diff --git a/.github/workflows/third-party-notices-check.yaml b/.github/workflows/third-party-notices-check.yaml index 82410bc2f..111c3c1f0 100644 --- a/.github/workflows/third-party-notices-check.yaml +++ b/.github/workflows/third-party-notices-check.yaml @@ -13,7 +13,11 @@ # limitations under the License. # Regenerates THIRD_PARTY_NOTICES.md and fails if it differs from the committed -# copy, so a dependency change cannot land without refreshed attribution. +# copy, so a dependency change cannot land without refreshed attribution. The +# generator also fails when a license file has no verified URL in +# tools/license-urls.tsv, which catches a bump that skipped +# 'make third-party-notices-urls'. Link rot is caught separately by +# third-party-notices-links.yaml. name: Third-Party Notices Check diff --git a/.github/workflows/third-party-notices-links.yaml b/.github/workflows/third-party-notices-links.yaml new file mode 100644 index 000000000..e15eb00d4 --- /dev/null +++ b/.github/workflows/third-party-notices-links.yaml @@ -0,0 +1,61 @@ +# Copyright NVIDIA CORPORATION +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Re-verifies every license URL against the vendored bytes. Links are proven +# correct when written, but upstream can retag, rename or archive a repository +# afterwards, and no offline gate can see that. This runs on a schedule rather +# than per pull request so link rot does not block unrelated work. + +name: Third-Party Notices Link Check + +on: + schedule: + - cron: '0 6 * * 1' + workflow_dispatch: + +permissions: + contents: read + +jobs: + verify-links: + runs-on: ubuntu-latest + timeout-minutes: 45 + steps: + - name: Checkout code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + + - name: Get Golang version + run: | + GOLANG_VERSION=$( grep "GOLANG_VERSION ?=" versions.mk ) + echo "GOLANG_VERSION=${GOLANG_VERSION##GOLANG_VERSION ?= }" >> "${GITHUB_ENV}" + + - name: Install Go + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 + with: + go-version: ${{ env.GOLANG_VERSION }} + + - name: Re-verify every license URL + env: + URLS_OUTPUT: /tmp/license-urls-fresh.tsv + run: make install-tools && bash tools/verify-license-urls.sh + + - name: Compare against the committed map + run: | + if ! diff -u <(LC_ALL=C grep -v '^#' tools/license-urls.tsv) \ + <(LC_ALL=C grep -v '^#' /tmp/license-urls-fresh.tsv); then + echo "::error::A license URL no longer serves the vendored bytes. Upstream may have retagged or moved." + exit 1 + fi diff --git a/Makefile b/Makefile index 4d5faf5cb..881e69e50 100644 --- a/Makefile +++ b/Makefile @@ -144,7 +144,7 @@ push-bundle-image: build-bundle-image CMDS := $(patsubst ./cmd/%/,%,$(sort $(dir $(wildcard ./cmd/*/)))) CMD_TARGETS := $(patsubst %,cmd-%, $(CMDS)) -CHECK_TARGETS := lint license-check validate-modules validate-generated-assets +CHECK_TARGETS := lint license-check validate-modules validate-generated-assets test-tools MAKE_TARGETS := build check coverage cmds $(CMD_TARGETS) $(CHECK_TARGETS) DOCKER_TARGETS := $(patsubst %,docker-%, $(MAKE_TARGETS)) .PHONY: $(MAKE_TARGETS) $(DOCKER_TARGETS) @@ -203,6 +203,24 @@ check-third-party-notices: third-party-notices @git diff --exit-code -- THIRD_PARTY_NOTICES.md \ || { echo "ERROR: THIRD_PARTY_NOTICES.md is stale. Run 'make third-party-notices' and commit the change."; exit 1; } +# Needs network. Rarely run: keyed by module, so a version bump does not +# invalidate it. Only a new dependency does. +.PHONY: third-party-notices-repos +third-party-notices-repos: + @bash tools/resolve-module-repos.sh + +# Needs network. Every URL is content-verified against the vendored copy before +# it is written, so re-run this whenever a dependency version changes. +.PHONY: third-party-notices-urls +third-party-notices-urls: third-party-notices-repos + @bash tools/verify-license-urls.sh + +.PHONY: test-tools +test-tools: + @for t in tools/*_test.sh; do \ + bash "$$t" || exit 1; \ + done + # Apply go fmt to the codebase fmt: go list -f '{{.Dir}}' $(MODULE)/... \ diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 7e76f1248..7dedbfa54 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -12,6 +12,13 @@ shipped; its dependencies are listed here as well rather than excluded. Go standard library packages are excluded; they are covered by the license of the Go distribution itself. +Each dependency is listed with the version redistributed and a link to the +license file in that version's upstream source. Every link was verified by +fetching it and comparing its contents against the copy vendored here, so each +one resolves to the same license text reproduced below. Modules that no command +under `cmd/` links are not listed; those are vendored only for this module's own +tests and build tooling. + The `gpu-operator` image uses `nvcr.io/nvidia/distroless/cc` as a base image. All of the OSS packages and source included in this image can be found at . A statically @@ -22,142 +29,144 @@ carry. ## Dependency Index -| Package | License | Dependency | -|---------|---------|------------| -| `dario.cat/mergo` | BSD-3-Clause | `dario.cat/mergo` | -| `github.com/MakeNowJust/heredoc` | MIT | `github.com/MakeNowJust/heredoc` | -| `github.com/Masterminds/goutils` | Apache-2.0 | `github.com/Masterminds/goutils` | -| `github.com/Masterminds/semver/v3` | MIT | `github.com/Masterminds/semver/v3` | -| `github.com/Masterminds/sprig/v3` | MIT | `github.com/Masterminds/sprig/v3` | -| `github.com/Mellanox/maintenance-operator/api/v1alpha1` | Apache-2.0 | `github.com/Mellanox/maintenance-operator/api` | -| `github.com/NVIDIA/go-nvlib/pkg` | Apache-2.0 | `github.com/NVIDIA/go-nvlib` | -| `github.com/NVIDIA/k8s-kata-manager/api/v1alpha1/config` | Apache-2.0 | `github.com/NVIDIA/k8s-kata-manager` | -| `github.com/NVIDIA/k8s-operator-libs` | Apache-2.0 | `github.com/NVIDIA/k8s-operator-libs` | -| `github.com/NVIDIA/nvidia-container-toolkit` | Apache-2.0 | `github.com/NVIDIA/nvidia-container-toolkit` | -| `github.com/beorn7/perks/quantile` | MIT | `github.com/beorn7/perks` | -| `github.com/blang/semver/v4` | MIT | `github.com/blang/semver/v4` | -| `github.com/cespare/xxhash/v2` | MIT | `github.com/cespare/xxhash/v2` | -| `github.com/chai2010/gettext-go` | BSD-3-Clause | `github.com/chai2010/gettext-go` | -| `github.com/cyphar/filepath-securejoin` | BSD-3-Clause / MPL-2.0 | `github.com/cyphar/filepath-securejoin` | -| `github.com/davecgh/go-spew/spew` | ISC | `github.com/davecgh/go-spew` | -| `github.com/docker/libtrust` | Apache-2.0 | `github.com/docker/libtrust` | -| `github.com/emicklei/go-restful/v3` | MIT | `github.com/emicklei/go-restful/v3` | -| `github.com/evanphx/json-patch/v5` | BSD-3-Clause | `github.com/evanphx/json-patch/v5` | -| `github.com/exponent-io/jsonpath` | MIT | `github.com/exponent-io/jsonpath` | -| `github.com/fsnotify/fsnotify` | BSD-3-Clause | `github.com/fsnotify/fsnotify` | -| `github.com/fxamacker/cbor/v2` | MIT | `github.com/fxamacker/cbor/v2` | -| `github.com/go-errors/errors` | MIT | `github.com/go-errors/errors` | -| `github.com/go-logr/logr` | Apache-2.0 | `github.com/go-logr/logr` | -| `github.com/go-logr/zapr` | Apache-2.0 | `github.com/go-logr/zapr` | -| `github.com/go-openapi/jsonpointer` | Apache-2.0 | `github.com/go-openapi/jsonpointer` | -| `github.com/go-openapi/jsonreference` | Apache-2.0 | `github.com/go-openapi/jsonreference` | -| `github.com/go-openapi/swag` | Apache-2.0 | `github.com/go-openapi/swag` | -| `github.com/go-openapi/swag/cmdutils` | Apache-2.0 | `github.com/go-openapi/swag/cmdutils` | -| `github.com/go-openapi/swag/conv` | Apache-2.0 | `github.com/go-openapi/swag/conv` | -| `github.com/go-openapi/swag/fileutils` | Apache-2.0 | `github.com/go-openapi/swag/fileutils` | -| `github.com/go-openapi/swag/jsonname` | Apache-2.0 | `github.com/go-openapi/swag/jsonname` | -| `github.com/go-openapi/swag/jsonutils` | Apache-2.0 | `github.com/go-openapi/swag/jsonutils` | -| `github.com/go-openapi/swag/loading` | Apache-2.0 | `github.com/go-openapi/swag/loading` | -| `github.com/go-openapi/swag/mangling` | Apache-2.0 | `github.com/go-openapi/swag/mangling` | -| `github.com/go-openapi/swag/netutils` | Apache-2.0 | `github.com/go-openapi/swag/netutils` | -| `github.com/go-openapi/swag/stringutils` | Apache-2.0 | `github.com/go-openapi/swag/stringutils` | -| `github.com/go-openapi/swag/typeutils` | Apache-2.0 | `github.com/go-openapi/swag/typeutils` | -| `github.com/go-openapi/swag/yamlutils` | Apache-2.0 | `github.com/go-openapi/swag/yamlutils` | -| `github.com/google/btree` | Apache-2.0 | `github.com/google/btree` | -| `github.com/google/gnostic-models` | Apache-2.0 | `github.com/google/gnostic-models` | -| `github.com/google/uuid` | BSD-3-Clause | `github.com/google/uuid` | -| `github.com/huandu/xstrings` | MIT | `github.com/huandu/xstrings` | -| `github.com/json-iterator/go` | MIT | `github.com/json-iterator/go` | -| `github.com/klauspost/compress` | Apache-2.0 / BSD-3-Clause / MIT | `github.com/klauspost/compress` | -| `github.com/klauspost/compress/internal/snapref` | BSD-3-Clause | `github.com/klauspost/compress` | -| `github.com/klauspost/compress/zstd/internal/xxhash` | MIT | `github.com/klauspost/compress` | -| `github.com/liggitt/tabwriter` | BSD-3-Clause | `github.com/liggitt/tabwriter` | -| `github.com/mitchellh/copystructure` | MIT | `github.com/mitchellh/copystructure` | -| `github.com/mitchellh/go-wordwrap` | MIT | `github.com/mitchellh/go-wordwrap` | -| `github.com/mitchellh/reflectwalk` | MIT | `github.com/mitchellh/reflectwalk` | -| `github.com/moby/term` | Apache-2.0 | `github.com/moby/term` | -| `github.com/modern-go/concurrent` | Apache-2.0 | `github.com/modern-go/concurrent` | -| `github.com/modern-go/reflect2` | Apache-2.0 | `github.com/modern-go/reflect2` | -| `github.com/monochromegane/go-gitignore` | MIT | `github.com/monochromegane/go-gitignore` | -| `github.com/munnerz/goautoneg` | BSD-3-Clause | `github.com/munnerz/goautoneg` | -| `github.com/opencontainers/cgroups/devices/config` | Apache-2.0 | `github.com/opencontainers/cgroups` | -| `github.com/opencontainers/go-digest` | Apache-2.0 | `github.com/opencontainers/go-digest` | -| `github.com/opencontainers/runc/libcontainer/devices` | Apache-2.0 | `github.com/opencontainers/runc` | -| `github.com/openshift/api` | Apache-2.0 | `github.com/openshift/api` | -| `github.com/openshift/client-go` | Apache-2.0 | `github.com/openshift/client-go` | -| `github.com/operator-framework/api/pkg` | Apache-2.0 | `github.com/operator-framework/api` | -| `github.com/peterbourgon/diskv` | MIT | `github.com/peterbourgon/diskv` | -| `github.com/pmezard/go-difflib/difflib` | BSD-3-Clause | `github.com/pmezard/go-difflib` | -| `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` | Apache-2.0 | `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` | -| `github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil` | BSD-3-Clause | `github.com/prometheus/client_golang` | -| `github.com/prometheus/client_golang/prometheus` | Apache-2.0 | `github.com/prometheus/client_golang` | -| `github.com/prometheus/client_model/go` | Apache-2.0 | `github.com/prometheus/client_model` | -| `github.com/prometheus/common` | Apache-2.0 | `github.com/prometheus/common` | -| `github.com/prometheus/procfs` | Apache-2.0 | `github.com/prometheus/procfs` | -| `github.com/regclient/regclient` | Apache-2.0 | `github.com/regclient/regclient` | -| `github.com/russross/blackfriday/v2` | BSD-2-Clause | `github.com/russross/blackfriday/v2` | -| `github.com/shopspring/decimal` | MIT | `github.com/shopspring/decimal` | -| `github.com/sirupsen/logrus` | MIT | `github.com/sirupsen/logrus` | -| `github.com/spf13/cast` | MIT | `github.com/spf13/cast` | -| `github.com/spf13/cobra` | Apache-2.0 | `github.com/spf13/cobra` | -| `github.com/spf13/pflag` | BSD-3-Clause | `github.com/spf13/pflag` | -| `github.com/stretchr/testify/assert/yaml` | MIT | `github.com/stretchr/testify` | -| `github.com/ulikunitz/xz` | BSD-3-Clause | `github.com/ulikunitz/xz` | -| `github.com/urfave/cli/v3` | MIT | `github.com/urfave/cli/v3` | -| `github.com/x448/float16` | MIT | `github.com/x448/float16` | -| `github.com/xlab/treeprint` | MIT | `github.com/xlab/treeprint` | -| `go.uber.org/multierr` | MIT | `go.uber.org/multierr` | -| `go.uber.org/zap` | MIT | `go.uber.org/zap` | -| `go.yaml.in/yaml/v2` | Apache-2.0 | `go.yaml.in/yaml/v2` | -| `go.yaml.in/yaml/v3` | MIT | `go.yaml.in/yaml/v3` | -| `golang.org/x/crypto` | BSD-3-Clause | `golang.org/x/crypto` | -| `golang.org/x/mod/semver` | BSD-3-Clause | `golang.org/x/mod` | -| `golang.org/x/net` | BSD-3-Clause | `golang.org/x/net` | -| `golang.org/x/oauth2` | BSD-3-Clause | `golang.org/x/oauth2` | -| `golang.org/x/sync/errgroup` | BSD-3-Clause | `golang.org/x/sync` | -| `golang.org/x/sys/unix` | BSD-3-Clause | `golang.org/x/sys` | -| `golang.org/x/term` | BSD-3-Clause | `golang.org/x/term` | -| `golang.org/x/text` | BSD-3-Clause | `golang.org/x/text` | -| `golang.org/x/time/rate` | BSD-3-Clause | `golang.org/x/time` | -| `gomodules.xyz/jsonpatch/v2` | Apache-2.0 | `gomodules.xyz/jsonpatch/v2` | -| `google.golang.org/protobuf` | BSD-3-Clause | `google.golang.org/protobuf` | -| `gopkg.in/evanphx/json-patch.v4` | BSD-3-Clause | `gopkg.in/evanphx/json-patch.v4` | -| `gopkg.in/inf.v0` | BSD-3-Clause | `gopkg.in/inf.v0` | -| `gopkg.in/yaml.v3` | MIT | `gopkg.in/yaml.v3` | -| `k8s.io/api` | Apache-2.0 | `k8s.io/api` | -| `k8s.io/apiextensions-apiserver/pkg` | Apache-2.0 | `k8s.io/apiextensions-apiserver` | -| `k8s.io/apimachinery/pkg` | Apache-2.0 | `k8s.io/apimachinery` | -| `k8s.io/apimachinery/third_party/forked/golang` | BSD-3-Clause | `k8s.io/apimachinery` | -| `k8s.io/cli-runtime/pkg` | Apache-2.0 | `k8s.io/cli-runtime` | -| `k8s.io/client-go` | Apache-2.0 | `k8s.io/client-go` | -| `k8s.io/client-go/third_party/forked/golang/template` | BSD-3-Clause | `k8s.io/client-go` | -| `k8s.io/client-go/third_party/forked/httpcache` | MIT | `k8s.io/client-go` | -| `k8s.io/component-base/version` | Apache-2.0 | `k8s.io/component-base` | -| `k8s.io/klog/v2` | Apache-2.0 | `k8s.io/klog/v2` | -| `k8s.io/kube-openapi/pkg` | Apache-2.0 | `k8s.io/kube-openapi` | -| `k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json` | BSD-3-Clause | `k8s.io/kube-openapi` | -| `k8s.io/kube-openapi/pkg/validation/spec` | Apache-2.0 | `k8s.io/kube-openapi` | -| `k8s.io/kubectl/pkg` | Apache-2.0 | `k8s.io/kubectl` | -| `k8s.io/utils` | Apache-2.0 | `k8s.io/utils` | -| `k8s.io/utils/internal/third_party/forked/golang` | BSD-3-Clause | `k8s.io/utils` | -| `k8s.io/utils/third_party/forked/golang/btree` | Apache-2.0 | `k8s.io/utils` | -| `sigs.k8s.io/controller-runtime` | Apache-2.0 | `sigs.k8s.io/controller-runtime` | -| `sigs.k8s.io/json` | Apache-2.0 / BSD-3-Clause | `sigs.k8s.io/json` | -| `sigs.k8s.io/kustomize/api` | Apache-2.0 | `sigs.k8s.io/kustomize/api` | -| `sigs.k8s.io/kustomize/kyaml` | Apache-2.0 | `sigs.k8s.io/kustomize/kyaml` | -| `sigs.k8s.io/randfill` | Apache-2.0 | `sigs.k8s.io/randfill` | -| `sigs.k8s.io/structured-merge-diff/v6` | Apache-2.0 | `sigs.k8s.io/structured-merge-diff/v6` | -| `sigs.k8s.io/yaml` | Apache-2.0 / BSD-3-Clause / MIT | `sigs.k8s.io/yaml` | +| Package | Version | License | Location | +|---------|---------|---------|----------| +| `dario.cat/mergo` | v1.0.1 | BSD-3-Clause | [LICENSE](https://github.com/imdario/mergo/blob/v1.0.1/LICENSE) | +| `github.com/MakeNowJust/heredoc` | v1.0.0 | MIT | [LICENSE](https://github.com/makenowjust/heredoc/blob/v1.0.0/LICENSE) | +| `github.com/Masterminds/goutils` | v1.1.1 | Apache-2.0 | [LICENSE.txt](https://github.com/Masterminds/goutils/blob/v1.1.1/LICENSE.txt) | +| `github.com/Masterminds/semver/v3` | v3.5.0 | MIT | [LICENSE.txt](https://github.com/Masterminds/semver/blob/v3.5.0/LICENSE.txt) | +| `github.com/Masterminds/sprig/v3` | v3.3.0 | MIT | [LICENSE.txt](https://github.com/Masterminds/sprig/blob/v3.3.0/LICENSE.txt) | +| `github.com/Mellanox/maintenance-operator/api/v1alpha1` | v0.3.0 | Apache-2.0 | [LICENSE](https://github.com/Mellanox/maintenance-operator/blob/api/v0.3.0/LICENSE) | +| `github.com/NVIDIA/go-nvlib/pkg` | v0.12.0 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/LICENSE) / [NOTICE](https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/NOTICE) | +| `github.com/NVIDIA/k8s-kata-manager/api/v1alpha1/config` | v0.2.3 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/k8s-kata-manager/blob/v0.2.3/LICENSE) | +| `github.com/NVIDIA/k8s-operator-libs` | v0.0.0-20260629200812-d720f2557494 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/k8s-operator-libs/blob/d720f2557494/LICENSE) | +| `github.com/NVIDIA/nvidia-container-toolkit` | v1.20.0 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/nvidia-container-toolkit/blob/v1.20.0/LICENSE) | +| `github.com/beorn7/perks/quantile` | v1.0.1 | MIT | [LICENSE](https://github.com/beorn7/perks/blob/v1.0.1/LICENSE) | +| `github.com/blang/semver/v4` | v4.0.0 | MIT | [LICENSE](https://github.com/blang/semver/blob/v4.0.0/LICENSE) | +| `github.com/cespare/xxhash/v2` | v2.3.0 | MIT | [LICENSE.txt](https://github.com/cespare/xxhash/blob/v2.3.0/LICENSE.txt) | +| `github.com/chai2010/gettext-go` | v1.0.2 | BSD-3-Clause | [LICENSE](https://github.com/chai2010/gettext-go/blob/v1.0.2/LICENSE) | +| `github.com/cyphar/filepath-securejoin` | v0.7.0 | BSD-3-Clause / MPL-2.0 | [COPYING.md](https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/COPYING.md) / [LICENSE.BSD](https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.BSD) / [LICENSE.MPL-2.0](https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.MPL-2.0) | +| `github.com/davecgh/go-spew/spew` | v1.1.2-0.20180830191138-d8f796af33cc | ISC | [LICENSE](https://github.com/davecgh/go-spew/blob/d8f796af33cc/LICENSE) | +| `github.com/docker/libtrust` | v0.0.0-20160708172513-aabc10ec26b7 | Apache-2.0 | [LICENSE](https://github.com/docker-archive-public/docker.libtrust/blob/aabc10ec26b7/LICENSE) | +| `github.com/emicklei/go-restful/v3` | v3.13.0 | MIT | [LICENSE](https://github.com/emicklei/go-restful/blob/v3.13.0/LICENSE) | +| `github.com/evanphx/json-patch/v5` | v5.9.11 | BSD-3-Clause | [LICENSE](https://github.com/evanphx/json-patch/blob/v5.9.11/LICENSE) | +| `github.com/exponent-io/jsonpath` | v0.0.0-20210407135951-1de76d718b3f | MIT | [LICENSE](https://github.com/exponent-io/jsonpath/blob/1de76d718b3f/LICENSE) | +| `github.com/fsnotify/fsnotify` | v1.9.0 | BSD-3-Clause | [LICENSE](https://github.com/fsnotify/fsnotify/blob/v1.9.0/LICENSE) | +| `github.com/fxamacker/cbor/v2` | v2.9.2 | MIT | [LICENSE](https://github.com/fxamacker/cbor/blob/v2.9.2/LICENSE) | +| `github.com/go-errors/errors` | v1.5.1 | MIT | [LICENSE.MIT](https://github.com/go-errors/errors/blob/v1.5.1/LICENSE.MIT) | +| `github.com/go-logr/logr` | v1.4.4 | Apache-2.0 | [LICENSE](https://github.com/go-logr/logr/blob/v1.4.4/LICENSE) | +| `github.com/go-logr/zapr` | v1.3.0 | Apache-2.0 | [LICENSE](https://github.com/go-logr/zapr/blob/v1.3.0/LICENSE) | +| `github.com/go-openapi/jsonpointer` | v0.22.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/jsonpointer/blob/v0.22.4/LICENSE) / [NOTICE](https://github.com/go-openapi/jsonpointer/blob/v0.22.4/NOTICE) | +| `github.com/go-openapi/jsonreference` | v0.21.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/jsonreference/blob/v0.21.4/LICENSE) / [NOTICE](https://github.com/go-openapi/jsonreference/blob/v0.21.4/NOTICE) | +| `github.com/go-openapi/swag` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/v0.25.4/LICENSE) | +| `github.com/go-openapi/swag/cmdutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/cmdutils/v0.25.4/LICENSE) | +| `github.com/go-openapi/swag/conv` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/conv/v0.25.4/LICENSE) | +| `github.com/go-openapi/swag/fileutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/fileutils/v0.25.4/LICENSE) | +| `github.com/go-openapi/swag/jsonname` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/jsonname/v0.25.4/LICENSE) | +| `github.com/go-openapi/swag/jsonutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/jsonutils/v0.25.4/LICENSE) | +| `github.com/go-openapi/swag/loading` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/loading/v0.25.4/LICENSE) | +| `github.com/go-openapi/swag/mangling` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/mangling/v0.25.4/LICENSE) | +| `github.com/go-openapi/swag/netutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/netutils/v0.25.4/LICENSE) | +| `github.com/go-openapi/swag/stringutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/stringutils/v0.25.4/LICENSE) | +| `github.com/go-openapi/swag/typeutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/typeutils/v0.25.4/LICENSE) | +| `github.com/go-openapi/swag/yamlutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/yamlutils/v0.25.4/LICENSE) | +| `github.com/google/btree` | v1.1.3 | Apache-2.0 | [LICENSE](https://github.com/google/btree/blob/v1.1.3/LICENSE) | +| `github.com/google/gnostic-models` | v0.7.1 | Apache-2.0 | [LICENSE](https://github.com/google/gnostic-models/blob/v0.7.1/LICENSE) | +| `github.com/google/uuid` | v1.6.0 | BSD-3-Clause | [LICENSE](https://github.com/google/uuid/blob/v1.6.0/LICENSE) | +| `github.com/huandu/xstrings` | v1.5.0 | MIT | [LICENSE](https://github.com/huandu/xstrings/blob/v1.5.0/LICENSE) | +| `github.com/json-iterator/go` | v1.1.12 | MIT | [LICENSE](https://github.com/json-iterator/go/blob/v1.1.12/LICENSE) | +| `github.com/klauspost/compress` | v1.19.1 | Apache-2.0 / BSD-3-Clause / MIT | [LICENSE](https://github.com/klauspost/compress/blob/v1.19.1/LICENSE) | +| `github.com/klauspost/compress/internal/snapref` | v1.19.1 | BSD-3-Clause | [LICENSE](https://github.com/klauspost/compress/blob/v1.19.1/internal/snapref/LICENSE) | +| `github.com/klauspost/compress/zstd/internal/xxhash` | v1.19.1 | MIT | [LICENSE.txt](https://github.com/klauspost/compress/blob/v1.19.1/zstd/internal/xxhash/LICENSE.txt) | +| `github.com/liggitt/tabwriter` | v0.0.0-20181228230101-89fcab3d43de | BSD-3-Clause | [LICENSE](https://github.com/liggitt/tabwriter/blob/89fcab3d43de/LICENSE) | +| `github.com/mitchellh/copystructure` | v1.2.0 | MIT | [LICENSE](https://github.com/mitchellh/copystructure/blob/v1.2.0/LICENSE) | +| `github.com/mitchellh/go-wordwrap` | v1.0.1 | MIT | [LICENSE.md](https://github.com/mitchellh/go-wordwrap/blob/v1.0.1/LICENSE.md) | +| `github.com/mitchellh/reflectwalk` | v1.0.2 | MIT | [LICENSE](https://github.com/mitchellh/reflectwalk/blob/v1.0.2/LICENSE) | +| `github.com/moby/term` | v0.5.2 | Apache-2.0 | [LICENSE](https://github.com/moby/term/blob/v0.5.2/LICENSE) | +| `github.com/modern-go/concurrent` | v0.0.0-20180306012644-bacd9c7ef1dd | Apache-2.0 | [LICENSE](https://github.com/modern-go/concurrent/blob/bacd9c7ef1dd/LICENSE) | +| `github.com/modern-go/reflect2` | v1.0.3-0.20250322232337-35a7c28c31ee | Apache-2.0 | [LICENSE](https://github.com/modern-go/reflect2/blob/35a7c28c31ee/LICENSE) | +| `github.com/monochromegane/go-gitignore` | v0.0.0-20200626010858-205db1a8cc00 | MIT | [LICENSE](https://github.com/monochromegane/go-gitignore/blob/205db1a8cc00/LICENSE) | +| `github.com/munnerz/goautoneg` | v0.0.0-20191010083416-a7dc8b61c822 | BSD-3-Clause | [LICENSE](https://github.com/munnerz/goautoneg/blob/a7dc8b61c822/LICENSE) | +| `github.com/opencontainers/cgroups/devices/config` | v0.0.7 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/cgroups/blob/v0.0.7/LICENSE) | +| `github.com/opencontainers/go-digest` | v1.0.0 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE) / [LICENSE.docs](https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE.docs) | +| `github.com/opencontainers/runc/libcontainer/devices` | v1.4.3 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/runc/blob/v1.4.3/LICENSE) / [NOTICE](https://github.com/opencontainers/runc/blob/v1.4.3/NOTICE) | +| `github.com/openshift/api` | v0.0.0-20260727141720-967cc4c36c9b | Apache-2.0 | [LICENSE](https://github.com/openshift/api/blob/967cc4c36c9b/LICENSE) | +| `github.com/openshift/client-go` | v0.0.0-20260723174158-ae2315de9d73 | Apache-2.0 | [LICENSE](https://github.com/openshift/client-go/blob/ae2315de9d73/LICENSE) | +| `github.com/operator-framework/api/pkg` | v0.45.0 | Apache-2.0 | [LICENSE](https://github.com/operator-framework/api/blob/v0.45.0/LICENSE) | +| `github.com/peterbourgon/diskv` | v2.0.1+incompatible | MIT | [LICENSE](https://github.com/peterbourgon/diskv/blob/v2.0.1/LICENSE) | +| `github.com/pmezard/go-difflib/difflib` | v1.0.1-0.20181226105442-5d4384ee4fb2 | BSD-3-Clause | [LICENSE](https://github.com/pmezard/go-difflib/blob/5d4384ee4fb2/LICENSE) | +| `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` | v0.93.