From e7fdcab9c1d2126b5291e4f47ddfbb9b62ec24fe Mon Sep 17 00:00:00 2001 From: Hamza Ayed Date: Wed, 7 Oct 2026 19:58:24 +0300 Subject: [PATCH] docs: add Flutter license triage evidence --- SovereignAI-Starter/LICENSE_REVIEW_2026-10.md | 2 +- SovereignAI-Starter/ROADMAP.md | 2 +- SovereignAI-Starter/sbom/README.md | 9 + .../sbom/flutter-license-triage.json | 1051 +++++++++++++++++ .../generate_flutter_license_triage.py | 143 +++ .../tests/test_flutter_license_triage.py | 25 + 6 files changed, 1230 insertions(+), 2 deletions(-) create mode 100644 SovereignAI-Starter/sbom/flutter-license-triage.json create mode 100644 SovereignAI-Starter/scripts/generate_flutter_license_triage.py create mode 100644 SovereignAI-Starter/tests/test_flutter_license_triage.py diff --git a/SovereignAI-Starter/LICENSE_REVIEW_2026-10.md b/SovereignAI-Starter/LICENSE_REVIEW_2026-10.md index 9732ce5..7e4f106 100644 --- a/SovereignAI-Starter/LICENSE_REVIEW_2026-10.md +++ b/SovereignAI-Starter/LICENSE_REVIEW_2026-10.md @@ -35,7 +35,7 @@ ## ما لم يُراجع بعد قبل التوزيع -- جرد مكونات التطوير متاح الآن في [`sbom/component-inventory.json`](sbom/component-inventory.json)، مع طريقة التوليد والحدود في [`sbom/README.md`](sbom/README.md). هذا لا يغلق مراجعة التراخيص: 101 ملف رخصة Flutter تحتاج تصنيفًا يدويًا، كما أن الجرد ليس خاصًا بإصدار إنتاج نهائي. +- جرد مكونات التطوير متاح في [`sbom/component-inventory.json`](sbom/component-inventory.json). أُضيف تقرير فرز نصي مرشح في [`sbom/flutter-license-triage.json`](sbom/flutter-license-triage.json)، ويصفه المولد [`scripts/generate_flutter_license_triage.py`](scripts/generate_flutter_license_triage.py). في لقطة 2026-10-07 وجد التقرير 102 ملف رخصة داخل جذور الحزم: 99 بصمة طابقت توقيعًا نصيًا مرشحًا (78 BSD-3-Clause و16 MIT و3 Apache-2.0 و1 BSD-2-Clause و1 MPL-2.0)، و3 بقيت ملتبسة، وحزمتا SDK بلا ملف رخصة داخل جذر الحزمة. هذه اقتراحات آلية وليست تصنيفات قانونية أو إثباتًا للمصدر أو الإذن بإعادة التوزيع؛ تبقى المراجعة اليدوية لكل الحزم والإشعارات مطلوبة، والجرد ليس خاصًا بإصدار إنتاج نهائي. - مطابقة مصدر كل artifact محلي وبصمته وملف الرخصة المطابق له، ثم إعداد حزمة إشعارات الرخصة للنماذج التي ستُوزع فعلًا. - مراجعة شاملة لاعتماديات Python وFlutter وWindows، وإنتاج SBOM وإشعاراتها. - رخصة PDFium وإشعارها، ورخصة كل وزن OCR محلي مستخدم فعليًا، بما في ذلك ملفات EasyOCR العربية والإنجليزية. diff --git a/SovereignAI-Starter/ROADMAP.md b/SovereignAI-Starter/ROADMAP.md index 24bf7fb..37ca2b6 100644 --- a/SovereignAI-Starter/ROADMAP.md +++ b/SovereignAI-Starter/ROADMAP.md @@ -209,7 +209,7 @@ - تكرار التقييم مع إجابات مرجعية ومراجعين/درجات بشرية، وقياس استهلاك الذاكرة واعتماد مقارنة قابلة للتكرار. (2026-10-03: أُعيد التشغيل بمعايير أوسع: Gemma وQwen أكملتا 5/5 طلبات بلا أخطاء؛ Gemma مرّرت 9/9 فحوص شكلية، وQwen 8/9، ومتوسط الزمن 14.77 مقابل 6.25 ثانية. إجابة Qwen عن SQLite كانت غير دقيقة رغم اجتياز فحص وجود ثلاث نقاط، ما يثبت أن هذه الفحوص لا تقيس صحة المعنى. التقريرين النهائيين `evals/results/gemma4_e2b_2026-10-03_183058.json` و`evals/results/qwen2.5_1.5b-instruct-q4_K_M_2026-10-03_183140.json`. التقييمات السابقة المؤرخة `175827` و`180307` تستخدم فحوصًا أضيق. أُضيف `scripts/capture_ollama_runtime.ps1`: أظهر `/api/ps` حجم Gemma المحمّل 6,733,158,152 بايت وQwen 1,169,980,128 بايت، و`size_vram=0` لكليهما. اللقطتان `evals/results/ollama_runtime_2026-10-03_180846.json` و`...180934.json` لحظيتان وليستا peak؛ لا تربطان كل PID بالنموذج ولم تتوفر قراءة إجمالي/متاح RAM بسبب رفض CIM. لم تُسجل درجات بشرية بعد؛ تبقى مراجعة بشرية، قياس ذروة RAM/VRAM موثوق ومتكرر، وجولات إضافية للمقارنة.) الجولة السابقة كانت Gemma 8/10 بمتوسط 16.32 ثانية وQwen 5/10 بمتوسط 8.93 ثانية. أُصلحت منذها مشكلة الحساب المباشر مقابل الأداة وصيغة Qwen الرياضية؛ مشغّل التقييم يستخدم جلسة loopback مؤقتة ويلغيها. - [x] جرد أولي لترخيص وسوم Ollama المحلية في `LICENSE_REVIEW_2026-10.md` (2026-10-04): فُحصت `ollama show --license` للأوزان الخمسة المثبتة وبطاقات المصادر الرسمية. Gemma 4 E2B وMinistral 3:3b وQwen2.5 وGranite Embedding أظهرت Apache 2.0؛ `gemma3:1b` تستخدم شروط Gemma الإضافية. وثّق الجرد أيضًا تدفق Groq الصوتي الخارجي واحتفاظ البيانات المحتمل. - [x] إنشاء جرد مكونات آلي أولي `sbom/component-inventory.json` باستخدام `scripts/generate_component_inventory.py`: لقطة 2026-10-04 تضم 50 توزيع Python من `.venv` و104 حزم Flutter من `pubspec.lock`، مع بصمات 104 ملفات رخصة وبصمة أرشيف `NOTICES.Z` المضمّن في Windows Debug. اجتازت اختبارات محلّل الجرد 4/4 وفحوص JSON والمرجع الفريد. تُرك التصنيف اليدوي مطلوبًا لـ101 ملف رخصة عثرت عليها الأداة دون تصنيف تلقائي. الملف ليس جرد إصدار إنتاج محصورًا ولا مراجعة قانونية ولم يُتحقق من مخطط CycloneDX الرسمي؛ لا يتضمن علاقات الاعتماد أو كامل مكونات Windows الأصلية وPDFium وأوزان OCR/النماذج. -- [ ] اعتماد النماذج والاعتماديات لنسخة تجارية محددة: مطابقة مصدر وبصمة كل وزن سيُشحن، حزمة SBOM وإشعارات Python/Flutter/Windows/PDFium/OCR، معالجة قيود Gemma 3 أو استبعادها، وشروط