Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[retrieval-kernel] Close four third-party license notice gaps before the first stable release

Open
  • Is something wrong?
#249 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
release

Research direction

Start with apps/retrieval-kernel/notices/GAPS.json, which lists the four crates: htmlescape 0.3.1, kanaria 0.2.0, winapi-i686-pc-windows-gnu 0.4.0 and winapi-x86_64-pc-windows-gnu 0.4.0. For each one, check whether it is linked into the linux/amd64 or linux/arm64 artifact, and record proof if it is not. For linked crates, get the license text from a verifiable upstream source, and leave GAPS.json empty and the notice check strict. Done means no gaps remain, with no invented revisions or license text.

Written by the indexing model from the issue text.

Description

Problem

The App image ships the Retrieval Kernel binary with SPDX metadata and supplied third-party notices. Four Rust crates in the locked dependency set have no verified upstream license notice. The image records them in apps/retrieval-kernel/notices/GAPS.json:

  • htmlescape 0.3.1: no recorded upstream revision; no release tag was verified.
  • kanaria 0.2.0 (revision c994ccf06d179851a1c7c3285c3a408ccb6279ec): no matching upstream license file was obtainable.
  • winapi-i686-pc-windows-gnu 0.4.0: no recorded upstream revision; no release tag was verified.
  • winapi-x86_64-pc-windows-gnu 0.4.0: no recorded upstream revision; no release tag was verified.

Engineer ruling

On 2026-10-15 the engineer ruled that prereleases ship with these gaps disclosed, and that the gaps must be closed before the first stable release. This issue blocks the first stable release.

Expected correction

  • For each crate, determine whether it is compiled into any shipped Linux artifact (linux/amd64 and linux/arm64). Remove from the notice obligation only a crate that is proven not to be linked, and record the proof.
  • For each linked crate, obtain the exact license text and copyright notice from a verifiable upstream source (crate package, tagged repository revision or a published crate archive), or replace the dependency.
  • Do not invent a revision, a copyright holder or a license text.
  • Keep GAPS.json empty at the first stable release, and keep the image notice check strict.
Dominant language
TypeScript
Stars
0
Forks
0
Avg merge
12h 53m
Merged PRs (30d)
13

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from lingkaix/openkit

All issues in lingkaix/openkit

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.