Remixware 0.3.0 adds a second check next to its licence check. remixware deps compares the lockfiles in a pull request with the ones on main and fails the change when it brings in a package nobody approved, a package that runs install scripts, or, with --online, a recent release from a new publisher. It reads go.mod and go.sum, package-lock.json, requirements files and poetry.lock. A lockfile it can’t read, or a change it can’t judge, such as a yarn.lock edit or a new pip index, fails too. Nothing passes on a guess.
By default it works offline, from the lockfiles alone, so the answer is the same every run. Each run ends with a list of the checks that ran and the ones that didn’t, and an offline run never claims an online one. The allow list sits in the same .remixware.json as the licence policy. Since that file arrives with the pull request, the gate shows any allow rules the change adds for itself, and --base-policy reads main’s copy instead.
The tests generate changes across all five lockfile formats: 400 new packages off the allow list all failed, 800 unchanged or allowed sets all passed, 80 updates that started running an install script all failed, and 400 broken lockfiles all stopped with an error. Binaries are out for Linux, macOS and Windows, and every release now runs the gate as part of its smoke test.
An independent review then went looking for ways past the gate and found 13, each fixed with a test in 0.3.1. The worst four let a package hide from it: npm lockfile keys in odd letter case, a pip comment ended by a line break pip honours and the gate didn’t, and two poetry.lock layouts it misread. Case studies on real commits came next. One esbuild line in TypeScript became 23 new lockfile packages and an install script, Hugo’s deploy command brought in 18 Go modules including the AWS SDK and gRPC, and a TorchServe commit pointed pip at two extra package indexes. The gate failed all three with reasons a reviewer would want to read. Those runs also turned up a gap, now closed in 0.3.2: a new lockfile outside a configured list was skipped without a word, and is now reported as not checked. The recipes post has the CI setup. The launch note covers the licence check.