Groq وإفصاح الصوت. لا يُعد الجرد الأولي أعلاه موافقة قانونية أو جاهزية إصدار. تقدم 2026-10-04: صُححت مراجعة Gemma 4 بعد مطابقة وسم Ollama المحلي وبصمته الكاملة مع `/api/tags` ونص Apache 2.0 من `/api/show`؛ بطاقة Google الرسمية تعلن Apache 2.0 أيضًا. تقدم 2026-10-07: أُدرجت بصمة PDFium وإشعارات binary المطابقة، وملفات أوزان EasyOCR التي تطابق MD5 في إعداد 1.7.2، وسُجل غياب وزن الإنجليزية. بقيت مراجعة شروط توزيع أوزان OCR وتبعيات PDFium، وتصنيف إشعارات Flutter الـ101، ومطابقة المصدر/الأوزان لكل إصدار نهائي، وشروط Groq والمراجعة القانونية. +- [ ] اعتماد النماذج والاعتماديات لنسخة تجارية محددة: مطابقة مصدر وبصمة كل وزن سيُشحن، حزمة SBOM وإشعارات Python/Flutter/Windows/PDFium/OCR، معالجة قيود Gemma 3 أو استبعادها، وشروط Groq وإفصاح الصوت. لا يُعد الجرد الأولي أعلاه موافقة قانونية أو جاهزية إصدار. تقدم 2026-10-04: صُححت مراجعة Gemma 4 بعد مطابقة وسم Ollama المحلي وبصمته الكاملة مع `/api/tags` ونص Apache 2.0 من `/api/show`؛ بطاقة Google الرسمية تعلن Apache 2.0 أيضًا. تقدم 2026-10-07: أُدرجت بصمة PDFium وإشعارات binary المطابقة، وملفات أوزان EasyOCR التي تطابق MD5 في إعداد 1.7.2، وسُجل غياب وزن الإنجليزية. في 2026-10-07 أُضيف `scripts/generate_flutter_license_triage.py` وتقرير `sbom/flutter-license-triage.json`: عولجت 102 رخصة من جذور الحزم ببصمات SHA-256؛ 99 لها اقتراح توقيع SPDX، و3 بقيت ملتبسة، وحزمتا SDK لا تحتويان ملف رخصة داخل الجذر. اجتاز اختبارا classifier 2/2. الاقتراحات ليست مراجعة قانونية ولا تغلق البند. بقيت مراجعة شروط توزيع أوزان OCR وتبعيات PDFium، والتحقق البشري من كل تراخيص Flutter ومطابقة المصدر/الأوزان لكل إصدار نهائي، وشروط Groq والمراجعة القانونية. - تحسين أولي عبر prompts وRAG والأدوات؛ هذه غالبًا تعالج نقص المعرفة أو القدرة على الفعل دون تغيير أوزان النموذج. - عند توفر GPU مناسب: تجربة LoRA/QLoRA على بيانات مرخصة ومنقحة، ومقارنة النتائج بالمجموعة المرجعية قبل اعتماد adapter. - تدريب نموذج أساسي من الصفر خارج نطاق العتاد الشخصي المعتاد؛ يحتاج بيانات وحوسبة وبنية تدريب كبيرة، ولا يكون خطتنا الأولى. diff --git a/SovereignAI-Starter/sbom/README.md b/SovereignAI-Starter/sbom/README.md index dee57fc..bd52208 100644 --- a/SovereignAI-Starter/sbom/README.md +++ b/SovereignAI-Starter/sbom/README.md @@ -9,12 +9,21 @@ The generator performs local JSON and uniqueness checks; this snapshot has not y - 50 Python distributions from `.venv`: 8 direct runtime requirements, 1 optional OCR requirement, and 41 installed transitive/development packages. Python versions are the versions installed in this local environment; `requirements.txt` still uses ranges and is not a fully pinned production lock. - 104 Flutter pub packages from the resolved lock: 15 direct main, 3 direct development, and 86 transitive/SDK packages. - 104 package license files have SHA-256 evidence. For 101 components the inventory can find a license file but deliberately does not classify its legal terms automatically. The remaining declarations come from distribution/package metadata or the Flutter SDK license notice. +- A separate text-signature triage report is generated at `flutter-license-triage.json`. At this snapshot it found 102 package license files directly in resolved package roots: 98 have a single recognizable candidate signature (78 BSD-3-Clause, 16 MIT, 3 Apache-2.0, and 1 BSD-2-Clause), 1 has an MPL-2.0 signature, and 3 remain ambiguous/unclassified; 2 SDK packages have no package-root license file. These are **candidates only**, not legal classifications. Every item still needs a reviewer to confirm the package's declared terms, source and included notices; the counts do not replace the 104-file hash evidence in the main inventory. - The Windows Debug artifact bundled `NOTICES.Z` (SHA-256 `eb0096c70ca8a2b23d1a806f1fddb5ce379730712347b267b7c7de4599b8ba70`; 1,836,646 bytes after decompression). The application build already carries this Flutter notice archive. - Three host-local runtime artifacts are now hashed as CycloneDX file/model components. `pypdfium2` 5.13.0's `pdfium.dll` is 7,260,672 bytes (SHA-256 `fb898a1f5ace57805834f390407500bdb6ef93eff326a252ad334a8aae809d8e`); the inventory records hashes for 16 Windows x64 `BUILD_LICENSES` files shipped in the wheel. - EasyOCR 1.7.2's local `arabic.pth` (215,400,714 bytes; SHA-256 `2a9afd42c374deb98aed0b53c9b77d75e1d00d4e0501f3b0276c54190c89b1a8`) and `craft_mlt_25k.pth` (83,152,330 bytes; SHA-256 `4a5efbfb48b4081100544e75e1e2b57f8de3d84f213004b14b85fd4b3748db17`) match the MD5 identifiers in the pinned EasyOCR model configuration. This confirms artifact identity against that manifest, not redistribution rights; both model components remain marked for human license review. `english_g2.pth`, which the current Arabic/English reader expects, is absent from this host's OCR model directory and is recorded as missing. The OCR code may download it when first initializing because downloads are enabled by default. The inventory does not include dependency edges, a release-only Python environment, all native Windows/C++ components, or completed classification of PDFium/OCR notices. It does not decide whether any license permits a specific commercial distribution. Continue the manual source, hash, notice, and terms review in `LICENSE_REVIEW_2026-10.md` for the exact release artifacts. +The Flutter candidate report can be regenerated from the repository root with: + +```powershell +& .