mirror of
https://github.com/vxcontrol/pentagi.git
synced 2026-08-26 13:06:32 +00:00
feat: add license compliance documentation and reporting tools
- Introduce CONTRIBUTING.md for license compliance guidelines for developers. - Update Dockerfile to generate license reports for frontend and backend dependencies. - Add scripts for generating license reports and include them in the Docker build process. - Create README.md and .gitignore files in the licenses directory for better organization. - Update go.mod and go.sum to use the latest versions of vxcontrol dependencies. This enhances the project's compliance with licensing requirements and improves dependency management.
This commit is contained in:
Dmitry Ng
@@ -0,0 +1,67 @@
|
||||
# License Compliance Guide
|
||||
|
||||
## Overview
|
||||
|
||||
PentAGI is **MIT licensed** and all dependencies use MIT-compatible licenses.
|
||||
|
||||
## For Developers
|
||||
|
||||
### Adding New Dependencies
|
||||
|
||||
When adding new dependencies, ensure they use compatible licenses:
|
||||
|
||||
#### Approved Licenses
|
||||
- MIT
|
||||
- Apache-2.0
|
||||
- BSD-2-Clause, BSD-3-Clause
|
||||
- ISC
|
||||
- MPL-2.0 (if used without modification)
|
||||
- 0BSD (public domain)
|
||||
|
||||
#### Incompatible Licenses
|
||||
- GPL, LGPL, AGPL (without special exception)
|
||||
- CC-BY-SA (for code, OK for data)
|
||||
- Proprietary/Commercial licenses
|
||||
|
||||
### Before Merging PR
|
||||
|
||||
1. Update dependencies:
|
||||
```bash
|
||||
cd backend && go mod tidy
|
||||
cd ../frontend && npm install
|
||||
```
|
||||
|
||||
2. Generate license reports:
|
||||
```bash
|
||||
./scripts/generate-licenses.sh
|
||||
```
|
||||
|
||||
This script automatically collects license information from all dependencies and saves them to the `licenses/` directory. See [licenses/README.md](../licenses/README.md) for details.
|
||||
|
||||
3. Scan for issues:
|
||||
```bash
|
||||
osv-scanner scan --experimental-licenses="MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC,MPL-2.0" backend
|
||||
osv-scanner scan --experimental-licenses="MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC,MPL-2.0" frontend
|
||||
```
|
||||
|
||||
### License Verification Tools
|
||||
|
||||
- **osv-scanner** - Security and license scanning (recommended)
|
||||
- **license-checker** - npm license verification
|
||||
- **go-licenses** - Go module license extraction (install: `go install github.com/google/go-licenses@latest`)
|
||||
- **go list** - Go module inspection
|
||||
|
||||
## For Docker Builds
|
||||
|
||||
License reports are automatically generated during Docker builds:
|
||||
- Backend reports in `/opt/pentagi/licenses/backend/`
|
||||
- `dependencies.txt` - List of all Go modules
|
||||
- `licenses.csv` - Detailed license information (generated by go-licenses)
|
||||
- Frontend reports in `/opt/pentagi/licenses/frontend/`
|
||||
- `dependencies.json` - Complete npm dependency tree
|
||||
- `licenses.json` - Detailed license data
|
||||
- `licenses.csv` - License summary
|
||||
|
||||
## Questions?
|
||||
|
||||
Contact: **info@pentagi.com** or **info@vxcontrol.com**
|
||||
+17
@@ -31,6 +31,12 @@ COPY frontend/ .
|
||||
RUN --mount=type=cache,target=/root/.npm \
|
||||
npm ci --include=dev
|
||||
|
||||
# Generate license report for frontend dependencies
|
||||
RUN npm install -g license-checker && \
|
||||
mkdir -p /licenses/frontend && \
|
||||
license-checker --production --json > /licenses/frontend/licenses.json && \
|
||||
license-checker --production --csv > /licenses/frontend/licenses.csv
|
||||
|
||||
# Build frontend with optimizations and parallel processing
|
||||
RUN npm run build -- \
|
||||
--mode production \
|
||||
@@ -71,6 +77,15 @@ COPY backend/ .
