KofTwentyTwo/standards
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases 6 Wiki Activity

docs(exceptions): record exact printing uri-js tool license #54

Merged
james.maes merged 1 commits from docs/qqq-print-uri-license-20261101 into main 2026-11-01 23:05:45 +00:00
Conversation 0 Commits 1 Files Changed 1
+17
1 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
exceptions/register.md
+17
View File
@@ -19,6 +19,7 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in
| [EX-0012](#ex-0012) | Open | K22-CODE-TF-04 (state never committed), K22-CODE-TF-05 (no secrets in `.tfvars`) | Praetor | Reviewed yearly, next on 2027-10-12 |
| [EX-0013](#ex-0013) | Open | K22-DEP-02 automated license classification | QRun-IO/qbit-printing, unmodified H2 2.4.240 only | 2027-04-30 or any H2 version/license change, whichever occurs first |
| [EX-0014](#ex-0014) | Proposed, awaiting approval | K22-DEP-02 (Microsoft SDK terms and classification) | QRun-IO/qqq-print-agent, exact 15-package Windows SDK inventory below | 2027-04-30 or any reviewed version/license/scope change, whichever occurs first |
| [EX-0015](#ex-0015) | Proposed, awaiting approval | K22-DEP-02 (build-tool license classification) | QRun-IO/qqq-print-protocol and QRun-IO/qqq-print-agent, development-only `uri-js` 4.4.1 only | 2027-04-30 or any `uri-js` version/license/scope change, whichever occurs first |
## EX-0001
@@ -413,3 +414,19 @@ App SDK section 1 permits Windows development/testing; section 3 permits distrib
The paired guard passed 25 rejection tests and checked the actual package cache, 11 locks and 11 evaluated assets. An unexecuted local MSI (`F08FF820CB4F7EA3877554E27208441942C6AA4D8749AD5A0D852C21A14D814C`) was built and statically extracted: all 13 legal/manifest paths matched expected bytes, the two runtime projections matched their package bytes, and BuildTools/MSIX nonlegal payloads and other reference-pack bytes were excluded. This is technical packaging evidence, not a certification that every redistribution obligation is fulfilled or authorization to install/publish that local MSI.
Additional evidence: [resolved dependency-review failure](https://github.com/QRun-IO/qqq-print-agent/actions/runs/41259093183), [application change under review](https://github.com/QRun-IO/qqq-print-agent/pull/10), [pinned reusable workflow](https://github.com/KofTwentyTwo/standards/blob/fdf5ed029603c938615a32b1beca3628b8787945/.github/workflows/pr.yml), [version-ignoring package matcher](https://github.com/actions/dependency-review-action/blob/a1d282b36b6f3519aa1f3fc636f609c47dddb294/src/purl.ts). Publication and approval links must be added only when they exist.
## EX-0015
**uri-js 4.4.1 license classification in the QQQ Print build tooling**
- **Status:** Open upon merge of this record through the normal protected PR process.
- **Requirements:** `K22-DEP-02`. Build-only tools may use any OSI-approved license. GitHub dependency review classifies the npm package `uri-js` 4.4.1 as `BSD-2-Clause AND BSD-2-Clause-Views`, and SPDX lists `BSD-2-Clause-Views` as not separately OSI-approved. This is a classification exception for one build-only tool dependency, not permission to ship it and not permission to admit any other non-allowlisted license. No vulnerability, malware, provenance, signing or branch-protection requirement is waived.
- **Scope:** `QRun-IO/qqq-print-protocol` and `QRun-IO/qqq-print-agent` only; npm package `uri-js`, unmodified version **4.4.1**, lock integrity `sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==`, installed `LICENSE` SHA-256 `0AF366EFF4C01EC147C9C61EA9E8FFAD64A4294754C9D79355F3FD1B97CB2FB9`. It is a locked, `dev: true`, transitive dependency of the pinned ESLint 10.14.0 (through ajv 6), never a direct dependency and never a runtime dependency. `node_modules` is restored only in development and CI; the protocol release bundle names repository paths only and the agent installer is built from .NET projects. No other package, version, repository or modified copy is covered.
- **Reason:** the pinned ESLint requires ajv 6, which requires `uri-js`; ESLint is required by the TypeScript standard for these repositories' owned tooling. The installed `LICENSE` (Copyright 2011 Gary Court) is the BSD-2-Clause conditions and disclaimer plus one sentence stating that the software's views and conclusions are the authors' and are not official policies; SPDX describes this as identical to BSD-2-Clause plus that sentence. It adds no restriction on use, copying, modification or redistribution. Replacing the resolver with a non-compatible library, or removing the package from the lock without an upstream ESLint change, would change reviewed tool behavior rather than resolve a policy problem.
- **Risk:** the scanner and SPDX classification are not on the permissive allowlist; the package is old (OpenSSF Scorecard 2.4, below the threshold of 3, already reported as a warning). A package-name exclusion could hide a later version or license change because the pinned action ignores PURL versions. Dependency review reports no vulnerability for 4.4.1.
- **Compensating controls:** each caller passes only `pkg:npm/uri-js` to `allow-dependencies-licenses`; every other package keeps its license check. `license-check: true`, `vulnerability-check: true`, low-or-higher advisory failure, development/runtime/unknown scopes, SCA/malware, Scorecard reporting and all required checks remain enabled. The required script-quality job in each repository fails unless the lock contains exactly one `uri-js`, version 4.4.1 with the integrity above, `dev: true`, not a direct dependency, required only by development packages; the installed `LICENSE` bytes hash to the value above; and the caller lists exactly `pkg:npm/uri-js` and no other npm package URL. The guard has rejection tests for another version, integrity, scope, consumer, duplicate copy, changed license bytes and a broadened caller list. Any version, license or scope change requires renewed approval before the exclusion can be used.
- **Expires:** 2027-04-30, or any `uri-js` version, license or scope change, or an ESLint release that no longer requires it, whichever occurs first. Remove or renew through the normal standards PR process; do not broaden the exclusion silently.
- **Owner:** the maintainer of `QRun-IO/qqq-print-protocol` and `QRun-IO/qqq-print-agent`.
- **Review date:** 2027-01-31.
Evidence: failed `pr / dependency-review` runs on [qqq-print-protocol#16](https://github.com/QRun-IO/qqq-print-protocol/pull/16) and [qqq-print-agent#18](https://github.com/QRun-IO/qqq-print-agent/pull/18) (only this license finding remained), [SPDX BSD-2-Clause-Views](https://spdx.org/licenses/BSD-2-Clause-Views.html), [pinned reusable workflow](https://github.com/KofTwentyTwo/standards/blob/fdf5ed029603c938615a32b1beca3628b8787945/.github/workflows/pr.yml), [version-ignoring package matcher](https://github.com/actions/dependency-review-action/blob/a1d282b36b6f3519aa1f3fc636f609c47dddb294/src/purl.ts).