\.venv\Scripts\python.exe .\scripts\generate_flutter_license_triage.py +``` + +It uses only local lockfile/package-cache files and SHA-256 hashes. A missing or ambiguous entry must remain unresolved until reviewed against its package and upstream terms. + ## Regenerate From the repository root, after installing Python requirements in `.venv` and resolving Flutter packages: diff --git a/SovereignAI-Starter/sbom/flutter-license-triage.json b/SovereignAI-Starter/sbom/flutter-license-triage.json new file mode 100644 index 0000000..650a24b --- /dev/null +++ b/SovereignAI-Starter/sbom/flutter-license-triage.json @@ -0,0 +1,1051 @@ +{ + "format": "flutter-license-triage-v1", + "generated_at": "2026-10-07T16:56:52.410488+00:00", + "source": "flutter_app/pubspec.lock and resolved package LICENSE files", + "notice": "Text-signature suggestions only. Not legal advice, provenance verification, or approval to redistribute. Review each package, source, notices, and terms.", + "summary": { + "locked_packages": 104, + "packages_with_license_file": 102, + "packages_without_license_file": 2, + "candidate_counts": { + "Apache-2.0": 3, + "BSD-2-Clause": 1, + "BSD-3-Clause": 78, + "MIT": 16, + "MPL-2.0": 1, + "unclassified": 3 + } + }, + "packages": [ + { + "name": "archive", + "version": "4.3.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "32f97d332eae7453ec4079858e6f1d74be85beeb6d3881068b47d02a379cccea", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "args", + "version": "2.7.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "dfb09c74e29386cd3e2719f32d4995d59526179753931d31840757c77fbf2791", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "async", + "version": "2.12.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "ff15faa32a2e638107b7789592b14426162a75ba620044ee2340a20ec6ce5e73", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "bloc", + "version": "9.2.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "798c1759b3fb8bbcb91ba0f22360bf60070a07ded17cfff0f77d5e7183c494e6", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "boolean_selector", + "version": "2.1.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "b71519245009a3b8f126196a5408ec031e216e8e0d985085958c6543f82a8a2a", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "characters", + "version": "1.4.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "0371d1da6a57fb791db29d29b95333429205f51f3cb2eb3a0c12d91838a38744", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "checked_yaml", + "version": "2.0.3", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "4771d808721f4d5f02318ab857c92f5a5dce87b14ae1c3770fe21ca7fd4a9280", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "cli_util", + "version": "0.4.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "ff15faa32a2e638107b7789592b14426162a75ba620044ee2340a20ec6ce5e73", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "clock", + "version": "1.1.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "58d1e17ffe5109a7ae296caafcadfdbe6a7d176f0bc4ab01e12a689b0499d8bd", + "candidate_spdx": "Apache-2.0", + "candidate_basis": "license text contains the Apache License 2.0 title", + "status": "candidate only; human review required" + }, + { + "name": "collection", + "version": "1.19.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "ff15faa32a2e638107b7789592b14426162a75ba620044ee2340a20ec6ce5e73", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "cross_file", + "version": "0.3.4+2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "crypto", + "version": "3.0.7", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "ad6a71997da90924b2cfb1fb47ec46537f70faf469efe016168794ae45ed6888", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "cupertino_icons", + "version": "1.0.8", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "310d6ab6483280280c9db122bded0a63c09558bc5743720f61dbcbb494db370a", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "dbus", + "version": "0.7.12", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "1f256ecad192880510e84ad60474eab7589218784b9a50bc7ceee34c2b91f1d5", + "candidate_spdx": "MPL-2.0", + "candidate_basis": "license text contains the Mozilla Public License 2.0 title", + "status": "candidate only; human review required" + }, + { + "name": "fake_async", + "version": "1.3.