|
||||
RUN --mount=type=cache,target=/go/pkg/mod \
|
||||
go mod download && go mod verify
|
||||
|
||||
# Install go-licenses tool for license extraction
|
||||
RUN --mount=type=cache,target=/go/pkg/mod \
|
||||
go install github.com/google/go-licenses@latest
|
||||
|
||||
# Generate license reports for backend dependencies
|
||||
RUN mkdir -p /licenses/backend && \
|
||||
go list -m all > /licenses/backend/dependencies.txt && \
|
||||
GOROOT=$(go env GOROOT) GOTOOLCHAIN=auto go-licenses csv ./cmd/pentagi > /licenses/backend/licenses.csv 2>/dev/null || true
|
||||
|
||||
# Compile main application binary with embedded version metadata
|
||||
RUN go build -trimpath \
|
||||
-ldflags "\
|
||||
@@ -137,6 +152,8 @@ COPY --from=api-builder /ctester /opt/pentagi/bin/ctester
|
||||
COPY --from=api-builder /ftester /opt/pentagi/bin/ftester
|
||||
COPY --from=api-builder /etester /opt/pentagi/bin/etester
|
||||
COPY --from=frontend-compiler /app/ui/dist /opt/pentagi/fe
|
||||
COPY --from=api-builder /licenses/backend /opt/pentagi/licenses/backend
|
||||
COPY --from=frontend-compiler /licenses/frontend /opt/pentagi/licenses/frontend
|
||||
|
||||
# Copy provider configuration files
|
||||
COPY examples/configs/custom-openai.provider.yml /opt/pentagi/conf/
|
||||
|
||||
@@ -3344,30 +3344,18 @@ This project is made possible thanks to the following research and developments:
|
||||
|
||||
## License
|
||||
|
||||
### PentAGI Core License
|
||||
**PentAGI** is licensed under the [MIT License](LICENSE).
|
||||
|
||||
**PentAGI Core**: Licensed under [MIT License](LICENSE)
|
||||
Copyright (c) 2025 PentAGI Development Team
|
||||
|
||||
### VXControl Cloud SDK Integration
|
||||
### Third-Party Dependencies
|
||||
|
||||
**VXControl Cloud SDK Integration**: This repository integrates [VXControl Cloud SDK](https://github.com/vxcontrol/cloud) under a **special licensing exception** that applies **ONLY** to the official PentAGI project.
|
||||
All third-party dependencies use MIT-compatible licenses. See [licenses/](licenses/) directory for detailed license reports.
|
||||
|
||||
#### Official PentAGI Project
|
||||
- This official repository: `https://github.com/vxcontrol/pentagi`
|
||||
- Official releases distributed by VXControl LLC-FZ
|
||||
- Code used under direct authorization from VXControl LLC-FZ
|
||||
### VXControl Cloud Services
|
||||
|
||||
#### ⚠️ Important for Forks and Third-Party Use
|
||||
⚠️ **Note:** While the VXControl Cloud SDK code is MIT licensed, accessing **VXControl Cloud Services** (threat intelligence, AI support, premium features) requires a separate License Key and compliance with [Terms of Service](https://github.com/vxcontrol/cloud#license-and-terms).
|
||||
|
||||
If you fork this project or create derivative works, the VXControl SDK components are subject to **AGPL-3.0** license terms. You must either:
|
||||
The SDK code itself is free to use - service access requires registration.
