From c94ad2c05b00eabe066ac140e00574ad5e35f57a Mon Sep 17 00:00:00 2001 From: Jeroen Schweitzer Date: Wed, 22 Apr 2026 08:26:36 +0200 Subject: [PATCH] restructure licenses.yaml: self + runtime deps + dev deps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three sections instead of one flat list. `self:` carries clide's own MIT license (rendered first in the About screen so the user knows what they're running before the dependency list). `dependencies:` covers artefacts that actually ship in the binary — JetBrainsMono, JosefinSans, yaml. `dev_dependencies:` tracks build-time tooling (mocktail, alchemist, flutter_lints, lints, test) for audit completeness without polluting the user-facing About panel. Also backfilled the two root-package dev deps that were missed the first pass: `lints: 5.0.0` and `test: 1.25.8` (root pubspec, not app/). Root LICENSE mirrored into app/assets/LICENSE + declared as a bundled asset so the About screen can read it at runtime (Flutter can't reference paths above the package root). D-042 updated to describe the three-section split and the dev-vs- runtime distinction. Co-Authored-By: Claude --- app/assets/LICENSE | 21 +++++++++++ app/assets/licenses.yaml | 79 ++++++++++++++++++++++++++++++++-------- app/pubspec.yaml | 10 +++-- decisions/tooling.md | 6 +-- 4 files changed, 94 insertions(+), 22 deletions(-) create mode 100644 app/assets/LICENSE diff --git a/app/assets/LICENSE b/app/assets/LICENSE new file mode 100644 index 00000000..27a337df --- /dev/null +++ b/app/assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Jeroen Schweitzer + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/app/assets/licenses.yaml b/app/assets/licenses.yaml index 49cbbc70..33314282 100644 --- a/app/assets/licenses.yaml +++ b/app/assets/licenses.yaml @@ -1,20 +1,48 @@ -# clide — bundled-dependency manifest. +# clide — licensing manifest. # -# Every third-party artefact that ships in the clide binary is listed -# here: fonts, Dart packages, native supporter tools, bundled data. -# The About screen reads this file and renders the entries verbatim. +# Three sections: +# - `self:` — clide's own license (MIT). Rendered first in the About +# screen so the user knows what they're running before they see +# the list of things it depends on. +# - `dependencies:` — third-party artefacts that SHIP in the clide +# binary: fonts, runtime Dart packages, native supporter tools, +# bundled data. The About screen renders these verbatim. +# - `dev_dependencies:` — build-time-only tooling: test runners, +# mocks, lints, golden-test harness. These never enter the shipped +# binary, so the About screen does not render them, but they're +# tracked here for audit completeness alongside the real list. # -# Adding a new bundled dependency is a two-step commit: +# Adding a new runtime dependency is a two-step commit: # 1. Add the dependency itself (font file, `pubspec.yaml` entry, etc.) -# 2. Add the entry below in the same commit, so the About screen stays -# accurate and the prefer-zero-deps guardrail is enforced by the -# obvious visible consequence: an extra row in the list. +# 2. Add the entry under `dependencies:` below in the same commit, so +# the About screen stays accurate and the prefer-zero-deps +# guardrail is enforced by the obvious visible consequence: an +# extra row in the list. +# +# Adding a new dev-only dependency is the same two-step commit, just +# under `dev_dependencies:` instead. The guardrail still applies — +# dev deps are supply-chain risk too — but they don't pollute the +# user-facing About screen. # # See CLAUDE.md "Dependencies & supply chain" for the full rule, and # `decisions/tooling.md` for the D-record that pins it. schema_version: 1 +# clide itself. Listed first so the About screen can render "You're +# looking at clide vX, MIT-licensed" at the top of the panel before +# the bundled-dependency list underneath. The root LICENSE is the +# authoritative copy; `app/assets/LICENSE` is a mirror bundled so the +# About screen can read it at runtime. +self: + name: clide + version: "2.0.0-dev" + homepage: https://git.schweitz.net/jpmschweitzer/clide + license: MIT + license_file: assets/LICENSE + copyright: "© 2026 Jeroen Schweitzer" + +# Runtime dependencies — ship in the clide binary. dependencies: - name: JetBrains Mono kind: font @@ -47,15 +75,17 @@ dependencies: YAML parser for theme files and extension manifests. The one justified exception to prefer-zero-deps; Dart-team maintained. +# Build-time-only dependencies — test runners, mocks, lints. Tracked +# here for audit completeness; NOT rendered in the About screen. +dev_dependencies: - name: mocktail kind: dart-package version: "1.0.4" homepage: https://pub.dev/packages/mocktail license: MIT purpose: >- - Test-only. Mocks at IO / IPC boundaries. ChangeNotifier facades - use hand-rolled fakes instead of mocks (D-025). - scope: dev + Mocks at IO / IPC boundaries. ChangeNotifier facades use + hand-rolled fakes instead of mocks (D-025). - name: alchemist kind: dart-package @@ -63,14 +93,31 @@ dependencies: homepage: https://pub.dev/packages/alchemist license: MIT purpose: >- - Test-only. Golden-test framework; Ahem-font rendering for - cross-platform