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "58d1e17ffe5109a7ae296caafcadfdbe6a7d176f0bc4ab01e12a689b0499d8bd", + "candidate_spdx": "Apache-2.0", + "candidate_basis": "license text contains the Apache License 2.0 title", + "status": "candidate only; human review required" + }, + { + "name": "ffi", + "version": "2.2.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "0371d1da6a57fb791db29d29b95333429205f51f3cb2eb3a0c12d91838a38744", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "file", + "version": "7.0.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "f6df86b1412172537273e8e80ee2fb8a66aa7307ce0b39ea5ddab47ca41b8c49", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "file_selector", + "version": "1.0.4", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "file_selector_android", + "version": "0.5.1+17", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "8e139d4c7faa5e7a76752e743a745113f46e658071733bfae4914a04da12ae0e", + "candidate_spdx": null, + "candidate_basis": "multiple license signatures occur in this file; manual review required", + "status": "candidate only; human review required" + }, + { + "name": "file_selector_ios", + "version": "0.5.3+2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "file_selector_linux", + "version": "0.9.3+2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "file_selector_macos", + "version": "0.9.4+4", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "file_selector_platform_interface", + "version": "2.7.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "420f7739f169097f0aad1242045169cd643c8f1d94e62866fad265ae4c369b7d", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "file_selector_web", + "version": "0.9.4+2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "file_selector_windows", + "version": "0.9.3+4", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "fixnum", + "version": "1.1.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "ff0b91d4f3c32b25cb6ec84985e8da89b0ba2a2b2f7eef353cda5e5423a20390", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "flutter", + "version": "0.0.0", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "a3a9fd82f800a47377f7d3f60c60a5c91cae0495be8f329031e1448ce0f5dab9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "flutter_bloc", + "version": "9.1.1", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "7e944ae2d1553a6c1db91ec53a5ed1b0e1b078637748d8b70995a5afc4e37d6e", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "flutter_highlight", + "version": "0.7.0", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "74f15c4199829a470ca46f2be1a9c40ec1d2fa21d1e42a91786d5ef5dc0dde00", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "flutter_launcher_icons", + "version": "0.14.4", + "scope": "direct dev", + "license_file": "LICENSE", + "license_file_sha256": "02c454256448927423b4c0e517a083cadf78a8d9467a9d31ad3b4f4ff48ff7ca", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "flutter_lints", + "version": "5.0.0", + "scope": "direct dev", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "flutter_local_notifications", + "version": "18.0.1", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "d6885e4633e08ec3a52cd90299b97831444d487f16721e5d092289bcfedfc511", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "flutter_local_notifications_linux", + "version": "5.0.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "d6885e4633e08ec3a52cd90299b97831444d487f16721e5d092289bcfedfc511", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "flutter_local_notifications_platform_interface", + "version": "8.0.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "2d77e2f3421858873865cf0bb0afd2fcf6f5ad8df9bdab10a7d7503bcf8a1c44", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "flutter_secure_storage", + "version": "10.3.4", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "55dafb084270616f95b9bea53654adda8bdcad95c022a83c4cf8769073f829fa", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "flutter_secure_storage_darwin", + "version": "0.3.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "3754c516086c62307896512b68024837bee5d2bea42a55cfd03f7448b92b06c8", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "flutter_secure_storage_linux", + "version": "3.0.3", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "55dafb084270616f95b9bea53654adda8bdcad95c022a83c4cf8769073f829fa", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "flutter_secure_storage_platform_interface", + "version": "2.1.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "55dafb084270616f95b9bea53654adda8bdcad95c022a83c4cf8769073f829fa", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "flutter_secure_storage_web", + "version": "2.1.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "55dafb084270616f95b9bea53654adda8bdcad95c022a83c4cf8769073f829fa", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "flutter_secure_storage_windows", + "version": "4.1.