Skip to content

v1.6.3 — Apache-2.0 license harmonization + unmapped triage to zero

Choose a tag to compare

View all tags
@clem-field clem-field released this 18 May 18:03
v1.6.3
fd42fd5

SPARC v1.6.3

A legal-terms harmonization release. The top-level LICENSE file is now Apache License, Version 2.0 — matching what NOTICE, docs/compliance/THIRD_PARTY_NOTICES.md, the 72 component dispositions in license-dispositions.yml, and the 27 LICENSES/ text files had all assumed since v1.6.0–v1.6.2. The contradiction is resolved; downstream consumers and auditors who read LICENSE first now see the same answer as everyone else.

This release ships alongside the unmapped-component triage from #481 (also merged just before).

Highlights

⚖️ License harmonized to Apache-2.0 (#483 → PR #484)

Before: LICENSE (MIT, "Rebel Raiders") disagreed with NOTICE (Apache-2.0, "Risk Sentinel") and the entire compliance-doc surface.
After: LICENSE, NOTICE, and README.md all state Apache License, Version 2.0, Copyright 2026 Risk Sentinel.

Why Apache-2.0:

  • Express patent grant — Apache-2.0 §3 includes a patent license that MIT lacks. Meaningful protection for a NIST/FedRAMP compliance tool.
  • NOTICE provision — Apache-2.0 §4 requires preserving NOTICE files. We've used this since #466 (AWS Labs CDEF attribution) and #481 (MITRE hdf-libs attribution).
  • Internal consistency — Brings the top-level LICENSE file into agreement with the compliance surface that has assumed Apache-2.0 since v1.6.0.
  • Compatibility — Apache-2.0 is a strict superset of MIT for downstream use; MIT consumers can include Apache-2.0 code freely.

LICENSE structure — 21-line SPARC-specific grant header (copyright + Apache-2.0 attribution + AS-IS disclaimer), then verbatim canonical Apache-2.0 text from LICENSES/Apache-2.0.txt. Matches the precedent we set with LICENSES/AWS-LABS-OSCAL-CONTENT-LICENSE and LICENSES/MITRE-HDF-LIBS-LICENSE in earlier releases.

🧹 Unmapped-component triage to zero (#481 → PR #482, merged just before)

Drove the license inventory's outstanding action-item count from 37 → 0 by triaging the five categories of unmapped components identified during the v1.6.2 review:

  • Track A (meta entries) — already covered by existing skip_patterns; no changes needed.
  • Track B (3 Debian system libs) — per-component dispositions for libcrypt1 (LGPL-2.1-or-later), libgcc-s1 and libstdc++6 (GPL-3.0-or-later WITH GCC-exception-3.1).
  • Track C (3 Ruby gems) — per-component dispositions for omniauth-gitlab, swd, validate_url (cdxgen extraction misses; all MIT upstream).
  • Track D (26 PyPI test deps) — new skip_purls mechanism in license-policy.yml + script support. Single entry ^pkg:pypi/ covers all tests/api/uv.lock deps without name-based matching.
  • Track E (~80 Go modules from the vendored MITRE hdf binary) — holistic disposition + new LICENSES/MITRE-HDF-LIBS-LICENSE + Go-namespace skip patterns. The vendored binary's transitive deps are subsumed under its consolidated Apache-2.0 grant.

Result with license-policy.yml::enforce: true still on:

  • 0 outstanding action items (warn/unmapped/block all empty)
  • 70 components dispositioned accepted, 114 skipped via patterns or purls
  • No policy weakening

What did NOT change

  • Third-party content keeps its original licenses. Gem licenses in the SBOM inventory, AWS Labs CDEFs (Apache-2.0 upstream), MITRE hdf-libs (Apache-2.0 upstream), and all 27 license texts in LICENSES/ are untouched.
  • CI behavior is unchanged. License inventory enforce-mode gate continues to pass; the swap only affects SPARC's own legal terms, not the third-party policy surface.
  • Database, API, services — no functional changes.

Upgrade Notes

  • License change is non-breaking for downstream consumers. Apache-2.0 is a strict superset of MIT; existing MIT-licensed projects can include SPARC v1.6.3+ without obstruction. Existing Apache-2.0 projects continue to work as before.
  • Patent grant now applies to all SPARC distributions from v1.6.3 onward.
  • NOTICE file is now load-bearing per Apache-2.0 §4; preserve it in any redistribution.
  • Copyright holder is Risk Sentinel (the copyright-pending organization matching the GitHub org risk-sentinel/sparc).

Verification

  • Full test suite: 2204 examples, 0 failures, 2 pending (HdfRunner real-binary; environmental).
  • license_inventory CI artifact: 0 block-severity, 0 un-dispositioned warns; gate enforce: true.
  • LICENSE first 21 lines = SPARC-specific Apache-2.0 grant header.
  • LICENSE remainder = byte-identical canonical Apache-2.0 text from LICENSES/Apache-2.0.txt.
  • LICENSE, NOTICE, README.md all consistent on: Apache-2.0, Risk Sentinel, 2026.

Release Contents

Issue PR Description
#481 #482 Close out unmapped components (Debian + Ruby + PyPI + hdf-libs holistic)
#483 #484 Harmonize top-level license to Apache-2.0; v1.6.3 bump

Closing the open-source-readiness arc

With v1.6.0 → v1.6.3:

  • License inventory + policy + dispositions + LICENSES/ + enforce gate ✅
  • AGPL hits: 0
  • GPL-3.0 runtime hits: 0
  • Unmapped action items: 0
  • Top-level license: Apache-2.0, internally consistent, with express patent grant
  • 27 canonical license text files committed
  • Attribution chains documented for AWS Labs CDEFs and MITRE hdf-libs

This is the audit-grade, defensible position for the public release.

Assets 2
Loading