Tidy doesn't check the dependencies from submodules/subtrees

[JohnTitor]

Filing this so that I don't forget to fix it...
We have a license check on tidy for each dependency but it doesn't check dependencies coming from submodules/subtrees. For instance, tidy doesn't say anything about the libm crate, which comes from rustfmt (rustfmt-nightly -> bytecount -> packed_simd2 -> libm). Ideally, tidy should also check those dependencies.

Originally discussed on #83239 (comment).

[ehuss]

Can you say more about why tidy would complain about adding libm? From what I see, it has a "MIT or Apache-2.0" license which is in the blanket allow list.

The license checks should be applied to everything in Cargo.lock. There are 3 categories (runtime, rustc, and tools) which are each treated differently. Only rustc has a "speedbump" list (PERMITTED_DEPENDENCIES), is that maybe what this is referring to? I'm not sure it has ever been discussed using that for anything other than rustc.

There's only one thing that is not validated that I am aware of, and that is rust-analyzer (#74269) because it is not in the lock file.

[JohnTitor]

Oh, I totally misunderstood! So, we actually run the license check but PERMITTED_DEPENDENCIES only has direct rustc_* crates dependencies, right? Then I think the issue is that whether we want to expand the list to submodules/subtrees but I'd like to see @Mark-Simulacrum's opinion since I don't have a strong thought for it.

[Mark-Simulacrum]

Ah, interesting. Yeah, I don't think the speed bump is directly necessary at this time, thanks for clarifying.