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "55dafb084270616f95b9bea53654adda8bdcad95c022a83c4cf8769073f829fa", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "highlight", + "version": "0.7.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "74f15c4199829a470ca46f2be1a9c40ec1d2fa21d1e42a91786d5ef5dc0dde00", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "http", + "version": "1.6.0", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "3c32b53167c7dae9190c38dab5dd9fe1789c53623ebc7d1babcb29914c5b3f16", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "http_parser", + "version": "4.1.2", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "3c32b53167c7dae9190c38dab5dd9fe1789c53623ebc7d1babcb29914c5b3f16", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "image", + "version": "4.10.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "f3c17da84e0780e1c334325c73098257c32221d62498ed55ef3c1361904925aa", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "json_annotation", + "version": "4.9.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "143839f62c9b7f88143ea9f688361c27050888acde7696b34e04414bd254fafc", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "leak_tracker", + "version": "10.0.8", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "08a004aa8956c3cf3b24f7f69c966247233953e18e6afaa61191ea47b7eb70f6", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "leak_tracker_flutter_testing", + "version": "3.0.9", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "08a004aa8956c3cf3b24f7f69c966247233953e18e6afaa61191ea47b7eb70f6", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "leak_tracker_testing", + "version": "3.0.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "08a004aa8956c3cf3b24f7f69c966247233953e18e6afaa61191ea47b7eb70f6", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "lints", + "version": "5.1.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "421fe78c3b5df297f8b4ab2c74f2450a274ee6d245a113091f6b9f90570af193", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "local_notifier", + "version": "0.1.6", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "516e1f470fd0e4c5c6cf02b6876153a9145283660a5de03fe9812b207dc34db5", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "matcher", + "version": "0.12.17", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "3c32b53167c7dae9190c38dab5dd9fe1789c53623ebc7d1babcb29914c5b3f16", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "material_color_utilities", + "version": "0.11.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "d103f246ef4c18dab8af0c1dcf6a8af884e5cff554da7261a48ac43c17d98f2e", + "candidate_spdx": "Apache-2.0", + "candidate_basis": "license text contains the Apache License 2.0 title", + "status": "candidate only; human review required" + }, + { + "name": "meta", + "version": "1.16.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "b71519245009a3b8f126196a5408ec031e216e8e0d985085958c6543f82a8a2a", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "mime", + "version": "2.0.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "ff15faa32a2e638107b7789592b14426162a75ba620044ee2340a20ec6ce5e73", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "nested", + "version": "1.0.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "fccaeae95a39c93176de9321c734c90d8e36f465c48fcf278840844d8eab1af4", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "path", + "version": "1.9.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "3c32b53167c7dae9190c38dab5dd9fe1789c53623ebc7d1babcb29914c5b3f16", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "path_provider", + "version": "2.1.5", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "path_provider_android", + "version": "2.2.16", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "path_provider_foundation", + "version": "2.4.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "path_provider_linux", + "version": "2.2.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "path_provider_platform_interface", + "version": "2.1.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "path_provider_windows", + "version": "2.3.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "petitparser", + "version": "6.1.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "1f18a2e5a5c57381d93efa92df86477eb1205689b345417c90fcfdc09fa4fa1f", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "platform", + "version": "3.1.6", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "143839f62c9b7f88143ea9f688361c27050888acde7696b34e04414bd254fafc", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "plugin_platform_interface", + "version": "2.1.8", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "posix", + "version": "6.5.