Skip to content

Commit 291ea46

Browse files
killianmuldoonkillianmuldoon
committed
Add licence-scan for pull requests
Signed-off-by: killianmuldoon <[email protected]>
1 parent 3b55934 commit 291ea46

File tree

5 files changed

+122
-36
lines changed

5 files changed

+122
-36
lines changed

‎CONTRIBUTING.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
- [Features and bugs](#features-and-bugs)
2424
- [Experiments](#experiments)
2525
- [Breaking Changes](#breaking-changes)
26+
- [Dependency Licence Management](#dependency-licence-management)
2627
- [API conventions](#api-conventions)
2728
- [Optional vs. Required](#optional-vs-required)
2829
- [Example](#example)
@@ -415,6 +416,10 @@ There may, at times, need to be exceptions where breaking changes are allowed in
415416
discretion of the project's maintainers, and must be carefully considered before merging. An example of an allowed
416417
breaking change might be a fix for a behavioral bug that was released in an initial minor version (such as `v0.3.0`).
417418

419+
## Dependency Licence Management
420+
421+
Cluster API follows the [license policy of the CNCF](https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md). This sets limits on which
422+
licenses dependencies and other artifacts use. For go dependencies only dependencies listed in the `go.mod` are considered dependencies. This is in line with [how dependencies are reviewed in Kubernetes](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/vendor.md#reviewing-and-approving-dependency-changes).
418423

419424
## API conventions
420425

‎Makefile

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,8 @@ HADOLINT_FAILURE_THRESHOLD = warning
144144

145145
SHELLCHECK_VER := v0.9.0
146146

147+
TRIVY_VER := 0.44.1
148+
147149
KPROMO_VER := v4.0.4
148150
KPROMO_BIN := kpromo
149151
KPROMO := $(abspath $(TOOLS_BIN_DIR)/$(KPROMO_BIN)-$(KPROMO_VER))
@@ -605,7 +607,7 @@ APIDIFF_OLD_COMMIT ?= $(shell git rev-parse origin/main)
605607
apidiff: $(GO_APIDIFF) ## Check for API differences
606608
$(GO_APIDIFF) $(APIDIFF_OLD_COMMIT) --print-compatible
607609

608-
ALL_VERIFY_CHECKS = boilerplate shellcheck tiltfile modules gen conversions doctoc capi-book-summary
610+
ALL_VERIFY_CHECKS = licenses boilerplate shellcheck tiltfile modules gen conversions doctoc capi-book-summary
609611

610612
.PHONY: verify
611613
verify: $(addprefix verify-,$(ALL_VERIFY_CHECKS)) lint-dockerfiles ## Run all verify-* targets
@@ -657,7 +659,11 @@ verify-tiltfile: ## Verify Tiltfile format
657659

658660
.PHONY: verify-container-images
659661
verify-container-images: ## Verify container images
660-
TRACE=$(TRACE) ./hack/verify-container-images.sh
662+
TRACE=$(TRACE) ./hack/verify-container-images.sh $(TRIVY_VER)
663+
664+
.PHONY: verify-licenses
665+
verify-licenses: ## Verify licenses
666+
TRACE=$(TRACE) ./hack/verify-licenses.sh $(TRIVY_VER)
661667

662668
.PHONY: verify-govulncheck
663669
verify-govulncheck: $(GOVULNCHECK) ## Verify code for vulnerabilities

‎hack/ensure-trivy.sh

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
#!/bin/bash
2+
3+
# Copyright 2023 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -o errexit
18+
set -o nounset
19+
set -o pipefail
20+
21+
if [[ "${TRACE-0}" == "1" ]]; then
22+
set -o xtrace
23+
fi
24+
25+
VERSION=${1}
26+
27+
GO_OS="$(go env GOOS)"
28+
if [[ "${GO_OS}" == "linux" ]]; then
29+
TRIVY_OS="Linux"
30+
elif [[ "${GO_OS}" == "darwin"* ]]; then
31+
TRIVY_OS="macOS"
32+
fi
33+
34+
GO_ARCH="$(go env GOARCH)"
35+
if [[ "${GO_ARCH}" == "amd" ]]; then
36+
TRIVY_ARCH="32bit"
37+
elif [[ "${GO_ARCH}" == "amd64"* ]]; then
38+
TRIVY_ARCH="64bit"
39+
elif [[ "${GO_ARCH}" == "arm" ]]; then
40+
TRIVY_ARCH="ARM"
41+
elif [[ "${GO_ARCH}" == "arm64" ]]; then
42+
TRIVY_ARCH="ARM64"
43+
fi
44+
45+
TOOL_BIN=hack/tools/bin
46+
mkdir -p ${TOOL_BIN}
47+
48+
TRIVY="${TOOL_BIN}/trivy/${VERSION}/trivy"
49+
50+
# Downloads trivy scanner
51+
if [ ! -f "$TRIVY" ]; then
52+
curl -L -o ${TOOL_BIN}/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_${TRIVY_OS}-${TRIVY_ARCH}.tar.gz"
53+
mkdir -p "$(dirname "$0")/tools/bin/trivy/${VERSION}"
54+
tar -xf "${TOOL_BIN}/trivy.tar.gz" -C "${TOOL_BIN}/trivy/${VERSION}" trivy
55+
chmod +x "${TOOL_BIN}/trivy/${VERSION}/trivy"
56+
rm "${TOOL_BIN}/trivy.tar.gz"
57+
fi

