docs(reviewer): add 4 gap audits — numerical, input-validation, thread-safety, dependency/license
Closes the dimensions the prior audits did not cover: - numerical-stability: tolerance hierarchy (FD-step vs Newton tol), discontinuous clamps, cancellation in cotangent/area, magic constants. - input-validation: malformed JSON/XML deserialization, NaN/Inf vertex coords on load, schema-drift handling. - thread-safety: no mutable static state (good); undocumented same-mesh concurrency contract; Eigen threading. - dependency-license: existing THIRD-PARTY-LICENSES matrix is sound but predicated on the MIT premise that G0 undermines; test meshes have no provenance/license. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Tarik Moussa
167
doc/reviewer/dependency-license-audit-2026-05-31.md
Normal file
167
doc/reviewer/dependency-license-audit-2026-05-31.md
Normal file
@@ -0,0 +1,167 @@
|
||||
# Dependency & License-Compatibility Audit — ConformalLabpp
|
||||
|
||||
**Date:** 2026-05-31
|
||||
**Auditor:** External reviewer (Claude Opus 4.8)
|
||||
**Scope:** Vendored/auto-fetched dependencies, their license compatibility, and the
|
||||
provenance/license of bundled **data assets** (test meshes).
|
||||
**Focus:** Is the dependency + data licensing coherent — especially in light of the
|
||||
unresolved provenance/license blocker (CGAL audit **G0/G1**)?
|
||||
|
||||
Status legend: 🔴 Critical · 🟡 Important · 🔵 Polish
|
||||
|
||||
> **Good news up front:** a `code/deps/THIRD-PARTY-LICENSES.md` already exists and is
|
||||
> a genuinely good per-dependency compatibility matrix (CGAL, Eigen, libigl, GLFW,
|
||||
> nlohmann/json). This audit does **not** redo that work. It flags two things that
|
||||
> matrix cannot see: (D1) it is built on the MIT premise that G0 undermines, and
|
||||
> (D2) the bundled **test meshes have no provenance or license at all**.
|
||||
|
||||
---
|
||||
|
||||
## Summary table
|
||||
|
||||
| ID | Sev | Title | Location |
|
||||
|----|-----|-------|----------|
|
||||
| D1 | 🔴 | The dependency-license matrix is predicated on "conformallab++ is MIT" — a premise CGAL-audit G0 shows is unfounded; the whole compatibility conclusion is conditional on the unresolved license decision | `code/deps/THIRD-PARTY-LICENSES.md` |
|
||||
| D2 | 🔴 | Bundled test meshes (`cathead.obj`, `brezel*.obj`, torus OFFs) have **no provenance and no license** — likely third-party / Varylab-origin, redistributed without attribution | `code/data/` |
|
||||
| D3 | 🟡 | No per-dependency license *files* under most vendored trees (only GLFW ships one); the matrix is the only record | `code/deps/*/` |
|
||||
| D4 | 🔵 | Vendored-tarball integrity is asserted ("bit-for-bit identical") but not checksum-verified in-repo | `code/deps/tarballs/` |
|
||||
|
||||
---
|
||||
|
||||
## D1 — 🔴 License matrix is conditional on the unresolved MIT premise
|
||||
|
||||
### Evidence
|
||||
`code/deps/THIRD-PARTY-LICENSES.md` opens its analysis with:
|
||||
> *"## conformallab++ itself … **MIT** … Every C++ source file carries
|
||||
> `SPDX-License-Identifier: MIT`"*
|
||||
|
||||
and every dependency row evaluates "**Compatibility with MIT distribution**".
|
||||
|
||||
### Problem
|
||||
The matrix's central column — and therefore its conclusion that everything is
|
||||
distributable — assumes conformallab++ *is* MIT-licensed and *may* be distributed as
|
||||
MIT. CGAL-audit **G0** establishes that this premise is unfounded: the code is a
|
||||
documented port (derivative work) of the unlicensed Varylab/TU-Berlin project, so the
|
||||
MIT grant itself is on shaky ground. Two consequences cascade:
|
||||
|
||||
1. If porting rights are **not** granted, there is no valid MIT (or any) license to
|
||||
be "compatible with" — the matrix evaluates compatibility against a license the
|
||||
project may not be entitled to use.
|
||||
2. If the project relicenses to **GPLv3+** for CGAL submission (G1), the entire
|
||||
"compatible with MIT distribution" analysis must be **redone against GPLv3+**
|
||||
(e.g. the CGAL LGPL/GPL split, Eigen's MPL-2.0, libigl's MPL-2.0 are all
|
||||
GPL-compatible — but that needs stating, not assuming).
|
||||
|
||||
### Fix
|
||||
- Resolve G0/G1 first (owner-level).
|
||||
- Then re-run the matrix against the *actual* outbound license. Add a column
|
||||
"compatibility with GPLv3+ distribution" if the CGAL path is taken.
|
||||
- Until resolved, annotate `THIRD-PARTY-LICENSES.md` with a banner that its
|
||||
conclusions are conditional on the pending G0/G1 decision.
|
||||
|
||||
### Acceptance criteria
|
||||
- The matrix's outbound-license assumption matches the resolved G0/G1 outcome and is
|
||||
re-evaluated against it.
