Policy clarified: No need to share a "distribution medium"

Including code built from restricted sources in a distribution medium
does not require sharing the code for building the distribution medium.

Test: m cts dist

Test: m cts dist gts (requires cherry-pick to internal)

Change-Id: I7fcd889b11a97f8deaf4de9d72fdadd09deebe30

tools/compliance/cmd/listshare/listshare.go

@@ -149,6 +149,9 @@ func listShare(stdout, stderr io.Writer, rootFS fs.FS, files ...string) error {
 	// Group the resolutions by project.
 	presolution := make(map[string]compliance.LicenseConditionSet)
 	for _, target := range shareSource.AttachesTo() {
+		if shareSource.IsPureAggregate(target) && !target.LicenseConditions().MatchesAnySet(compliance.ImpliesShared) {
+			continue
+		}
 		rl := shareSource.Resolutions(target)
 		sort.Sort(rl)
 		for _, r := range rl {

tools/compliance/cmd/listshare/listshare_test.go

@@ -193,13 +193,6 @@ func Test(t *testing.T) {
 					project:    "dynamic/binary",
 					conditions: []string{"restricted"},
 				},
-				{
-					project: "highest/apex",
-					conditions: []string{
-						"restricted",
-						"restricted_allows_dynamic_linking",
-					},
-				},
 				{
 					project: "static/binary",
 					conditions: []string{
@@ -224,13 +217,6 @@ func Test(t *testing.T) {
 					project:    "base/library",
 					conditions: []string{"restricted"},
 				},
-				{
-					project: "container/zip",
-					conditions: []string{
-						"restricted",
-						"restricted_allows_dynamic_linking",
-					},
-				},
 				{
 					project:    "device/library",
 					conditions: []string{"restricted_allows_dynamic_linking"},
@@ -320,10 +306,6 @@ func Test(t *testing.T) {
 					project:    "dynamic/binary",
 					conditions: []string{"restricted"},
 				},
-				{
-					project:    "highest/apex",
-					conditions: []string{"restricted"},
-				},
 			},
 		},
 		{
@@ -335,10 +317,6 @@ func Test(t *testing.T) {
 					project:    "base/library",
 					conditions: []string{"restricted"},
 				},
-				{
-					project:    "container/zip",
-					conditions: []string{"restricted"},
-				},
 				{
 					project:    "dynamic/binary",
 					conditions: []string{"restricted"},
@@ -381,10 +359,6 @@ func Test(t *testing.T) {
 					project:    "bin/threelibraries",
 					conditions: []string{"restricted"},
 				},
-				{
-					project:    "container/zip",
-					conditions: []string{"restricted"},
-				},
 			},
 		},
 		{
@@ -396,10 +370,6 @@ func Test(t *testing.T) {
 					project:    "bin/threelibraries",
 					conditions: []string{"restricted"},
 				},
-				{
-					project:    "container/zip",
-					conditions: []string{"restricted"},
-				},
 				{
 					project:    "lib/apache",
 					conditions: []string{"restricted"},
@@ -419,10 +389,6 @@ func Test(t *testing.T) {
 					project:    "bin/threelibraries",
 					conditions: []string{"restricted"},
 				},
-				{
-					project:    "container/zip",
-					conditions: []string{"restricted"},
-				},
 				{
 					project:    "lib/apache",
 					conditions: []string{"restricted"},
@@ -446,10 +412,6 @@ func Test(t *testing.T) {
 					project:    "bin/threelibraries",
 					conditions: []string{"restricted"},
 				},
-				{
-					project:    "container/zip",
-					conditions: []string{"restricted"},
-				},
 				{
 					project:    "lib/apache",
 					conditions: []string{"restricted"},

tools/compliance/policy_resolve.go

@@ -65,9 +65,7 @@ func TraceBottomUpConditions(lg *LicenseGraph, conditionsFn TraceConditions) {
 	// amap identifes targets previously walked. (guarded by mu)
 	amap := make(map[*TargetNode]struct{})
 
