Skip to content

Commit 613a37e

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #9184 from killianmuldoon/pr-add-license-scan
🌱 Add licence-scan for pull requests
2 parents 7b6db93 + 291ea46 commit 613a37e

File tree

5 files changed

+122
-36
lines changed

5 files changed

+122
-36
lines changed

‎CONTRIBUTING.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
- [Features and bugs](#features-and-bugs)
2424
- [Experiments](#experiments)
2525
- [Breaking Changes](#breaking-changes)
26+
- [Dependency Licence Management](#dependency-licence-management)
2627
- [API conventions](#api-conventions)
2728
- [Optional vs. Required](#optional-vs-required)
2829
- [Example](#example)
@@ -415,6 +416,10 @@ There may, at times, need to be exceptions where breaking changes are allowed in
415416
discretion of the project's maintainers, and must be carefully considered before merging. An example of an allowed
416417
breaking change might be a fix for a behavioral bug that was released in an initial minor version (such as `v0.3.0`).
417418

419+
## Dependency Licence Management
420+
421+
Cluster API follows the [license policy of the CNCF](https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md). This sets limits on which
422+
licenses dependencies and other artifacts use. For go dependencies only dependencies listed in the `go.mod` are considered dependencies. This is in line with [how dependencies are reviewed in Kubernetes](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/vendor.md#reviewing-and-approving-dependency-changes).
418423

419424
## API conventions
420425

‎Makefile

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,8 @@ HADOLINT_FAILURE_THRESHOLD = warning
145145

146146
SHELLCHECK_VER := v0.9.0
147147

148+
TRIVY_VER := 0.44.1
149+
148150
KPROMO_VER := v4.0.4
149151
KPROMO_BIN := kpromo
150152
KPROMO := $(abspath $(TOOLS_BIN_DIR)/$(KPROMO_BIN)-$(KPROMO_VER))
@@ -618,7 +620,7 @@ APIDIFF_OLD_COMMIT ?= $(shell git rev-parse origin/main)
618620
apidiff: $(GO_APIDIFF) ## Check for API differences
619621
$(GO_APIDIFF) $(APIDIFF_OLD_COMMIT) --print-compatible
620622

621-
ALL_VERIFY_CHECKS = boilerplate shellcheck tiltfile modules gen conversions doctoc capi-book-summary
623+
ALL_VERIFY_CHECKS = licenses boilerplate shellcheck tiltfile modules gen conversions doctoc capi-book-summary
622624

623625
.PHONY: verify
624626
verify: $(addprefix verify-,$(ALL_VERIFY_CHECKS)) lint-dockerfiles ## Run all verify-* targets
@@ -670,7 +672,11 @@ verify-tiltfile: ## Verify Tiltfile format
670672

671673
.PHONY: verify-container-images
672674
verify-container-images: ## Verify container images
673-
TRACE=$(TRACE) ./hack/verify-container-images.sh
675+
TRACE=$(TRACE) ./hack/verify-container-images.sh $(TRIVY_VER)
676+
677+
.PHONY: verify-licenses
678+
verify-licenses: ## Verify licenses
679+
TRACE=$(TRACE) ./hack/verify-licenses.sh $(TRIVY_VER)
674680

675681
.PHONY: verify-govulncheck
676682
verify-govulncheck: $(GOVULNCHECK) ## Verify code for vulnerabilities

‎hack/ensure-trivy.sh

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
#!/bin/bash
2+
3+
# Copyright 2023 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -o errexit
18+
set -o nounset
19+
set -o pipefail
20+
21+
if [[ "${TRACE-0}" == "1" ]]; then
22+
set -o xtrace
23+
fi
24+
25+
VERSION=${1}
26+
27+
GO_OS="$(go env GOOS)"
28+
if [[ "${GO_OS}" == "linux" ]]; then
29+
TRIVY_OS="Linux"
30+
elif [[ "${GO_OS}" == "darwin"* ]]; then
31+
TRIVY_OS="macOS"
32+
fi
33+
34+
GO_ARCH="$(go env GOARCH)"
35+
if [[ "${GO_ARCH}" == "amd" ]]; then
36+
TRIVY_ARCH="32bit"
37+
elif [[ "${GO_ARCH}" == "amd64"* ]]; then
38+
TRIVY_ARCH="64bit"
39+
elif [[ "${GO_ARCH}" == "arm" ]]; then
40+
TRIVY_ARCH="ARM"
41+
elif [[ "${GO_ARCH}" == "arm64" ]]; then
42+
TRIVY_ARCH="ARM64"
43+
fi
44+
45+
TOOL_BIN=hack/tools/bin
46+
mkdir -p ${TOOL_BIN}
47+
48+
TRIVY="${TOOL_BIN}/trivy/${VERSION}/trivy"
49+
50+
# Downloads trivy scanner
51+
if [ ! -f "$TRIVY" ]; then
52+
curl -L -o ${TOOL_BIN}/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_${TRIVY_OS}-${TRIVY_ARCH}.tar.gz"
53+
mkdir -p "$(dirname "$0")/tools/bin/trivy/${VERSION}"
54+
tar -xf "${TOOL_BIN}/trivy.tar.gz" -C "${TOOL_BIN}/trivy/${VERSION}" trivy
55+
chmod +x "${TOOL_BIN}/trivy/${VERSION}/trivy"
56+
rm "${TOOL_BIN}/trivy.tar.gz"
57+
fi

