Google Git
Sign in
fuchsia/fuchsia/HEAD/./tools/check-licenses/result
tree: 6b93188554fe20f124843e6a78d03f4f5614619b
  1. testdata/
  2. _config.json
  3. BUILD.bazel
  4. BUILD.gn
  5. checks.go
  6. checks_test.go
  7. config.go
  8. config_test.go
  9. README.md
  10. result.go
  11. spdx.go
  12. spdx_test.go
  13. template.go
  14. template_test.go
  15. world.go
  16. world_test.go
tools/check-licenses/result/README.md

tools/check-licenses/result

The result package is the final stage of the check-licenses pipeline. Its primary objective is to aggregate all the data generated by the file, directory, project, and readme packages, perform validation checks against it, and export the final artifacts (NOTICE files, SPDX JSON, metrics tarballs, and compliance summaries).

Core Architecture

result.go (The Orchestrator)

This file exposes SaveResults(), the top-level function called by the CLI driver. It acts as a massive pipeline coordinator:

  • It calls RunChecks() to validate the workspace compliance state.
  • It calls expandTemplates() to generate the actual human-readable NOTICE files.
  • It calls generateSPDXDoc() to generate the machine-readable SPDX JSON.
  • It zips everything up into a .tar.gz archive.

world.go (The Template Context)

This defines a world struct. This struct acts as a massive Data-Transfer Object (DTO) that scoops up every thread-safe global variable from across the tool (like project.GetAllFilteredProjects()) and packages them into a single struct. This struct is then passed directly into Go's text/template engine so the authors of the .txt templates can access any piece of data they need.

  • Deduplication: The getWorldStruct() constructor performs an aggressive O(N) deduplication pass over all filtered license texts. It uses the pre-computed base64 SHA-1 Hash() strings of the texts as map keys, grouping all projects that share identical license texts (e.g., the standard MIT license) into a single DedupedLicense struct. This drastically shrinks the size of the final output file and minimizes memory allocations.

template.go (The Output Generator)

This handles expanding the .txt templates found in the assets/output_templates folder. It uses standard Go text/template, executes them using the world struct as context, and writes the output files (like the NOTICE file) to the out directory, optionally gzipping them.

spdx.go (The JSON Exporter)

It takes the internal data structures and maps them into an official github.com/spdx/tools-golang document, rendering out a massive, compliant results.spdx.json SBOM file.

  • License Expressions: The core complexity of this file lies in building strict, mathematically valid boolean expressions out of license IDs (e.g., (LicenseRef-A AND LicenseRef-B)). It properly handles both single and multi-segment licenses to satisfy the official SPDX v2.2 validator.

checks.go (The Validation Engine)

This is essentially a giant linter for the Fuchsia source tree. It runs a suite of hardcoded compliance checks against the aggregated workspace state.

  • Concurrency: To prevent massive delays, the AllComplianceWorksheetLinksAreGood check uses a bounded worker pool (goroutines executing behind a buffered channel) to parallelize HTTP validation queries. It enforces a strict timeout and always closes response bodies to prevent connection leaks.
  • Allowlists: All checks cross-reference against explicit Allowlist configurations defined in _config.json. If a check fails and is not allowlisted, it throws a fatal error that will stop the fx build or CQ process.