|
||||
|
||||
1. **Remove VXControl SDK integration**
|
||||
2. **Open source your entire application** (comply with AGPL-3.0 copyleft terms)
|
||||
3. **Obtain a commercial license** from VXControl LLC
|
||||
|
||||
#### Commercial Licensing
|
||||
|
||||
For commercial use of VXControl Cloud SDK in proprietary applications, contact:
|
||||
- **Email**: info@vxcontrol.com
|
||||
- **Subject**: "VXControl Cloud SDK Commercial License"
|
||||
For questions contact: **info@pentagi.com** or **info@vxcontrol.com**
|
||||
|
||||
+2
-2
@@ -49,8 +49,8 @@ require (
|
||||
github.com/swaggo/gin-swagger v1.3.0
|
||||
github.com/swaggo/swag v1.8.7
|
||||
github.com/vektah/gqlparser/v2 v2.5.19
|
||||
github.com/vxcontrol/cloud v0.0.0-20250927184507-e8b7ea3f9ba1
|
||||
github.com/vxcontrol/graphiti-go-client v0.0.0-20260203202314-a1540b4a652f
|
||||
github.com/vxcontrol/cloud v0.9.0
|
||||
github.com/vxcontrol/graphiti-go-client v0.9.0
|
||||
github.com/vxcontrol/langchaingo v0.1.14-update.5
|
||||
github.com/wasilibs/go-re2 v1.10.0
|
||||
github.com/xeipuuv/gojsonschema v1.2.0
|
||||
|
||||
+4
-4
@@ -624,10 +624,10 @@ github.com/vmihailenco/tagparser v0.1.2 h1:gnjoVuB/kljJ5wICEEOpx98oXMWPLj22G67Vb
|
||||
github.com/vmihailenco/tagparser v0.1.2/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
|
||||
github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
|
||||
github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
|
||||
github.com/vxcontrol/cloud v0.0.0-20250927184507-e8b7ea3f9ba1 h1:qx2SF3lrUBFSMylsk6jMVEI1AWOTIDHTz3ddMQ0ryCw=
|
||||
github.com/vxcontrol/cloud v0.0.0-20250927184507-e8b7ea3f9ba1/go.mod h1:AeiQFqiMgJJAXy6FYXtDS2a3P/PMB56iiBNY2vGrZhQ=
|
||||
github.com/vxcontrol/graphiti-go-client v0.0.0-20260203202314-a1540b4a652f h1:5RzZ9isUxs51yYrcwop1MeDJMTX3aLAKqYi6taOVpZc=
|
||||
github.com/vxcontrol/graphiti-go-client v0.0.0-20260203202314-a1540b4a652f/go.mod h1:6UHL5uqAKp4KAdziva4qgcAxFtBzU05Hm/BAo4NkAuo=
|
||||
github.com/vxcontrol/cloud v0.9.0 h1:p7xYTgUctbY8w6YfhugNzvfi3/0EQoZGumMe67keAng=
|
||||
github.com/vxcontrol/cloud v0.9.0/go.mod h1:AeiQFqiMgJJAXy6FYXtDS2a3P/PMB56iiBNY2vGrZhQ=
|
||||
github.com/vxcontrol/graphiti-go-client v0.9.0 h1:3GxpFmQoHmz/d7/9tyEqD8+S99v2cuqG1UEmrbAFrLU=
|
||||
github.com/vxcontrol/graphiti-go-client v0.9.0/go.mod h1:6UHL5uqAKp4KAdziva4qgcAxFtBzU05Hm/BAo4NkAuo=
|
||||
github.com/vxcontrol/langchaingo v0.1.14-update.5 h1:QIib3znyGg/YnRSRB3ZMxwwfRE2vy+xZ2gDH6zwj9fk=
|
||||
github.com/vxcontrol/langchaingo v0.1.14-update.5/go.mod h1:fJal4XqJsYXRFTbAPJpwcJdztea9+1174fSDYacgctU=
|
||||
github.com/wasilibs/go-re2 v1.10.0 h1:vQZEBYZOCA9jdBMmrO4+CvqyCj0x4OomXTJ4a5/urQ0=
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
backend-dependencies.txt
|
||||
backend-licenses.csv
|
||||
frontend-dependencies.json
|
||||
frontend-licenses.csv
|
||||
frontend-licenses.json
|
||||
@@ -0,0 +1,43 @@
|
||||
# Third-Party Licenses
|
||||
|
||||
This directory contains license information for all PentAGI dependencies.
