
main.Refs #26