|
||||
|
||||
---
|
||||
|
||||
## D2 — 🔴 Bundled test meshes have no provenance or license
|
||||
|
||||
### Evidence
|
||||
```
|
||||
code/data/obj: brezel.obj brezel2.obj cathead.obj tetraflat.obj
|
||||
code/data/off: simple_cupe.off torus_4x4.off torus_8x8.off torus_hex_6x6.off torus_skewed_4x4.off
|
||||
```
|
||||
`find code/data -iname '*readme*' -o -iname '*licen*' -o -iname '*source*'` → **nothing.**
|
||||
|
||||
### Problem
|
||||
These meshes are committed and redistributed with the project, used by the smoke and
|
||||
parity tests (`test_scalability_smoke.cpp`, `test_geometry_utils.cpp` references
|
||||
`brezel2.obj`, etc.). But:
|
||||
|
||||
- `cathead.obj` is a **well-known third-party mesh** that circulates in graphics
|
||||
courses/datasets — it is almost certainly not original to this project and carries
|
||||
whoever's terms.
|
||||
- `brezel.obj` / `brezel2.obj` ("Brezel" = pretzel; genus-1/genus-2) are the exact
|
||||
example surfaces used in the **Varylab/TU-Berlin** discrete-conformal work — i.e.
|
||||
likely the *same* upstream as the G0 code-provenance problem.
|
||||
|
||||
Redistributing third-party data assets without attribution or a license is the same
|
||||
class of issue as the code port (G0), and CGAL submission would flag it: CGAL example
|
||||
data must have clear redistribution rights.
|
||||
|
||||
### Fix
|
||||
- Establish each mesh's origin and license. For `cathead.obj`, identify the standard
|
||||
source and its terms. For the `brezel*` meshes, this is part of the **same
|
||||
conversation with the Varylab/TU-Berlin authors** as G0.
|
||||
- Add `code/data/PROVENANCE.md` listing each file: source, author, license, URL.
|
||||
- Replace any mesh whose redistribution rights cannot be confirmed with a
|
||||
cleanly-licensed or self-generated equivalent (the torus OFFs look procedurally
|
||||
generated — confirm and document that, which would make them safe).
|
||||
|
||||
### Acceptance criteria
|
||||
- Every file under `code/data/` has documented provenance + redistribution rights;
|
||||
unconfirmed assets are replaced.
|
||||
|
||||
---
|
||||
|
||||
## D3 — 🟡 Most vendored trees ship no license file
|
||||
|
||||
### Evidence
|
||||
```
|
||||
eigen-3.4.0: NONE FOUND CGAL-6.1.1: NONE FOUND
|
||||
libigl-2.6.0: NONE FOUND glfw-3.4: LICENSE.md ✓
|
||||
```
|
||||
Only GLFW retains its upstream license file; the others rely solely on the central
|
||||
`THIRD-PARTY-LICENSES.md`.
|
||||
|
||||
### Problem
|
||||
When vendoring source trees, the upstream LICENSE/COPYING file should travel with the
|
||||
code (it is usually a license *requirement* — MPL-2.0 and LGPL both require preserving
|
||||
license notices). A central summary is good practice but does not substitute for the
|
||||
upstream notice files inside each tree.
|
||||
|
||||
### Fix
|
||||
Restore each upstream license file into its vendored tree (`eigen-3.4.0/COPYING.*`,
|
||||
`CGAL-6.1.1/LICENSE*`, `libigl-2.6.0/LICENSE*`). They were likely stripped during
|
||||
trimming of the vendored copies.
|
||||
|
||||
### Acceptance criteria
|
||||
- Each vendored dependency tree contains its upstream license notice file.
|
||||
|
||||
---
|
||||
|
||||
## D4 — 🔵 Vendored tarball integrity not checksum-verified
|
||||
|
||||
### Evidence
|
||||
`THIRD-PARTY-LICENSES.md` states the cached tarballs are "bit-for-bit identical to the
|
||||
upstream releases", but no checksum manifest is committed.
|
||||
|
||||
### Problem
|
||||
The reproducibility claim (the stated rationale for vendoring) rests on an unverified
|
||||
assertion. A corrupted or substituted tarball would not be detected.
|
||||
|
||||
### Fix
|
||||
Commit a `code/deps/tarballs/SHA256SUMS` and verify it in the extraction step of the
|
||||
CMake/deps logic.
|
||||
|
||||
---
|
||||
|
||||
## What is already good
|
||||
|
||||
- `THIRD-PARTY-LICENSES.md` is a thorough, honest per-dependency matrix with real
|
||||
compatibility reasoning (the CGAL LGPL/GPL split, Eigen's NonMPL2 gating, the
|
||||
viewer-only scope of libigl/GLFW) — excellent practice, just built on a premise
|
||||
(D1) that G0 destabilizes.
|
||||
- The dependency choices themselves are clean: Eigen (MPL-2.0), libigl (MPL-2.0),
|
||||
GLFW (zlib), nlohmann/json (MIT) are all permissive; only CGAL carries copyleft, and
|
||||
its header-only LGPL consumption is correctly reasoned.
|
||||
- Vendoring at fixed versions for build reproducibility is a defensible choice and is
|
||||
documented.
|
||||
|
||||
## Suggested order
|
||||
1. **D2** (data provenance) — couple with the G0 conversation; CGAL-blocking and the
|
||||
most clearly missing piece.
|
||||
2. **D1** (re-base the matrix on the resolved license) — after G0/G1.
|
||||
3. **D3** (restore upstream license files) — quick, and likely a license requirement.
|
||||
4. **D4** (checksum manifest) — polish.
|
||||
Reference in New Issue
Block a user