licence_audit/notice_resolve

Per-package licence-materials resolution with the fallback chain.

Resolution order, honouring source-archive priority:

1. Source archive. Read the package’s own source (Hex tarball, git archive at the manifest commit, or a local path) and keep every notice file it ships. If that includes an actual licence file (LICENSE / LICENCE / COPYING) resolution stops here.
2. Repository fallback (Hex packages only — git sources are already the repository at an immutable commit, so a retry cannot help). Follow the package’s declared repository links, resolve a deterministic tag (v<version> then <version>) to an immutable commit SHA, download the repository archive at that SHA, and lift its licence text. Any NOTICE file found in step 1 is preserved alongside the recovered licence.
3. SPDX fallback. Expand the declared SPDX identifiers/expressions to canonical licence text from the pinned SPDX License List revision.

Every network result is cached in the shared notices_cache under an immutable key so repeated runs — and packages that share an SPDX licence — avoid redundant traffic. Repository network/API failures are non-fatal: they surface a deferred warning and resolution continues to the SPDX fallback. When that happens the final per-package result is deliberately not cached, so a later run retries the repository instead of being frozen on the degraded SPDX material; successful per-namespace values (SPDX records, tag→commit resolutions, repository archives) are still cached. An SPDX network failure with no cached record, when a fallback is required, is a hard error.

pub type Outcome {
  Resolved(files: List(notice.NoticeFile))
  Missing
}

pub type Resolution {
  Resolution(outcome: Outcome, warnings: List(String))
}

pub fn resolve(
  cache: notice_cache.Cache,
  package: notice.NoticePackage,
  clients: notice.Clients,
) -> #(Result(Resolution, notice.Error), option.Option(String))

pub fn resolve_spdx(
  cache: notice_cache.Cache,
  package: String,
  requirement: spdx.Requirement,
  clients: notice.Clients,
) -> #(
  Result(option.Option(notice.NoticeFile), notice.Error),
  option.Option(String),
)