Approve coder/websocket (ISC) for golang - #16
Merged
Conversation
Indirect dependency of github.com/tmc/go-iroh, the iroh transport in any-sync.
requilence
self-requested a review
August 26, 2026 14:21
requilence
approved these changes
Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
anyproto/any-sync#768 adds the iroh transport and with it two modules,
github.com/tmc/go-irohand its indirect dependencygithub.com/coder/websocket. The golang license gate (failing run) flags only the latter.Licenses verified against the module cache:
github.com/coder/websocketv1.8.14 — ISC. LicenseFinder reportsunknownbecause the file carries the OpenBSD ISC wording "copy, modify, and distribute", while LicenseFinder's ISC template requires "and/or distribute"; that single token is the entire mismatch. Same situation as the already-approvedgithub.com/hashicorp/yamux.github.com/tmc/go-irohv0.1.0 — MIT, plus vendored code under MIT (internal/qng, a quic-go fork), BSD-3-Clause (internal/itls/tls, from the Go standard library) and MIT/Apache-2.0 (internal/qng/n0ext/reference). LicenseFinder detects it asApache 2.0, MIT, New BSD, all permitted, so it needs no entry here.Reproduced the gate locally with the exact steps from
anyproto/shared-actionscoverage-go-daemons-reusable.yml@v1(python3 tools/generate.py --platform golang,license_finder inherited_decisions add open/decisions.yml,go mod tidy,license_finder --enabled-package-managers gomodules) against the any-sync branch:main:Dependencies that need approval: github.com/coder/websocket, v1.8.14, unknownAll dependencies are approved for useThe gate clones this repo at
refs/heads/main, so any-sync#768 stays red until this merges.🤖 Generated with Claude Code