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus-operator/prometheus-operator/blob/pkg/apis/monitoring/v0.93.1/LICENSE) | +| `github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil` | v1.24.1 | BSD-3-Clause | [LICENSE](https://github.com/prometheus/client_golang/blob/v1.24.1/internal/github.com/golang/gddo/LICENSE) | +| `github.com/prometheus/client_golang/prometheus` | v1.24.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus/client_golang/blob/v1.24.1/LICENSE) / [NOTICE](https://github.com/prometheus/client_golang/blob/v1.24.1/NOTICE) | +| `github.com/prometheus/client_model/go` | v0.6.2 | Apache-2.0 | [LICENSE](https://github.com/prometheus/client_model/blob/v0.6.2/LICENSE) / [NOTICE](https://github.com/prometheus/client_model/blob/v0.6.2/NOTICE) | +| `github.com/prometheus/common` | v0.70.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus/common/blob/v0.70.1/LICENSE) / [NOTICE](https://github.com/prometheus/common/blob/v0.70.1/NOTICE) | +| `github.com/prometheus/procfs` | v0.21.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus/procfs/blob/v0.21.1/LICENSE) / [NOTICE](https://github.com/prometheus/procfs/blob/v0.21.1/NOTICE) | +| `github.com/regclient/regclient` | v0.11.5 | Apache-2.0 | [LICENSE](https://github.com/regclient/regclient/blob/v0.11.5/LICENSE) | +| `github.com/russross/blackfriday/v2` | v2.1.0 | BSD-2-Clause | [LICENSE.txt](https://github.com/russross/blackfriday/blob/v2.1.0/LICENSE.txt) | +| `github.com/shopspring/decimal` | v1.4.0 | MIT | [LICENSE](https://github.com/shopspring/decimal/blob/v1.4.0/LICENSE) | +| `github.com/sirupsen/logrus` | v1.10.1 | MIT | [LICENSE](https://github.com/sirupsen/logrus/blob/v1.10.1/LICENSE) | +| `github.com/spf13/cast` | v1.7.0 | MIT | [LICENSE](https://github.com/spf13/cast/blob/v1.7.0/LICENSE) | +| `github.com/spf13/cobra` | v1.10.2 | Apache-2.0 | [LICENSE.txt](https://github.com/spf13/cobra/blob/v1.10.2/LICENSE.txt) | +| `github.com/spf13/pflag` | v1.0.10 | BSD-3-Clause | [LICENSE](https://github.com/spf13/pflag/blob/v1.0.10/LICENSE) | +| `github.com/stretchr/testify/assert/yaml` | v1.12.0 | MIT | [LICENSE](https://github.com/stretchr/testify/blob/v1.12.0/LICENSE) | +| `github.com/ulikunitz/xz` | v0.5.15 | BSD-3-Clause | [LICENSE](https://github.com/ulikunitz/xz/blob/v0.5.15/LICENSE) | +| `github.com/urfave/cli/v3` | v3.10.1 | MIT | [LICENSE](https://github.com/urfave/cli/blob/v3.10.1/LICENSE) | +| `github.com/x448/float16` | v0.8.4 | MIT | [LICENSE](https://github.com/x448/float16/blob/v0.8.4/LICENSE) | +| `github.com/xlab/treeprint` | v1.2.0 | MIT | [LICENSE](https://github.com/xlab/treeprint/blob/v1.2.0/LICENSE) | +| `go.uber.org/multierr` | v1.11.0 | MIT | [LICENSE.txt](https://github.com/uber-go/multierr/blob/v1.11.0/LICENSE.txt) | +| `go.uber.org/zap` | v1.28.0 | MIT | [LICENSE](https://github.com/uber-go/zap/blob/v1.28.0/LICENSE) | +| `go.yaml.in/yaml/v2` | v2.4.4 | Apache-2.0 / MIT | [LICENSE](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE) / [LICENSE.libyaml](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE.libyaml) / [NOTICE](https://github.com/yaml/go-yaml/blob/v2.4.4/NOTICE) | +| `go.yaml.in/yaml/v3` | v3.0.4 | Apache-2.0 / MIT | [LICENSE](https://github.com/yaml/go-yaml/blob/v3.0.4/LICENSE) / [NOTICE](https://github.com/yaml/go-yaml/blob/v3.0.4/NOTICE) | +| `golang.org/x/crypto` | v0.55.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE) / [PATENTS](https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/PATENTS) | +| `golang.org/x/mod/semver` | v0.40.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/mod/+/refs/tags/v0.40.0/LICENSE) / [PATENTS](https://go.googlesource.com/mod/+/refs/tags/v0.40.0/PATENTS) | +| `golang.org/x/net` | v0.58.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/net/+/refs/tags/v0.58.0/LICENSE) / [PATENTS](https://go.googlesource.com/net/+/refs/tags/v0.58.0/PATENTS) | +| `golang.org/x/oauth2` | v0.36.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/oauth2/+/refs/tags/v0.36.0/LICENSE) | +| `golang.org/x/sync/errgroup` | v0.22.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/sync/+/refs/tags/v0.22.0/LICENSE) / [PATENTS](https://go.googlesource.com/sync/+/refs/tags/v0.22.0/PATENTS) | +| `golang.org/x/sys/unix` | v0.47.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/sys/+/refs/tags/v0.47.0/LICENSE) / [PATENTS](https://go.googlesource.com/sys/+/refs/tags/v0.47.0/PATENTS) | +| `golang.org/x/term` | v0.45.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/term/+/refs/tags/v0.45.0/LICENSE) / [PATENTS](https://go.googlesource.com/term/+/refs/tags/v0.45.0/PATENTS) | +| `golang.org/x/text` | v0.41.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/text/+/refs/tags/v0.41.0/LICENSE) / [PATENTS](https://go.googlesource.com/text/+/refs/tags/v0.41.0/PATENTS) | +| `golang.org/x/time/rate` | v0.14.