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "aaf6271abd048deb3125828613f1797b7556472de6c7acd7103bd43e9cb6a84b", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "provider", + "version": "6.1.5+1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "fccaeae95a39c93176de9321c734c90d8e36f465c48fcf278840844d8eab1af4", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "record", + "version": "6.2.1", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "5a21ee0d2585baccfde18aeb045037701172460213db723e9d189ca1922aaf79", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "record_android", + "version": "1.5.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "5a21ee0d2585baccfde18aeb045037701172460213db723e9d189ca1922aaf79", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "record_ios", + "version": "1.2.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "5a21ee0d2585baccfde18aeb045037701172460213db723e9d189ca1922aaf79", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "record_linux", + "version": "1.3.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "5a21ee0d2585baccfde18aeb045037701172460213db723e9d189ca1922aaf79", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "record_macos", + "version": "1.2.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "5a21ee0d2585baccfde18aeb045037701172460213db723e9d189ca1922aaf79", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "record_platform_interface", + "version": "1.6.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "5a21ee0d2585baccfde18aeb045037701172460213db723e9d189ca1922aaf79", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "record_web", + "version": "1.3.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "5a21ee0d2585baccfde18aeb045037701172460213db723e9d189ca1922aaf79", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "record_windows", + "version": "1.0.7", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "b0cbe4a6717dc8286d44792bd905fdc49f179b80af8d1543e4194e61766803a3", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "share_plus", + "version": "10.1.4", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "eb9741a672906ebd01fd9b3bef38f6c82eff250e91149cf404539ee7981079fd", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "share_plus_platform_interface", + "version": "5.0.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "3b38d48befd0af70b892e13d10c9e34679416c24a9277f962629951c64d71f4c", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "sky_engine", + "version": "0.0.0", + "scope": "transitive", + "license_file": "license", + "license_file_sha256": "5f0e774c67dda412e9550b8ce7408a3543e174f8ccb03ace280ddf4c5a8c8fec", + "candidate_spdx": null, + "candidate_basis": "multiple license signatures occur in this file; manual review required", + "status": "candidate only; human review required" + }, + { + "name": "source_span", + "version": "1.10.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "3c32b53167c7dae9190c38dab5dd9fe1789c53623ebc7d1babcb29914c5b3f16", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "stack_trace", + "version": "1.12.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "ff0b91d4f3c32b25cb6ec84985e8da89b0ba2a2b2f7eef353cda5e5423a20390", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "stream_channel", + "version": "2.1.4", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "ff15faa32a2e638107b7789592b14426162a75ba620044ee2340a20ec6ce5e73", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "string_scanner", + "version": "1.4.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "3c32b53167c7dae9190c38dab5dd9fe1789c53623ebc7d1babcb29914c5b3f16", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "term_glyph", + "version": "1.2.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "ea97a7558a7bd7cee4e2355f7529e3cbebb0dcbb546ddb9a90f10c9eb6b08da5", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "test_api", + "version": "0.7.4", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "ff1b9f0df9036c04be424b1e3ce12789bea880ad5ffc3a48e069ae2d40a087a4", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "timezone", + "version": "0.10.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "d8f160d6dcdd4ec77522646d04c139d89d55910d6852792d2b441625763c012f", + "candidate_spdx": "BSD-2-Clause", + "candidate_basis": "license text contains a two-clause BSD-style grant and disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "typed_data", + "version": "1.4.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "ff15faa32a2e638107b7789592b14426162a75ba620044ee2340a20ec6ce5e73", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "url_launcher", + "version": "6.3.1", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "url_launcher_android", + "version": "6.3.15", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "url_launcher_ios", + "version": "6.3.