>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #779452. --> Reported by: [alex_b](https://www.drupal.org/user/53995) >>> <p>This issue is part of the <a href="https://www.drupal.org/node/779440">Distribution Packaging</a> initiative.</p> <h3>Problem/Motivation</h3> <p>Distributions often package external JS and PHP libraries. However, many such libraries are not released under the GPL. Drupal.org generally requires all code hosted on the server to be released under GPLv2-and-later, just like Drupal. Also, not all 3rd party libraries are compatible with the GPL.</p> <h3>Proposed resolution</h3> <p>We will allow the distribution packager to automatically pull in 3rd party libraries to the packaged download. However, to ensure only libraries released under GPL-compatible licenses are used we will need to maintain a whitelist of 3rd party libraries that have been confirmed GPL-compatible.</p> <h3>Remaining tasks</h3> <p>This issue is focused solely on the technical aspects of the whitelist on Drupal.org itself. See the <a href="https://www.drupal.org/node/779440">Distribution Packaging community initiative page</a> for other aspects.</p> <ul> <li><del>Create a content type for package whitelist entries.</del> Done! Here's a sample entry: <a href="http://drupal.org/node/1259160">http://drupal.org/node/1259160</a></li> <li><del>Create a view of existing package whitelist entries for displaying which entries we already have.</del> Done! Here it is: <a href="http://drupal.org/packaging-whitelist">http://drupal.org/packaging-whitelist</a></li> <li><del>Create a view of package whitelist entries in JSON, for pulling into the packaging scripts.</del> See: <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/infrastructure/issues/779452" title="Status: Closed (fixed)">#779452: Whitelist for external dependencies</a></span></li> <li><del>Export these views to drupalorg_project module.</del></li> </ul> <p>Regexes were chosen as the format for whitelist entries rather than custom syntax, to allow for greater flexibility of download links for distribution maintainers. Regexes look something like the following: <code>^http://www\.example\.com/downloads/download-name.+$</code>.</p> <h3>User interface changes</h3> <p>A new view showing packaging whitelist entries.</p> <h3>API changes</h3> <p>None.</p> <h3>Original report by alexb</h3> <p>Follow-up from <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/infrastructure/-/work_items/594704" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/infrastructure/-/work_items/594704</a></span>.</p> <p>Create and deploy a white list on drupal.org that can selectively allow download of external libraries from non drupal.org URLs.</p> <p>Example:</p> <pre>http://download.cksource.com/CKEditor/*</pre><p>Would allow the inclusion of any files available under this wildcard URL.</p> <p>This white list includes</p> <ul> <li> UI (surfaces where?) that shows which URLs are currently allowed to include in an installation profile. </li> <li> UI to edit the white list. </li> <li> Simple permission to control access to edit the white list. </li> <li> Necessary modifications to drush make to limit potential sources for external dependencies. </li> </ul>