|
||||
|
||||
## Quick Start
|
||||
|
||||
Run the generator script to create/update license reports (run from project root):
|
||||
|
||||
```bash
|
||||
./scripts/generate-licenses.sh
|
||||
```
|
||||
|
||||
## Generated Files
|
||||
|
||||
### Backend (Go)
|
||||
- `backend-dependencies.txt` - Complete list of Go modules
|
||||
- `backend-licenses.csv` - Detailed license information (CSV format)
|
||||
|
||||
### Frontend (npm)
|
||||
- `frontend-dependencies.json` - Complete npm dependency tree (JSON)
|
||||
- `frontend-licenses.json` - Detailed license data (JSON)
|
||||
- `frontend-licenses.csv` - License data (CSV)
|
||||
|
||||
**Note:**
|
||||
- Backend reports require `go-licenses` tool: `go install github.com/google/go-licenses@latest`
|
||||
- Frontend reports require `npm ci` in the frontend directory first.
|
||||
|
||||
## License
|
||||
|
||||
PentAGI is licensed under **MIT License**.
|
||||
|
||||
All third-party dependencies use MIT-compatible licenses:
|
||||
- MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, 0BSD
|
||||
|
||||
## Docker Builds
|
||||
|
||||
License reports are automatically generated during Docker builds and included in the final image at `/opt/pentagi/licenses/`.
|
||||
|
||||
## More Information
|
||||
|
||||
- Project License: [../LICENSE](../LICENSE)
|
||||
- Legal Notices: [../NOTICE](../NOTICE)
|
||||
- Full Documentation: [../README.md](../README.md)
|
||||
Executable
+50
@@ -0,0 +1,50 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Generate license reports for PentAGI dependencies
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
cd "$(dirname "$0")/.."
|
||||
LICENSES_DIR="./licenses"
|
||||
|
||||
mkdir -p "$LICENSES_DIR"
|
||||
|
||||
echo "Generating license reports..."
|
||||
|
||||
# Backend (Go)
|
||||
echo "→ Backend..."
|
||||
cd backend
|
||||
|
||||
# Generate module list
|
||||
go list -m all > "../$LICENSES_DIR/backend-dependencies.txt"
|
||||
|
||||
# Generate detailed license report using go-licenses
|
||||
if command -v go-licenses &> /dev/null; then
|
||||
echo " Generating detailed license report with go-licenses..."
|
||||
GOROOT=$(go env GOROOT) GOTOOLCHAIN=auto go-licenses csv ./cmd/pentagi > "../$LICENSES_DIR/backend-licenses.csv" 2>/dev/null || {
|
||||
echo " go-licenses failed, install it with: go install github.com/google/go-licenses@latest"
|
||||
}
|
||||
else
|
||||
echo " go-licenses not found, install it with: go install github.com/google/go-licenses@latest"
|
||||
fi
|
||||
|
||||
cd ..
|
||||
|
||||
# Frontend (npm)
|
||||
echo "→ Frontend..."
|
||||
cd frontend
|
||||
if [ -d "node_modules" ]; then
|
||||
npm ls --production --json > "../$LICENSES_DIR/frontend-dependencies.json" 2>/dev/null || true
|
||||
|
||||
if command -v license-checker &> /dev/null; then
|
||||
license-checker --production --json > "../$LICENSES_DIR/frontend-licenses.json" 2>/dev/null || true
|
||||
license-checker --production --csv > "../$LICENSES_DIR/frontend-licenses.csv" 2>/dev/null || true
|
||||
fi
|
||||
else
|
||||
echo " Run 'npm ci' in frontend/ for detailed reports"
|
||||
fi
|
||||
cd ..
|
||||
|
||||
echo "Done! Reports saved in: $LICENSES_DIR/"
|
||||
ls -1 "$LICENSES_DIR/" | grep -v -E "(README|gitignore)" | sed 's/^/ - /'
|
||||
Reference in New Issue
Block a user