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "url_launcher_linux", + "version": "3.2.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "url_launcher_macos", + "version": "3.2.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "url_launcher_platform_interface", + "version": "2.3.2", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "url_launcher_web", + "version": "2.4.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "f9bd6d4f1da93f33d7d9aa44848bee6d1bacf1c5049d3ba2fd3f5d362a01ceab", + "candidate_spdx": null, + "candidate_basis": "multiple license signatures occur in this file; manual review required", + "status": "candidate only; human review required" + }, + { + "name": "url_launcher_windows", + "version": "3.1.4", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "uuid", + "version": "4.6.0", + "scope": "direct main", + "license_file": "LICENSE", + "license_file_sha256": "ad3e5523e51004e94ba9ce728805b1b4242dbccdb65e62b523800e35a8a7cfdc", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "vector_math", + "version": "2.1.4", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "b5d856a1e27e9ebea4957fc3526f1c65782a04894b113c6b3b0fb1321dbdec55", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "vm_service", + "version": "14.3.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "ad6a71997da90924b2cfb1fb47ec46537f70faf469efe016168794ae45ed6888", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "web", + "version": "1.1.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "aa913ff50d7542eb8cc35b9f48a80928ac6819ba9057f85d424655e3e8dc271c", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "win32", + "version": "5.10.1", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "87ef8bccdd619f2345ba5b9026cf1d6cccb305e36ab83849a8a3af9293abde7e", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "xdg_directories", + "version": "1.1.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "89519eca6f7b9529b35bdddd623a58c3af06a88c458dbd6531ddb4675acf75a9", + "candidate_spdx": "BSD-3-Clause", + "candidate_basis": "license text contains the three-clause BSD endorsement restriction", + "status": "candidate only; human review required" + }, + { + "name": "xml", + "version": "6.5.0", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "5fcf06da398e047a219dfbe7f4b39e83720003c971cc8e9ee40d057f979bdd6d", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + }, + { + "name": "yaml", + "version": "3.1.4", + "scope": "transitive", + "license_file": "LICENSE", + "license_file_sha256": "d47b93335401b052d79a2f5a3710e4cf7b5aed782faedf84d40fbdd6eb934ec7", + "candidate_spdx": "MIT", + "candidate_basis": "license text contains the standard MIT grant and warranty disclaimer", + "status": "candidate only; human review required" + } + ], + "missing_license_file": [ + { + "name": "flutter_test", + "version": "0.0.0" + }, + { + "name": "flutter_web_plugins", + "version": "0.0.0" + } + ] +} diff --git a/SovereignAI-Starter/scripts/generate_flutter_license_triage.py b/SovereignAI-Starter/scripts/generate_flutter_license_triage.py new file mode 100644 index 0000000..c6845eb --- /dev/null +++ b/SovereignAI-Starter/scripts/generate_flutter_license_triage.py @@ -0,0 +1,143 @@ +"""Create a hash-backed, non-legal triage report for unresolved Flutter licenses.""" + +from __future__ import annotations + +import argparse +import json +import re +from datetime import UTC, datetime +from pathlib import Path + +try: + from scripts.generate_component_inventory import ( + digest, + flutter_license_file, + package_roots, + parse_lockfile, + ) +except ModuleNotFoundError: # direct execution as `python scripts/...py` + from generate_component_inventory import ( + digest, + flutter_license_file, + package_roots, + parse_lockfile, + ) + + +def candidate_license(text: str) -> tuple[str | None, str]: + """Suggest an SPDX identifier only when the license's identifying text is clear. + + Suggestions are for human triage. They do not establish provenance, package + applicability, exceptions, or permission to redistribute. + """ + normalized = re.sub(r"(?m)^\s*(?://|#|\*)\s?", "", text).lower() + normalized = re.sub(r"\s+", " ", normalized) + + matches: list[tuple[str, str]] = [] + if "mozilla public license version 2.0" in normalized: + matches.append(("MPL-2.0", "license text contains the Mozilla Public License 2.0 title")) + if "apache license" in normalized and "version 2.0" in normalized: + matches.append(("Apache-2.0", "license text contains the Apache License 2.0 title")) + if ( + "permission is hereby granted, free of charge" in normalized + and "the software is provided" in normalized + and "in no event shall" in normalized + ): + matches.append(("MIT", "license text contains the standard MIT grant and warranty disclaimer")) + if ( + "redistribution and use in source and binary forms" in