feat: Adding licensing information to image

Using go-license to pull in the licensing for all go dependencies. The
final image then hosts all licencing informations under
"/usr/share/doc/preflight".

For more minimal impact on the repo this was added to the builder image.
This then gets output into "./builds/licenses" which is already copied
out by the makefile. Adds a step to copy over the licencing in the final
release image.

Author: hawksight

Dockerfile

@@ -1,4 +1,4 @@
-FROM gcr.io/distroless/static
+FROM gcr.io/distroless/static as release
 
 # TARGETPLATFORM comes from the buildx context and it will be something like `linux/arm64/v8` or `linux/amd64`.
 # Ref: https://docs.docker.com/buildx/working-with-buildx/
@@ -7,6 +7,10 @@ ARG TARGETPLATFORM
 USER 1000:1000
 
 COPY ./builds/${TARGETPLATFORM}/preflight /bin/preflight
+
+# '/usr/share/doc/$PACKAGE' is a pretty standard location for notices. In particular Debian does it this way.
+COPY ./builds/licenses /usr/share/doc/preflight/
+
 # load in an example config file
 ADD ./agent.yaml /etc/preflight/agent.yaml
 ENTRYPOINT ["preflight"]

builder.dockerfile

@@ -21,3 +21,11 @@ RUN make build-all-platforms \
     OAUTH_CLIENT_ID=${oauth_client_id} \
     OAUTH_CLIENT_SECRET=${oauth_client_secret} \
     OAUTH_AUTH_SERVER_DOMAIN=${oauth_auth_server_domain}
+
+
+# c781b427440f8ea100841eefdd308e660d26d121 is the v1.0.0 tag at the time of writing. 
+RUN go install github.com/google/go-licenses@c781b427440f8ea100841eefdd308e660d26d121
+
+# We need this '|| true' because go-licenses could fail to find a license so
+# may return a non-zero exit code and there's no way to supress it.
+RUN /go/bin/go-licenses save ./ --save_path="./builds/licenses/" || true