pixel stability on widget primitives (D-024). - scope: dev + Golden-test framework; Ahem-font rendering for cross-platform + pixel stability on widget primitives (D-024). - name: flutter_lints kind: dart-package version: "6.0.0" homepage: https://pub.dev/packages/flutter_lints license: BSD-3-Clause - purpose: Test-only. Flutter-team-recommended analyzer lint set. - scope: dev + purpose: Flutter-team-recommended analyzer lint set (app/). + + - name: lints + kind: dart-package + version: "5.0.0" + homepage: https://pub.dev/packages/lints + license: BSD-3-Clause + purpose: >- + Dart-team-recommended analyzer lint set for the Flutter-free + core package at the repo root. + + - name: test + kind: dart-package + version: "1.25.8" + homepage: https://pub.dev/packages/test + license: BSD-3-Clause + purpose: >- + Dart test runner for the core package (Flutter-free; the app + uses flutter_test from the Flutter SDK for widget + golden + coverage). diff --git a/app/pubspec.yaml b/app/pubspec.yaml index 37b58133..35359f4f 100644 --- a/app/pubspec.yaml +++ b/app/pubspec.yaml @@ -53,11 +53,15 @@ flutter: assets: - lib/kernel/src/theme/themes/ - lib/kernel/src/i18n/catalog/ - # Bundled-dependency manifest — read by the About screen. + # Licensing — read by the About screen. `licenses.yaml` is the + # manifest (self + runtime deps + dev deps); each `license_file` + # pointer must also be a bundled asset so the About screen can + # display each dependency's full license text at runtime. + # Root LICENSE is mirrored into assets/LICENSE for the same reason + # (root paths can't be referenced from a Flutter package's assets). # See CLAUDE.md "Dependencies & supply chain" and D-042. - assets/licenses.yaml - # License files referenced by licenses.yaml must be bundled too so - # the About screen can display each dependency's full license text. + - assets/LICENSE - assets/fonts/jetbrains_mono/OFL.txt - assets/fonts/josefin_sans/OFL.txt diff --git a/decisions/tooling.md b/decisions/tooling.md index c11d353a..4e1a5ff0 100644 --- a/decisions/tooling.md +++ b/decisions/tooling.md @@ -18,10 +18,10 @@ Toolchain, supply chain, CI, ignore strategy. - **Cost:** PRs don't run CI yet; `make push-check` is the gate until activation. - **Raised by:** 2026-04-21 planning. -### D-042: Bundled dependencies documented in `licenses.yaml` +### D-042: Dependencies documented in `licenses.yaml` - **Date:** 2026-04-22 -- **Decision:** Every third-party artefact bundled into the clide binary — Dart packages, fonts, native supporter tools, bundled data — has an entry in `app/assets/licenses.yaml` with name, kind, version, homepage, license identifier, relative path to the bundled license text, and a one-line purpose. The file is shipped as a Flutter asset and rendered by the About screen (Tier 6). Adding a bundled dependency is a two-step commit: add the artefact **and** the corresponding `licenses.yaml` entry in the same changeset. -- **Rationale:** Complements [D-031](#d-031-prefer-zero-deps-exact-pin). Prefer-zero-deps is a *budget*; `licenses.yaml` is the *visible consequence*. An extra row in the About screen is a review-time signal that the budget just grew. It also discharges the redistribution obligations bundled licenses impose (OFL, MIT, BSD all require preserving the license text alongside the binary) without ad-hoc NOTICE files. +- **Decision:** `app/assets/licenses.yaml` has three sections: `self:` (clide's MIT license, rendered first in the About screen so the user knows what they're running), `dependencies:` (third-party artefacts that **ship in the binary** — fonts, runtime Dart packages, native supporter tools, bundled data), and `dev_dependencies:` (build-time-only tooling — test runners, mocks, lints, golden harness — tracked for audit but **not rendered** in the About screen because they don't reach the user). Each entry has name, kind, version, homepage, license identifier, and a one-line purpose; runtime entries also carry a `license_file:` pointer to the bundled license text so the About screen can display it verbatim. Adding any dependency is a two-step commit: add the artefact **and** the corresponding `licenses.yaml` entry in the same changeset, under the correct section. +- **Rationale:** Complements [D-031](#d-031-prefer-zero-deps-exact-pin). Prefer-zero-deps is a *budget*; `licenses.yaml` is the *visible consequence*. An extra row in the About screen is a review-time signal that the shipped-binary surface grew. Splitting dev deps out keeps the user-facing list small and honest — a test framework is not something the user needs to see in About — while still documenting every supply-chain input for audit completeness. The runtime entries discharge the redistribution obligations bundled licenses impose (OFL, MIT, BSD all require preserving the license text alongside the binary) without ad-hoc NOTICE files. - **Cost:** One extra edit per dep. Zero tolerance for drift — an un-listed dep is a contributor-visible bug. Until the About screen lands at Tier 6, `licenses.yaml` is accurate but not rendered; the discipline applies from now regardless so Tier 6 inherits a clean list. - **Raised by:** 2026-04-22 planning (user-directed best practice).