normalized + and "neither the name" in normalized + and "disclaimer" in normalized + ): + matches.append(("BSD-3-Clause", "license text contains the three-clause BSD endorsement restriction")) + if ( + "redistribution and use in source and binary forms" in normalized + and "neither the name" not in normalized + and "disclaimer" in normalized + and "provided that the following conditions are met" in normalized + ): + matches.append(("BSD-2-Clause", "license text contains a two-clause BSD-style grant and disclaimer")) + if len(matches) == 1: + return matches[0] + if len(matches) > 1: + return None, "multiple license signatures occur in this file; manual review required" + return None, "no conservative license-text signature matched" + + +def build_report(root: Path) -> dict[str, object]: + app_root = root / "flutter_app" + packages = parse_lockfile(app_root / "pubspec.lock") + roots = package_roots(app_root / ".dart_tool" / "package_config.json") + entries: list[dict[str, object]] = [] + missing: list[dict[str, str]] = [] + + for package in packages: + name = package["name"] + package_root = roots.get(name) + license_file = flutter_license_file(package_root) if package_root else None + if license_file is None: + missing.append({"name": name, "version": package["version"]}) + continue + + text = license_file.read_text(encoding="utf-8", errors="replace") + candidate, basis = candidate_license(text) + entries.append( + { + "name": name, + "version": package["version"], + "scope": package.get("dependency", "transitive"), + "license_file": license_file.name, + "license_file_sha256": digest(license_file), + "candidate_spdx": candidate, + "candidate_basis": basis, + "status": "candidate only; human review required", + } + ) + + counts: dict[str, int] = {} + for entry in entries: + candidate = entry["candidate_spdx"] or "unclassified" + counts[str(candidate)] = counts.get(str(candidate), 0) + 1 + + return { + "format": "flutter-license-triage-v1", + "generated_at": datetime.now(UTC).isoformat(), + "source": "flutter_app/pubspec.lock and resolved package LICENSE files", + "notice": ( + "Text-signature suggestions only. Not legal advice, provenance verification, " + "or approval to redistribute. Review each package, source, notices, and terms." + ), + "summary": { + "locked_packages": len(packages), + "packages_with_license_file": len(entries), + "packages_without_license_file": len(missing), + "candidate_counts": dict(sorted(counts.items())), + }, + "packages": sorted(entries, key=lambda item: str(item["name"]).lower()), + "missing_license_file": sorted(missing, key=lambda item: item["name"].lower()), + } + + +def main() -> int: + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument( + "--project-root", + type=Path, + default=Path(__file__).resolve().parents[1], + ) + parser.add_argument("--output", type=Path, default=None) + args = parser.parse_args() + root = args.project_root.resolve() + output = args.output or root / "sbom" / "flutter-license-triage.json" + report = build_report(root) + output.parent.mkdir(parents=True, exist_ok=True) + output.write_text( + json.dumps(report, ensure_ascii=False, indent=2) + "\n", encoding="utf-8" + ) + print(json.dumps(report["summary"], ensure_ascii=False, sort_keys=True)) + print(f"Wrote {output}") + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/SovereignAI-Starter/tests/test_flutter_license_triage.py b/SovereignAI-Starter/tests/test_flutter_license_triage.py new file mode 100644 index 0000000..791d757 --- /dev/null +++ b/SovereignAI-Starter/tests/test_flutter_license_triage.py @@ -0,0 +1,25 @@ +from __future__ import annotations + +import unittest + +from scripts.generate_flutter_license_triage import candidate_license + + +class FlutterLicenseTriageTests(unittest.TestCase): + def test_recognizes_common_license_text_signatures_conservatively(self) -> None: + mit = "Permission is hereby granted, free of charge, to any person. The Software is provided AS IS. In no event shall the authors be liable." + mpl = "Mozilla Public License Version 2.0" + bsd3 = "Redistribution and use in source and binary forms are permitted provided that the following conditions are met. Neither the name of the project nor the names of its contributors may be used to endorse products. THIS SOFTWARE IS PROVIDED AS IS; DISCLAIMER" + + self.assertEqual(candidate_license(mit)[0], "MIT") + self.assertEqual(candidate_license(mpl)[0], "MPL-2.0") + self.assertEqual(candidate_license(bsd3)[0], "BSD-3-Clause") + + def test_keeps_ambiguous_notice_unclassified(self) -> None: + self.assertIsNone(candidate_license("Copyright 2026 Example Authors. All rights reserved." )[0]) + mixed = "Mozilla Public License Version 2.0. Apache License Version 2.0." + self.assertIsNone(candidate_license(mixed)[0]) + + +if __name__ == "__main__": + unittest.main()