-	// cmap identifies targets previously walked as pure aggregates. i.e. as containers
+	// mu guards concurrent access to amap
-	// (guarded by mu)
-	cmap := make(map[*TargetNode]struct{})
 	var mu sync.Mutex
 
 	var walk func(target *TargetNode, treatAsAggregate bool) LicenseConditionSet
@@ -81,19 +79,16 @@ func TraceBottomUpConditions(lg *LicenseGraph, conditionsFn TraceConditions) {
 				if treatAsAggregate {
 					return target.resolution, true
 				}
-				if _, asAggregate := cmap[target]; !asAggregate {
+				if !target.pure {
 					return target.resolution, true
 				}
 				// previously walked in a pure aggregate context,
 				// needs to walk again in non-aggregate context
-				delete(cmap, target)
 			} else {
 				target.resolution |= conditionsFn(target)
 				amap[target] = struct{}{}
 			}
-			if treatAsAggregate {
+			target.pure = treatAsAggregate
-				cmap[target] = struct{}{}
-			}
 			return target.resolution, false
 		}
 		cs, alreadyWalked := priorWalkResults()
@@ -169,11 +164,7 @@ func TraceTopDownConditions(lg *LicenseGraph, conditionsFn TraceConditions) {
 	// amap contains the set of targets already walked. (guarded by mu)
 	amap := make(map[*TargetNode]struct{})
 
-	// cmap contains the set of targets walked as pure aggregates. i.e. containers
+	// mu guards concurrent access to amap
-	// (guarded by mu)
-	cmap := make(map[*TargetNode]struct{})
-
-	// mu guards concurrent access to cmap
 	var mu sync.Mutex
 
 	var walk func(fnode *TargetNode, cs LicenseConditionSet, treatAsAggregate bool)
@@ -183,10 +174,8 @@ func TraceTopDownConditions(lg *LicenseGraph, conditionsFn TraceConditions) {
 		mu.Lock()
 		fnode.resolution |= conditionsFn(fnode)
 		fnode.resolution |= cs
+		fnode.pure = treatAsAggregate
 		amap[fnode] = struct{}{}
-		if treatAsAggregate {
-			cmap[fnode] = struct{}{}
-		}
 		cs = fnode.resolution
 		mu.Unlock()
 		// for each dependency
@@ -208,11 +197,10 @@ func TraceTopDownConditions(lg *LicenseGraph, conditionsFn TraceConditions) {
 							return
 						}
 						// non-aggregates don't need walking as non-aggregate a 2nd time
-						if _, asAggregate := cmap[dnode]; !asAggregate {
+						if !dnode.pure {
 							return
 						}
 						// previously walked as pure aggregate; need to re-walk as non-aggregate
-						delete(cmap, dnode)
 					}
 				}
 				// add the conditions to the dependency

tools/compliance/policy_shareprivacyconflicts.go

@@ -49,7 +49,11 @@ func ConflictingSharedPrivateSource(lg *LicenseGraph) []SourceSharePrivacyConfli
 
 	// size is the size of the result
 	size := 0
-	for _, cs := range combined {
+	for actsOn, cs := range combined {
+		if actsOn.pure && !actsOn.LicenseConditions().MatchesAnySet(ImpliesShared) {
+			// no need to share code to build "a distribution medium"
+			continue
+		}
 		size += cs.Intersection(ImpliesShared).Len() * cs.Intersection(ImpliesPrivate).Len()
 	}
 	if size == 0 {
@@ -57,6 +61,9 @@ func ConflictingSharedPrivateSource(lg *LicenseGraph) []SourceSharePrivacyConfli
 	}
 	result := make([]SourceSharePrivacyConflict, 0, size)
 	for actsOn, cs := range combined {
+		if actsOn.pure { // no need to share code for "a distribution medium"
+			continue
+		}
 		pconditions := cs.Intersection(ImpliesPrivate).AsList()
 		ssconditions := cs.Intersection(ImpliesShared).AsList()
 

tools/compliance/readgraph.go

@@ -198,6 +198,9 @@ type targetNode struct {
 
 	// resolution identifies the set of conditions resolved by acting on the target node.
 	resolution LicenseConditionSet
+
+	// pure indicates whether to treat the node as a pure aggregate (no internal linkage)
+	pure bool
 }
 
 // addDependencies converts the proto AnnotatedDependencies into `edges`

tools/compliance/resolutionset.go

@@ -72,6 +72,16 @@ func (rs ResolutionSet) AttachesToTarget(target *TargetNode) bool {
 	return isPresent
 }
 
+// IsPureAggregate returns true if `target`, which must be in
+// `AttachesTo()` resolves to a pure aggregate in the resolution.
+func (rs ResolutionSet) IsPureAggregate(target *TargetNode) bool {
+	_, isPresent := rs[target]
+	if !isPresent {
+		panic(fmt.Errorf("ResolutionSet.IsPureAggregate(%s): not attached to %s", target.Name(), target.Name()))
+	}
+	return target.pure
+}
+
 // Resolutions returns the list of resolutions that `attachedTo`
 // target must resolve. Returns empty list if no conditions apply.
 func (rs ResolutionSet) Resolutions(attachesTo *TargetNode) ResolutionList {