3 ms·
Every single 3p library that's imported into Google's monorepo gets vetted for license. If it's one of the standard licenses, it gets approved somewhat fast, bu
by klabb3 5y ago
Every single 3p library that's imported into Google's monorepo gets vetted for license. If it's one of the standard licenses, it gets approved somewhat fast, but it's still time time consuming.
- fmajid 5y agoI would assume any library is vetted for security, a company like Google cannot afford wild-west practices with dependencies. Adding a license audit to the process would not be a big imposition.
- klabb3 5y agoCorrect. The security vetting is indeed more cumbersome. All 3p code is reviewed with the same standards as internal projects, in theory.