branderson
c61eebb5b5
dejima carries this and its wording covers all three repositories by name: these projects, any of these repositories. A reader landing here would not have seen it. Duplicated rather than linked, which is the opposite of what attribution and the security policy do here, and deliberately. A disclaimer behind a link is a disclaimer the reader does not see, and its whole value is being on the page where the security argument is being made. Everything else that gets linked is reference material someone goes looking for; this is the one thing that has to arrive uninvited. test/disclaimer.bats pins it. The line is the one most likely to be dropped without anyone deciding to drop it - by a rewrite of some section that happened to contain it - and every other test here would still pass on a repository that had lost it.
29 lines
1.0 KiB
Bash
29 lines
1.0 KiB
Bash
#!/usr/bin/env bats
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
# Copyright (C) 2026 Brad Anderson
|
|
#
|
|
# The maturity disclaimer, pinned in every place a reader can land.
|
|
#
|
|
# A repository that argues at length for its own security properties is exactly
|
|
# the one that has to say those properties are unreviewed. It is also the line
|
|
# most likely to be quietly dropped as a project starts to feel established -
|
|
# not by decision, but by a rewrite of a section that happened to contain it.
|
|
#
|
|
# Nothing else here would notice. Every other test in this suite would still
|
|
# pass on a repository that had lost it.
|
|
|
|
setup() {
|
|
REPO="$(cd "$BATS_TEST_DIRNAME/.." && pwd)"
|
|
}
|
|
|
|
@test "every entry point says this is unreviewed early development" {
|
|
for f in README.md SECURITY.md; do
|
|
grep -q 'reviewed by anyone else\|outside review' "$REPO/$f" || {
|
|
echo "$f does not say the work is unreviewed" >&2
|
|
false
|
|
}
|
|
done
|
|
grep -q 'Not ready to be depended on' "$REPO/README.md"
|
|
grep -q 'not proven software' "$REPO/SECURITY.md"
|
|
}
|