Add package_info rule and a new gatherer to manage it.

- Add rules/package_info.bzl
- Refactor get_transitive_licenses to get_transitive_metadata.
  - Take a list of providers to gather.
  - Some hackery for Bazel 5.x support. This can be fixed if starlark
    visibility gets backported to Bazel 5.
- Add gather_metadata.bzl.  This is so we can freely experiment on
  techniques for multi provider support in OSS land, without impacting
  existing users in Google. We can merge them some day in the future.
- Create a dummy sbom writer.

There is also experimental code to show a different design choice
for new types of Metadata. I want to preserve both for a while
to have a broader design discussion over the next month.
8 files changed
tree: bb52046c2998df563cbb6699eb402de18e49544f
  1. .bazelci/
  2. .github/
  3. admin/
  4. distro/
  5. docs/
  6. examples/
  7. licenses/
  8. rules/
  9. tests/
  10. tools/
  11. .gitignore
  12. BUILD
  13. CODEOWNERS
  14. deps.bzl
  15. LICENSE
  16. MODULE.bazel
  17. README.md
  18. version.bzl
  19. WORKSPACE
  20. WORKSPACE.bzlmod
README.md

rules_license

CI: Build status

This repository contains a set of rules and tools for

  • declaring metadata about packages, such as
    • the licenses the package is available under
    • the canonical package name and version
    • copyright information
    • ... and more TBD in the future
  • gathering those license declarations into artifacts to ship with code
  • applying organization specific compliance constriants against the set of packages used by a target.
  • (eventually) producing SBOMs for built artifacts.

WARNING: The code here is still in active initial development and will churn a lot.

If you want to follow along:

Background reading: These is for learning about the problem space, and our approach to solutions. Concrete specifications will always appear in checked in code rather than documents.