licensing: add Apache 2.0 (LICENSE, NOTICE, SPDX headers)#283
Conversation
Adds the Apache 2.0 license text verbatim at the repository root. Source: https://www.apache.org/licenses/LICENSE-2.0.txt
Lists direct Go dependencies from go.mod with their licenses and copyright attributions, per Apache 2.0 NOTICE file conventions. Transitive dependencies are tracked via go.mod and the upstream repositories of each dependency.
Adds `// SPDX-License-Identifier: Apache-2.0` to all first-party Go source files in `cmd/` and `pkg/`. Generated code (protobuf in `pkg/cantonsdk/lapi/v2/`, abigen bindings in `pkg/ethereum/contracts/`, mockery-generated mocks, anything carrying a "Code generated" or "DO NOT EDIT" marker) is intentionally skipped. The helper script `scripts/dev/add-spdx-headers.sh` is idempotent: re-running it is a no-op against files that already carry an SPDX header, so future contributors can extend the sweep without manual fiddling.
Adds `# SPDX-License-Identifier: Apache-2.0` to first-party shell scripts under `scripts/` and to the production Dockerfiles (`Dockerfile.local`, `cmd/api-server/Dockerfile`, `cmd/indexer/Dockerfile`, `cmd/relayer/Dockerfile`). For shell scripts, the header is inserted directly after the shebang; for Dockerfiles it sits at the top of the file.
Replaces the `[License details here]` placeholder with a real license section pointing to the Apache 2.0 LICENSE and the NOTICE file.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds SPDX-License-Identifier headers to first-party source files, including Go files, shell scripts, and Dockerfiles, and introduces a helper script add-spdx-headers.sh to automate this process. Two critical issues were identified in the helper script where using mv to replace files causes them to lose their original file permissions (such as the executable bit on shell scripts). It is recommended to redirect the temporary file contents back into the original file instead.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #283 +/- ##
=======================================
Coverage ? 31.28%
=======================================
Files ? 131
Lines ? 10179
Branches ? 0
=======================================
Hits ? 3185
Misses ? 6724
Partials ? 270
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
The SPDX-header sweep in 6832c5b inadvertently downgraded 19 shell scripts from 100755 to 100644, breaking direct invocation via `./scripts/.../foo.sh` (notably `make build-dars` in the E2E workflow, which exits 127 when build-dars.sh is not executable). Root cause: the helper script used `mv tmp file` after rewriting each file, and `rename(2)` adopts the source file's mode (mktemp default 0600 -> normalized to 100644 in git). Restoring the executable bit here; the helper script itself will be updated separately to preserve target mode on rewrite.
`mv tmp file` is rename(2); the target inode adopts the source file's mode (mktemp default 0600 -> 100644 in git). That silently stripped the executable bit on shell scripts during the initial sweep. Switching to `cat tmp >file` keeps the existing target file (and its mode) intact, just overwriting its contents. Re-running the script on an already-headered tree is still a no-op via the SPDX-detection guard.
|
Addressed by commit |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces Apache 2.0 license headers across the codebase, adds an automation script to manage these headers, and implements three new Go-based testing scripts (send-usdcx-direct.go, send-usdcx-transfer.go, and withdraw-via-interface.go) to facilitate direct token transfers and withdrawals. The review feedback highlights several opportunities to improve the robustness and efficiency of these new scripts, specifically by replacing inefficient fmt.Sscanf calls with strconv.ParseFloat, adding a missing AV_Map case to encodeAnyValue for parity, and properly handling ignored errors from io.ReadAll when reading HTTP response bodies.
dhyaniarun1993
left a comment
dhyaniarun1993
left a comment
There was a problem hiding this comment.
It looks like you have added some extra scripts that aren’t related to the license changes. If that was unintentional, could you please remove them? Other than that, everything looks good to me.
The `scripts/dev/add-spdx-headers.sh` helper was used once to seed the SPDX headers across the tree and isn't needed as a checked-in artifact; SPDX coverage is now maintained file-by-file as code is added.
This reverts commit 821f427.
`scripts/testing/send-usdcx-direct.go`, `scripts/testing/send-usdcx-transfer.go`, and `scripts/testing/withdraw-via-interface.go` were untracked working files at the time of branch creation and got swept into commit cbbcd74 by a `git add scripts/` invocation that was supposed to stage only the chmod-only changes on shell scripts. None of these files exist on main; removing them here so this PR stays scoped to licensing.
3 participants
Summary
Brings the canton-middleware repo into compliance with the licensing
posture committed to in the upcoming CIP56/ERC-20 Middleware grant
proposal: all first-party deliverables released under Apache License
2.0, with SPDX headers in every source file and a root
NOTICEenumerating third-party software.
This is the canton-middleware piece of a broader rollout; parallel PRs
follow against the linked submodule repositories
(
ChainSafe/canton-erc20,ChainSafe/canton-wayfinder) and thecanton-snaprepository.Commits in this PR
licensing: add root LICENSE (Apache 2.0)— verbatim text fromhttps://www.apache.org/licenses/LICENSE-2.0.txt.
licensing: add NOTICE enumerating third-party licenses— directGo dependencies from
go.modwith copyright attributions.licensing: add SPDX headers to Go source— 192 files incmd/andpkg/, plus the helper scriptscripts/dev/add-spdx-headers.shused to seed and re-apply headers idempotently. Generated code
(protobuf in
pkg/cantonsdk/lapi/v2/, abigen bindings inpkg/ethereum/contracts/, mockery-generated mocks) is skipped.licensing: add SPDX headers to scripts and Dockerfiles— 20 shellscripts and 4 Dockerfiles.
licensing: update README license section— replaces the[License details here]placeholder.licensing: restore executable bit on shell scripts— fixes moderegression introduced by commit Fix/canton v2 api compatibility #4.
licensing: preserve file mode in SPDX-header helper script—helper script now uses
cat tmp > fileinstead ofmv tmp filesosubsequent runs preserve target permissions.
licensing: drop unrelated WIP scripts pulled in by an earlier git add— removes three untracked working files inscripts/testing/that got swept into commit Production Authentication Implementation #6 by accident; noneexisted on main.
Out of scope
contracts/canton-erc20,contracts/ethereum-wayfinder, and the externally-locatedcanton-snaprepository. Each gets its own PR.halmos-cheatcodesunderopenzeppelin-contracts): confirmed dormant, not referenced by anyfirst-party source, test, or
foundry.toml.Test plan
go build ./...succeeds.go vet ./...clean.go test -count=1 -run='^$' ./...(all test files compile).E2E Tests,PR Lint,PR Testall pass.