Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Ship third-party license notices for everything in the installer

Đang mở
  • Có gì không ổn?
#1,941 1 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

@Cedric921 đang làm issue này rồi.

Từ ngày 6/10/2026.

Đánh giá

Độ khó
5/5
Thời gian dự kiến
Hơn một tuần
Mức phù hợp với người mới
42/100
Loại issue
Tính năng
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
electron, python, typescript
Lĩnh vực
devops, release

Hướng nghiên cứu

Read CONTRIBUTING.md, docs/architecture/about.md and docs/architecture/packaging.md; inspect electron-builder.yml and the listed fetch/build scripts to trace shipped artifacts. Start with about-settings.test.tsx and the license-generation test, then run the frontend and Electron tests and typecheck as listed. Done means generated notices for shipped dependencies are available offline in the app, the About documentation is updated, and the known-gap entry is removed.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

desktop documentation help wanted

The gap

docs/architecture/about.md lists this under Known gaps:

No third-party license notices ship with the app. Generating them needs the frontend's npm dependencies, the Python sidecars' packages and the bundled native binaries collected at build time.

Why it matters

Settings › About has a License section that says SurfSense is Apache 2.0 and links the repository's LICENSE. That is SurfSense's own licence. The installer also ships hundreds of other people's work — the renderer's npm tree, two frozen Python binaries, llama-server, sd-server, audio.cpp and the eSpeak-ng it phonemises through, and the embedding, voice and Docling parser packs — and none of their notices reach the user's machine.

Most of those licences (MIT, BSD, Apache 2.0) require the notice to travel with the binary. A user who wants to know what is in the app they installed, or a company deciding whether they may deploy it, has nowhere to look and no file to point at.

Where

Collect, do not add a dependency. pnpm licenses list --json ships with pnpm (the tree is pinned to [email protected]) and covers both npm trees. Python distribution metadata carries the licence and the classifier, readable from the environment uv sync already builds. The native binaries are fetched by pinned-version scripts that can fetch the licence file alongside the binary.

What done looks like

  • A user can read the notices for everything that shipped, from the running app, offline. The app is offline by default and the notices describe what is on this machine, so a link to the web is a weaker answer than a bundled file — but it is yours to choose, with the reason in the PR.
  • The notices are produced by the build from the pinned versions, not written by hand. A hand-maintained list is wrong the first time a dependency moves.
  • A dependency added to any of the three trees appears in the notices without anyone remembering to do anything.
  • Say what you did about the parts that resist automation: a native binary whose release carries no licence file, and a model pack, whose weights have licences of their own.
  • Update docs/architecture/about.md — the What it shows list describes the License line — and delete the Known gaps line in the same PR.

What not to change

The four rows in about-links.ts are constrained by external-url.ts, which drops anything outside surfsense.com, github.com/MODSetter/SurfSense and the Discord invite. Do not widen that allowlist to make a link work; it is an egress boundary, described in egress.

How to verify

surfsense_local/frontend/src/features/about/about-settings.test.tsx covers the About pane. Write the failing test first, on whichever half you start with: that the pane offers the notices, and that the generator produces an entry for a known dependency.

cd surfsense_local/frontend
pnpm test
cd ../electron
pnpm test
pnpm typecheck

Before you start

Read CONTRIBUTING.md, the about doc and the packaging doc, which is where the build's shape is described. Interface strings in surfsense_local follow the translate skill described in AGENTS.md — note that licence text itself is not interface text and is not translated. UI work follows the frontend-workflow skill. This is a big one; comment here with the approach you mean to take before you write much of it, and open your PR against dev, not main.

Ngôn ngữ chính
Python
Star
16.3k
Fork
1.6k
Merge trung bình
19 giờ 14 phút
Pull request đã merge (30 ngày)
252

Chuẩn bị môi trường

Dự án này không cung cấp dev container, Dockerfile hay hướng dẫn đóng góp, nên bạn cần tự thiết lập môi trường: hãy bắt đầu từ README và xem hướng dẫn đóng góp lần đầu của chúng tôi để biết các bước chung.

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của MODSetter/SurfSense

Tất cả issue của MODSetter/SurfSense

Issue tương tự

Thêm issue về Python

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.