Repository navigation
docs(deps): record the cgm_cbio vendor-derived material review - #165
Closed
shroominic wants to merge 1 commit into
Closed
shroominic wants to merge 1 commit into
shroominic wants to merge 1 commit into
Conversation
The dependency review still described cgm_cbio as an offline scaffold with no vendor material. That is no longer true: the package carries link material and a stream masking constant derived from a shipped third-party sensor application, i.e. exactly the shape that needs a notice and redistribution review before an artifact ships. Corrects the package section, states the two open reviews (notice and redistribution terms, and how the material reaches a build at all), and adds the matching paragraph to NOTICE.md. References the derivation record by path instead of restating any bytes.
This was referenced Sep 18, 2026
Closed
Owner
Author
|
Carried by the GS1 consolidation in PR #209 (branch feature/cbio-gs1, head 3eca4f4). This PR is contained in the consolidated line; the merge that carries it is c85f827. Closing as subsumed by the consolidation - not as won't fix. The per-defect evidence stays in this thread, and the carrying commit above is where the change now lives. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses #157 (notice and inventory coverage). Stays open.
Problem
docs/dependencies.mdstill described this package as an offline scaffold with "no credentials"and "no vendor library or algorithm", and
NOTICE.mdlisted onlypackages/cgm_libre2_glucoseas athird-party-derived exception. Both statements are now wrong: the package carries a per-frame stream
masking constant and link material derived from a shipped third-party sensor application.
Change
Documentation only:
docs/dependencies.md: the package section now states what the package actually contains, andrecords the two open reviews (redistribution/notice terms, and how the material reaches a build at
all).
NOTICE.md: adds the interoperability-material paragraph next to the existing GPL exception so thepre-publication inventory step explicitly covers it.
Both reference
docs/testing/cbio-gs1-auth-material.mdby path and restate no bytes.Verification
make bootstrapmake format-checkopenhealth/integration_test/cbio_glucose_query_test.dart, which is #151 / PR #152No Dart, shell, or workflow file is touched by this PR, so
lint,test-unit, andtest-integrationare unaffected.Not covered
The version and artifact-identity parts of #157 (aggregate version behind
main,cgm_cbiomanifeststill at
0.0.1/ "scaffold") are left to the release assembly decision, and the exposure itself istracked in #158.