release: binaries and the ghcr image ship without the MIT license text

Open Beginner friendly
  • Is something wrong?
#2,283 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
62/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
c, docker, github-actions
Domain
devops

Research direction

Start with .github/workflows/release.yml around lines 173-176 to see the upload list, then .github/actions/release-build/action.yml lines 33 and 43 where only src/eigenscript is copied into the artifacts. For the image, check the Dockerfile final stage at lines 32-34 and add LICENSE there. Done when a dry-run's artifact list includes the license and docker run --entrypoint cat prints the MIT text.

Written by the indexing model from the issue text.

Description

area:ci bug found-by:duet-audit

Found by a read-only license audit (area 12). Facts only; no legal advice.

What is shipped

The two redistributed artifacts carry the executables and stdlib, but not LICENSE:

  • GitHub release assets. .github/actions/release-build/action.yml:33 and :43 copy only src/eigenscript to eigenscript-$ARTIFACT_LABEL / eigenscript-full-$ARTIFACT_LABEL. .github/workflows/release.yml:173-176 uploads eigenscript-*, CHECKSUMS and attestation.sigstore.json. No license file is in the asset list. (GitHub's auto-generated source archives on the same release do contain LICENSE; the binary assets are separate downloads.)
  • Docker image (ghcr.io/<owner>/eigenscript, pushed by .github/workflows/docker.yml:47,58). Dockerfile:32-34 copies eigenscript, eigenlsp and lib/eigenscript into the final stage. LICENSE is not copied. The binaries have no --license output either (src/main.c handles --version only).

Expected vs actual

  • Expected: LICENSE says the copyright and permission notice "shall be included in all copies or substantial portions of the Software", and the copyright line is "InauguralSystems and contributors". There are 105 merged PRs from authors other than the owner account, so the notice is not only the owner's to waive.
  • Actual: someone who downloads a release binary or pulls the image gets the software with no copy of the notice.

make install and install.sh are not in scope here: they run from a clone that already holds LICENSE.

Done when

  • release.yml's upload list includes LICENSE (or each binary ships in an archive that contains it), checked by listing a dry-run's artifacts.
  • The final Docker stage contains the license text: docker run --rm --entrypoint cat <image> /usr/share/doc/eigenscript/LICENSE (or the chosen path) prints the MIT text.
  • A planted removal of the new LICENSE line from either step makes a check fail (or the check is named in this issue if none is added).

— Duet (orchestrator)

Dominant language
C
Stars
3
Forks
7
Avg merge
6h 26m
Merged PRs (30d)
318

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from InauguralSystems/EigenScript

All issues in InauguralSystems/EigenScript

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.