Hacker News Reader

Comment by buildbot | Hacker News Reader

I would assume at googles scale that this has to be violated pretty often, how could you possibly police this well?

You are only allowed to use imports that are in the monorepo, and each time a library is added to the monorepo, the license is checked.

A lot of Google operates outside the monorepo these days.

Every single 3p library that's imported into Google's monorepo gets vetted for license. If it's one of the standard licenses, it gets approved somewhat fast, but it's still time time consuming.

I would assume any library is vetted for security, a company like Google cannot afford wild-west practices with dependencies. Adding a license audit to the process would not be a big imposition.

Correct. The security vetting is indeed more cumbersome. All 3p code is reviewed with the same standards as internal projects, in theory.

we're not Google scale, but this works very well with precommit hooks and automatic CI checks that inspect dependencies for know vulnerabilities and incompatible licenses (you know, sonarqube and the likes).

I would assume this is pretty well policed for all existing projects and by default for all new projects.

Google has tools for making sure that outgoing open source projects have kosher licensing (e.g. cross: https://opensource.google/documentation/reference/glossary#c...).

I wouldn't be surprised if there's something similar that runs on incoming code and freaks out if it sees the text "under the terms of the GNU Affero General Public License". It'd be hard to introduce AGPL code accidentally.

I assume they do license scanning at the very least.

Reply on news.ycombinator.com