‎hack/verify-container-images.sh

Lines changed: 11 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -22,48 +22,25 @@ if [[ "${TRACE-0}" == "1" ]]; then
2222
set -o xtrace
2323
fi
2424

25-
TRIVY_VERSION=0.34.0
25+
VERSION=${1}
2626

27-
GO_OS="$(go env GOOS)"
28-
if [[ "${GO_OS}" == "linux" ]]; then
29-
TRIVY_OS="Linux"
30-
elif [[ "${GO_OS}" == "darwin"* ]]; then
31-
TRIVY_OS="macOS"
32-
fi
33-
34-
GO_ARCH="$(go env GOARCH)"
35-
if [[ "${GO_ARCH}" == "amd" ]]; then
36-
TRIVY_ARCH="32bit"
37-
elif [[ "${GO_ARCH}" == "amd64"* ]]; then
38-
TRIVY_ARCH="64bit"
39-
elif [[ "${GO_ARCH}" == "arm" ]]; then
40-
TRIVY_ARCH="ARM"
41-
elif [[ "${GO_ARCH}" == "arm64" ]]; then
42-
TRIVY_ARCH="ARM64"
43-
fi
44-
45-
TOOL_BIN=hack/tools/bin
46-
mkdir -p ${TOOL_BIN}
47-
48-
# Downloads trivy scanner
49-
curl -L -o ${TOOL_BIN}/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_OS}-${TRIVY_ARCH}.tar.gz"
27+
REPO_ROOT=$(git rev-parse --show-toplevel)
28+
"${REPO_ROOT}/hack/ensure-trivy.sh" "${VERSION}"
5029

51-
tar -xf "${TOOL_BIN}/trivy.tar.gz" -C "${TOOL_BIN}" trivy
52-
chmod +x ${TOOL_BIN}/trivy
53-
rm ${TOOL_BIN}/trivy.tar.gz
30+
TRIVY="${REPO_ROOT}/hack/tools/bin/trivy/${VERSION}/trivy"
5431

5532
# Builds all the container images to be scanned and cleans up changes to ./*manager_image_patch.yaml ./*manager_pull_policy.yaml.
5633
make REGISTRY=gcr.io/k8s-staging-cluster-api PULL_POLICY=IfNotPresent TAG=dev docker-build
5734
make clean-release-git
5835

5936
# Scan the images
60-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/clusterctl-"${GO_ARCH}":dev && R1=$? || R1=$?
61-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/test-extension-"${GO_ARCH}":dev && R2=$? || R2=$?
62-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/kubeadm-control-plane-controller-"${GO_ARCH}":dev && R3=$? || R3=$?
63-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/kubeadm-bootstrap-controller-"${GO_ARCH}":dev && R4=$? || R4=$?
64-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/cluster-api-controller-"${GO_ARCH}":dev && R5=$? || R5=$?
65-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/capd-manager-"${GO_ARCH}":dev && R6=$? || R6=$?
66-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/capim-manager-"${GO_ARCH}":dev && R6=$? || R6=$?
37+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/clusterctl-"${GO_ARCH}":dev && R1=$? || R1=$?
38+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/test-extension-"${GO_ARCH}":dev && R2=$? || R2=$?
39+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/kubeadm-control-plane-controller-"${GO_ARCH}":dev && R3=$? || R3=$?
40+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/kubeadm-bootstrap-controller-"${GO_ARCH}":dev && R4=$? || R4=$?
41+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/cluster-api-controller-"${GO_ARCH}":dev && R5=$? || R5=$?
42+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/capd-manager-"${GO_ARCH}":dev && R6=$? || R6=$?
43+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/capim-manager-"${GO_ARCH}":dev && R6=$? || R6=$?
6744

6845
echo ""
6946
BRed='\033[1;31m'

‎hack/verify-licenses.sh

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/bin/bash
2+
3+
# Copyright 2023 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -o errexit
18+
set -o nounset
19+
set -o pipefail
20+
21+
if [[ "${TRACE-0}" == "1" ]]; then
22+
set -o xtrace
23+
fi
24+
25+
# This list is from https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md
26+
CNCF_LICENSE_ALLOWLIST=Apache-2.0,MIT,BSD-2-Clause,SD-2-Clause-FreeBSD,BSD-3-Clause,ISC,Python-2.0,PostgreSQL,X11,Zlib
27+
28+
VERSION=${1}
29+
30+
REPO_ROOT=$(git rev-parse --show-toplevel)
31+
"${REPO_ROOT}/hack/ensure-trivy.sh" "${VERSION}"
32+
33+
34+
TRIVY="${REPO_ROOT}/hack/tools/bin/trivy/${VERSION}/trivy"
35+
$TRIVY filesystem . --license-full --ignored-licenses ${CNCF_LICENSE_ALLOWLIST} --scanners license --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL -f json | \
36+
# Specifically ignore 'github.com/hashicorp/hcl'. This is a known indirect dependency that we should remove where possible.
37+
# This query ensures we only skip github.com/hashicorp/hcl for as long as the license remains MPL-2.0
38+
jq '.Results[] | select( .Licenses[]?.PkgName == "github.com/hashicorp/hcl" and .Licenses[]?.Name == "MPL-2.0" | not) | if . == {} then . else error(.) end'
39+
40+
41+

0 commit comments

Comments
 (0)