‎hack/verify-container-images.sh

Lines changed: 11 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -22,48 +22,25 @@ if [[ "${TRACE-0}" == "1" ]]; then
2222
set -o xtrace
2323
fi
2424

25-
TRIVY_VERSION=0.34.0
25+
VERSION=${1}
2626

27-
GO_OS="$(go env GOOS)"
28-
if [[ "${GO_OS}" == "linux" ]]; then
29-
TRIVY_OS="Linux"
30-
elif [[ "${GO_OS}" == "darwin"* ]]; then
31-
TRIVY_OS="macOS"
32-
fi
33-
34-
GO_ARCH="$(go env GOARCH)"
35-
if [[ "${GO_ARCH}" == "amd" ]]; then
36-
TRIVY_ARCH="32bit"
37-
elif [[ "${GO_ARCH}" == "amd64"* ]]; then
38-
TRIVY_ARCH="64bit"
39-
elif [[ "${GO_ARCH}" == "arm" ]]; then
40-
TRIVY_ARCH="ARM"
41-
elif [[ "${GO_ARCH}" == "arm64" ]]; then
42-
TRIVY_ARCH="ARM64"
43-
fi
44-
45-
TOOL_BIN=hack/tools/bin
46-
mkdir -p ${TOOL_BIN}
47-
48-
# Downloads trivy scanner
49-
curl -L -o ${TOOL_BIN}/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_OS}-${TRIVY_ARCH}.tar.gz"
27+
REPO_ROOT=$(git rev-parse --show-toplevel)
28+
"${REPO_ROOT}/hack/ensure-trivy.sh" "${VERSION}"
5029

51-
tar -xf "${TOOL_BIN}/trivy.tar.gz" -C "${TOOL_BIN}" trivy
52-
chmod +x ${TOOL_BIN}/trivy
53-
rm ${TOOL_BIN}/trivy.tar.gz
30+
TRIVY="${REPO_ROOT}/hack/tools/bin/trivy/${VERSION}/trivy"
5431

5532
# Builds all the container images to be scanned and cleans up changes to ./*manager_image_patch.yaml ./*manager_pull_policy.yaml.
5633
make REGISTRY=gcr.io/k8s-staging-cluster-api PULL_POLICY=IfNotPresent TAG=dev docker-build
5734
make clean-release-git
5835

5936
# Scan the images
60-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/clusterctl-"${GO_ARCH}":dev && R1=$? || R1=$?
61-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/test-extension-"${GO_ARCH}":dev && R2=$? || R2=$?
62-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/kubeadm-control-plane-controller-"${GO_ARCH}":dev && R3=$? || R3=$?
63-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/kubeadm-bootstrap-controller-"${GO_ARCH}":dev && R4=$? || R4=$?
64-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/cluster-api-controller-"${GO_ARCH}":dev && R5=$? || R5=$?
65-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/capd-manager-"${GO_ARCH}":dev && R6=$? || R6=$?
66-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/capim-manager-"${GO_ARCH}":dev && R6=$? || R6=$?
37+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/clusterctl-"${GO_ARCH}":dev && R1=$? || R1=$?
38+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/test-extension-"${GO_ARCH}":dev && R2=$? || R2=$?
39+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/kubeadm-control-plane-controller-"${GO_ARCH}":dev && R3=$? || R3=$?
40+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/kubeadm-bootstrap-controller-"${GO_ARCH}":dev && R4=$? || R4=$?
41+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/cluster-api-controller-"${GO_ARCH}":dev && R5=$? || R5=$?
42+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/capd-manager-"${GO_ARCH}":dev && R6=$? || R6=$?
43+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/capim-manager-"${GO_ARCH}":dev && R6=$? || R6=$?
6744

6845
echo ""
6946
BRed='\033[1;31m'

‎hack/verify-licenses.sh

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/bin/bash
2+
3+
# Copyright 2023 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -o errexit
18+
set -o nounset
19+
set -o pipefail
20+
21+
if [[ "${TRACE-0}" == "1" ]]; then
22+
set -o xtrace
23+
fi
24+
25+
# This list is from https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md
26+
CNCF_LICENSE_ALLOWLIST=Apache-2.0,MIT,BSD-2-Clause,SD-2-Clause-FreeBSD,BSD-3-Clause,ISC,Python-2.0,PostgreSQL,X11,Zlib
27+
28+
VERSION=${1}
29+
30+
REPO_ROOT=$(git rev-parse --show-toplevel)
31+
"${REPO_ROOT}/hack/ensure-trivy.sh" "${VERSION}"
32+
33+
34+
TRIVY="${REPO_ROOT}/hack/tools/bin/trivy/${VERSION}/trivy"
35+
$TRIVY filesystem . --license-full --ignored-licenses ${CNCF_LICENSE_ALLOWLIST} --scanners license --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL -f json | \
36+
# Specifically ignore 'github.com/hashicorp/hcl'. This is a known indirect dependency that we should remove where possible.
37+
# This query ensures we only skip github.com/hashicorp/hcl for as long as the license remains MPL-2.0
38+
jq '.Results[] | select( .Licenses[]?.PkgName == "github.com/hashicorp/hcl" and .Licenses[]?.Name == "MPL-2.0" | not) | if . == {} then . else error(.) end'
39+
40+
41+

0 commit comments

Comments
 (0)