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/time/+/refs/tags/v0.14.0/LICENSE) / [PATENTS](https://go.googlesource.com/time/+/refs/tags/v0.14.0/PATENTS) | +| `gomodules.xyz/jsonpatch/v2` | v2.4.0 | Apache-2.0 | [LICENSE](https://github.com/gomodules/jsonpatch/blob/v2.4.0/LICENSE) | +| `google.golang.org/protobuf` | v1.36.12-0.20260120151049-f2248ac996af | BSD-3-Clause | [LICENSE](https://go.googlesource.com/protobuf/+/f2248ac996af/LICENSE) / [PATENTS](https://go.googlesource.com/protobuf/+/f2248ac996af/PATENTS) | +| `gopkg.in/evanphx/json-patch.v4` | v4.13.0 | BSD-3-Clause | [LICENSE](https://github.com/evanphx/json-patch/blob/v4.13.0/LICENSE) | +| `gopkg.in/inf.v0` | v0.9.1 | BSD-3-Clause | [LICENSE](https://github.com/go-inf/inf/blob/v0.9.1/LICENSE) | +| `gopkg.in/yaml.v3` | v3.0.1 | Apache-2.0 / MIT | [LICENSE](https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE) / [NOTICE](https://github.com/go-yaml/yaml/blob/v3.0.1/NOTICE) | +| `k8s.io/api` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/api/blob/v0.36.4/LICENSE) | +| `k8s.io/apiextensions-apiserver/pkg` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/apiextensions-apiserver/blob/v0.36.4/LICENSE) | +| `k8s.io/apimachinery/pkg` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/apimachinery/blob/v0.36.4/LICENSE) | +| `k8s.io/apimachinery/third_party/forked/golang` | v0.36.4 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/LICENSE) / [PATENTS](https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/PATENTS) | +| `k8s.io/cli-runtime/pkg` | v0.36.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/cli-runtime/blob/v0.36.0/LICENSE) | +| `k8s.io/client-go` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/LICENSE) | +| `k8s.io/client-go/third_party/forked/golang/template` | v0.36.4 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/LICENSE) / [PATENTS](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/PATENTS) | +| `k8s.io/client-go/third_party/forked/httpcache` | v0.36.4 | MIT | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/httpcache/LICENSE) | +| `k8s.io/component-base/version` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/component-base/blob/v0.36.4/LICENSE) | +| `k8s.io/klog/v2` | v2.140.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/klog/blob/v2.140.0/LICENSE) | +| `k8s.io/kube-openapi/pkg` | v0.0.0-20260603220949-865597e52e25 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/LICENSE) | +| `k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json` | v0.0.0-20260603220949-865597e52e25 | BSD-3-Clause | [AUTHORS](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/AUTHORS) / [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/LICENSE) | +| `k8s.io/kube-openapi/pkg/validation/spec` | v0.0.0-20260603220949-865597e52e25 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/validation/spec/LICENSE) | +| `k8s.io/kubectl/pkg` | v0.36.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kubectl/blob/v0.36.0/LICENSE) | +| `k8s.io/utils` | v0.0.0-20260507154919-ff6756f316d2 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/LICENSE) | +| `k8s.io/utils/internal/third_party/forked/golang` | v0.0.0-20260507154919-ff6756f316d2 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/LICENSE) / [PATENTS](https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/PATENTS) | +| `k8s.io/utils/third_party/forked/golang/btree` | v0.0.0-20260507154919-ff6756f316d2 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/third_party/forked/golang/btree/LICENSE) | +| `sigs.k8s.io/controller-runtime` | v0.24.1 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/controller-runtime/blob/v0.24.1/LICENSE) | +| `sigs.k8s.io/json` | v0.0.0-20250730193827-2d320260d730 | Apache-2.0 / BSD-3-Clause | [LICENSE](https://github.com/kubernetes-sigs/json/blob/2d320260d730/LICENSE) | +| `sigs.k8s.io/kustomize/api` | v0.21.1 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/kustomize/blob/api/v0.21.1/LICENSE) | +| `sigs.k8s.io/kustomize/kyaml` | v0.21.1 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/kustomize/blob/kyaml/v0.21.1/LICENSE) | +| `sigs.k8s.io/randfill` | v1.0.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/LICENSE) / [NOTICE](https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/NOTICE) | +| `sigs.k8s.io/structured-merge-diff/v6` | v6.4.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/structured-merge-diff/blob/v6.4.0/LICENSE) | +| `sigs.k8s.io/yaml` | v1.6.0 | Apache-2.0 / BSD-3-Clause / MIT | [LICENSE](https://github.com/kubernetes-sigs/yaml/blob/v1.6.0/LICENSE) | ## License Texts ### dario.cat/mergo +* Version: v1.0.1 * License: BSD-3-Clause -* Module: dario.cat/mergo #### LICENSE + + ```text Copyright (c) 2013 Dario Castañé. All rights reserved. Copyright (c) 2012 The Go Authors. All rights reserved. @@ -193,11 +202,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### github.com/MakeNowJust/heredoc +* Version: v1.0.0 * License: MIT -* Module: github.com/MakeNowJust/heredoc #### LICENSE + + ```text The MIT License (MIT) @@ -226,11 +237,13 @@ THE SOFTWARE. ### github.com/Masterminds/goutils +* Version: v1.1.1 * License: Apache-2.0 -* Module: github.com/Masterminds/goutils #### LICENSE.txt + + ```text Apache License @@ -440,11 +453,13 @@ THE SOFTWARE. ### github.com/Masterminds/semver/v3 +* Version: v3.5.0 * License: MIT -* Module: github.com/Masterminds/semver/v3 #### LICENSE.txt + + ```text Copyright (C) 2014-2019, Matt Butcher and Matt Farina @@ -471,11 +486,13 @@ THE SOFTWARE. ### github.com/Masterminds/sprig/v3 +* Version: v3.3.0 * License: MIT -* Module: github.com/Masterminds/sprig/v3 #### LICENSE.txt + + ```text Copyright (C) 2013-2020 Masterminds @@ -502,11 +519,13 @@ THE SOFTWARE. ### github.com/Mellanox/maintenance-operator/api/v1alpha1 +* Version: v0.3.0 * License: Apache-2.0 -* Module: github.com/Mellanox/maintenance-operator/api #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -715,11 +734,13 @@ THE SOFTWARE. ### github.com/NVIDIA/go-nvlib/pkg +* Version: v0.12.0 * License: Apache-2.0 -* Module: github.com/NVIDIA/go-nvlib #### LICENSE + + ```text Apache License @@ -928,6 +949,8 @@ THE SOFTWARE. #### NOTICE + + ```text The file pkg/pciids/default_pci.ids is distributed under the 3-clause BSD License. Maintained by Albert Pool, Martin Mares, and other volunteers from @@ -939,11 +962,13 @@ the PCI ID Project at https://pci-ids.ucw.cz/. ### github.com/NVIDIA/k8s-kata-manager/api/v1alpha1/config +* Version: v0.2.3 * License: Apache-2.0 -* Module: github.com/NVIDIA/k8s-kata-manager #### LICENSE + + ```text Apache License @@ -1153,11 +1178,13 @@ the PCI ID Project at https://pci-ids.ucw.cz/. ### github.com/NVIDIA/k8s-operator-libs +* Version: v0.0.0-20260629200812-d720f2557494 * License: Apache-2.0 -* Module: github.com/NVIDIA/k8s-operator-libs #### LICENSE + + ```text Apache License @@ -1367,11 +1394,13 @@ the PCI ID Project at https://pci-ids.ucw.cz/. ### github.com/NVIDIA/nvidia-container-toolkit +* Version: v1.20.0 * License: Apache-2.0 -* Module: github.com/NVIDIA/nvidia-container-toolkit #### LICENSE + + ```text Apache License @@ -1581,11 +1610,13 @@ the PCI ID Project at https://pci-ids.ucw.cz/. ### github.com/beorn7/perks/quantile +* Version: v1.0.1 * License: MIT -* Module: github.com/beorn7/perks #### LICENSE + + ```text Copyright (C) 2013 Blake Mizerany @@ -1613,11 +1644,13 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ### github.com/blang/semver/v4 +* Version: v4.0.0 * License: MIT -* Module: github.com/blang/semver/v4 #### LICENSE + + ```text The MIT License @@ -1647,11 +1680,13 @@ THE SOFTWARE. ### github.com/cespare/xxhash/v2 +* Version: v2.3.0 * License: MIT -* Module: github.com/cespare/xxhash/v2 #### LICENSE.txt + + ```text Copyright (c) 2016 Caleb Spare @@ -1681,11 +1716,13 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ### github.com/chai2010/gettext-go +* Version: v1.0.2 * License: BSD-3-Clause -* Module: github.com/chai2010/gettext-go #### LICENSE + + ```text Copyright 2013 ChaiShushan . All rights reserved. @@ -1720,11 +1757,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### github.com/cyphar/filepath-securejoin +* Version: v0.7.0 * License: BSD-3-Clause / MPL-2.0 -* Module: github.com/cyphar/filepath-securejoin #### COPYING.md + + ````text ## COPYING ## @@ -2178,6 +2217,8 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice #### LICENSE.BSD + + ```text Copyright (C) 2014-2015 Docker Inc & Go Authors. All rights reserved. Copyright (C) 2017-2024 SUSE LLC. All rights reserved. @@ -2212,6 +2253,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #### LICENSE.MPL-2.0 + + ```text Mozilla Public License Version 2.0 ================================== @@ -2592,11 +2635,13 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice ### github.com/davecgh/go-spew/spew +* Version: v1.1.2-0.20180830191138-d8f796af33cc * License: ISC -* Module: github.com/davecgh/go-spew #### LICENSE + + ```text ISC License @@ -2619,11 +2664,13 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ### github.com/docker/libtrust +* Version: v0.0.0-20160708172513-aabc10ec26b7 * License: Apache-2.0 -* Module: github.com/docker/libtrust #### LICENSE + + ```text Apache License @@ -2822,11 +2869,13 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ### github.com/emicklei/go-restful/v3 +* Version: v3.13.0 * License: MIT -* Module: github.com/emicklei/go-restful/v3 #### LICENSE + + ```text Copyright (c) 2012,2013 Ernest Micklei @@ -2855,11 +2904,13 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ### github.com/evanphx/json-patch/v5 +* Version: v5.9.11 * License: BSD-3-Clause -* Module: github.com/evanphx/json-patch/v5 #### LICENSE + + ```text Copyright (c) 2014, Evan Phoenix All rights reserved. @@ -2892,11 +2943,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### github.com/exponent-io/jsonpath +* Version: v0.0.0-20210407135951-1de76d718b3f * License: MIT -* Module: github.com/exponent-io/jsonpath #### LICENSE + + ```text The MIT License (MIT) @@ -2925,11 +2978,13 @@ SOFTWARE. ### github.com/fsnotify/fsnotify +* Version: v1.9.0 * License: BSD-3-Clause -* Module: github.com/fsnotify/fsnotify #### LICENSE + + ```text Copyright © 2012 The Go Authors. All rights reserved. Copyright © fsnotify Authors. All rights reserved. @@ -2962,11 +3017,13 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### github.com/fxamacker/cbor/v2 +* Version: v2.9.2 * License: MIT -* Module: github.com/fxamacker/cbor/v2 #### LICENSE + + ```text MIT License @@ -2994,11 +3051,13 @@ SOFTWARE. ### github.com/go-errors/errors +* Version: v1.5.1 * License: MIT -* Module: github.com/go-errors/errors #### LICENSE.MIT + + ```text Copyright (c) 2015 Conrad Irwin @@ -3013,11 +3072,13 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI ### github.com/go-logr/logr +* Version: v1.4.4 * License: Apache-2.0 -* Module: github.com/go-logr/logr #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -3226,11 +3287,13 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI ### github.com/go-logr/zapr +* Version: v1.3.0 * License: Apache-2.0 -* Module: github.com/go-logr/zapr #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -3439,11 +3502,13 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI ### github.com/go-openapi/jsonpointer +* Version: v0.22.4 * License: Apache-2.0 -* Module: github.com/go-openapi/jsonpointer #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -3651,6 +3716,8 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI #### NOTICE + + ```text Copyright 2015-2025 go-swagger maintainers @@ -3697,11 +3764,13 @@ limitations under the License. ### github.com/go-openapi/jsonreference +* Version: v0.21.4 * License: Apache-2.0 -* Module: github.com/go-openapi/jsonreference #### LICENSE + + ```text Apache License @@ -3910,6 +3979,8 @@ limitations under the License. #### NOTICE + + ```text Copyright 2015-2025 go-swagger maintainers @@ -3956,11 +4027,13 @@ limitations under the License. ### github.com/go-openapi/swag +* Version: v0.25.4 * License: Apache-2.0 -* Module: github.com/go-openapi/swag #### LICENSE + + ```text Apache License @@ -4170,11 +4243,13 @@ limitations under the License. ### github.com/go-openapi/swag/cmdutils +* Version: v0.25.4 * License: Apache-2.0 -* Module: github.com/go-openapi/swag/cmdutils #### LICENSE + + ```text Apache License @@ -4384,11 +4459,13 @@ limitations under the License. ### github.com/go-openapi/swag/conv +* Version: v0.25.4 * License: Apache-2.0 -* Module: github.com/go-openapi/swag/conv #### LICENSE + + ```text Apache License @@ -4598,11 +4675,13 @@ limitations under the License. ### github.com/go-openapi/swag/fileutils +* Version: v0.25.4 * License: Apache-2.0 -* Module: github.com/go-openapi/swag/fileutils #### LICENSE + + ```text Apache License @@ -4812,11 +4891,13 @@ limitations under the License. ### github.com/go-openapi/swag/jsonname +* Version: v0.25.4 * License: Apache-2.0 -* Module: github.com/go-openapi/swag/jsonname #### LICENSE + + ```text Apache License @@ -5026,11 +5107,13 @@ limitations under the License. ### github.com/go-openapi/swag/jsonutils +* Version: v0.25.4 * License: Apache-2.0 -* Module: github.com/go-openapi/swag/jsonutils #### LICENSE + + ```text Apache License @@ -5240,11 +5323,13 @@ limitations under the License. ### github.com/go-openapi/swag/loading +* Version: v0.25.4 * License: Apache-2.0 -* Module: github.com/go-openapi/swag/loading #### LICENSE + + ```text Apache License @@ -5454,11 +5539,13 @@ limitations under the License. ### github.com/go-openapi/swag/mangling +* Version: v0.25.4 * License: Apache-2.0 -* Module: github.com/go-openapi/swag/mangling #### LICENSE + + ```text Apache License @@ -5668,11 +5755,13 @@ limitations under the License. ### github.com/go-openapi/swag/netutils +* Version: v0.25.4 * License: Apache-2.0 -* Module: github.com/go-openapi/swag/netutils #### LICENSE + + ```text Apache License @@ -5882,11 +5971,13 @@ limitations under the License. ### github.com/go-openapi/swag/stringutils +* Version: v0.25.4 * License: Apache-2.0 -* Module: github.com/go-openapi/swag/stringutils #### LICENSE + + ```text Apache License @@ -6096,11 +6187,13 @@ limitations under the License. ### github.com/go-openapi/swag/typeutils +* Version: v0.25.4 * License: Apache-2.0 -* Module: github.com/go-openapi/swag/typeutils #### LICENSE + + ```text Apache License @@ -6310,11 +6403,13 @@ limitations under the License. ### github.com/go-openapi/swag/yamlutils +* Version: v0.25.4 * License: Apache-2.0 -* Module: github.com/go-openapi/swag/yamlutils #### LICENSE + + ```text Apache License @@ -6524,11 +6619,13 @@ limitations under the License. ### github.com/google/btree +* Version: v1.1.3 * License: Apache-2.0 -* Module: github.com/google/btree #### LICENSE + + ```text Apache License @@ -6738,11 +6835,13 @@ limitations under the License. ### github.com/google/gnostic-models +* Version: v0.7.1 * License: Apache-2.0 -* Module: github.com/google/gnostic-models #### LICENSE + + ```text Apache License @@ -6953,11 +7052,13 @@ limitations under the License. ### github.com/google/uuid +* Version: v1.6.0 * License: BSD-3-Clause -* Module: github.com/google/uuid #### LICENSE + + ```text Copyright (c) 2009,2014 Google Inc. All rights reserved. @@ -6992,11 +7093,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### github.com/huandu/xstrings +* Version: v1.5.0 * License: MIT -* Module: github.com/huandu/xstrings #### LICENSE + + ```text The MIT License (MIT) @@ -7026,11 +7129,13 @@ SOFTWARE. ### github.com/json-iterator/go +* Version: v1.1.12 * License: MIT -* Module: github.com/json-iterator/go #### LICENSE + + ```text MIT License @@ -7059,11 +7164,13 @@ SOFTWARE. ### github.com/klauspost/compress +* Version: v1.19.1 * License: Apache-2.0 / BSD-3-Clause / MIT -* Module: github.com/klauspost/compress #### LICENSE + + ```text Copyright (c) 2012 The Go Authors. All rights reserved. Copyright (c) 2019 Klaus Post. All rights reserved. @@ -7375,11 +7482,13 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI ### github.com/klauspost/compress/internal/snapref +* Version: v1.19.1 * License: BSD-3-Clause -* Module: github.com/klauspost/compress #### LICENSE + + ```text Copyright (c) 2011 The Snappy-Go Authors. All rights reserved. @@ -7414,11 +7523,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### github.com/klauspost/compress/zstd/internal/xxhash +* Version: v1.19.1 * License: MIT -* Module: github.com/klauspost/compress #### LICENSE.txt + + ```text Copyright (c) 2016 Caleb Spare @@ -7448,11 +7559,13 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ### github.com/liggitt/tabwriter +* Version: v0.0.0-20181228230101-89fcab3d43de * License: BSD-3-Clause -* Module: github.com/liggitt/tabwriter #### LICENSE + + ```text Copyright (c) 2009 The Go Authors. All rights reserved. @@ -7487,11 +7600,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### github.com/mitchellh/copystructure +* Version: v1.2.0 * License: MIT -* Module: github.com/mitchellh/copystructure #### LICENSE + + ```text The MIT License (MIT) @@ -7520,11 +7635,13 @@ THE SOFTWARE. ### github.com/mitchellh/go-wordwrap +* Version: v1.0.1 * License: MIT -* Module: github.com/mitchellh/go-wordwrap #### LICENSE.md + + ```text The MIT License (MIT) @@ -7553,11 +7670,13 @@ THE SOFTWARE. ### github.com/mitchellh/reflectwalk +* Version: v1.0.2 * License: MIT -* Module: github.com/mitchellh/reflectwalk #### LICENSE + + ```text The MIT License (MIT) @@ -7586,11 +7705,13 @@ THE SOFTWARE. ### github.com/moby/term +* Version: v0.5.2 * License: Apache-2.0 -* Module: github.com/moby/term #### LICENSE + + ```text Apache License @@ -7789,11 +7910,13 @@ THE SOFTWARE. ### github.com/modern-go/concurrent +* Version: v0.0.0-20180306012644-bacd9c7ef1dd * License: Apache-2.0 -* Module: github.com/modern-go/concurrent #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -8002,11 +8125,13 @@ THE SOFTWARE. ### github.com/modern-go/reflect2 +* Version: v1.0.3-0.20250322232337-35a7c28c31ee * License: Apache-2.0 -* Module: github.com/modern-go/reflect2 #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -8215,11 +8340,13 @@ THE SOFTWARE. ### github.com/monochromegane/go-gitignore +* Version: v0.0.0-20200626010858-205db1a8cc00 * License: MIT -* Module: github.com/monochromegane/go-gitignore #### LICENSE + + ```text The MIT License (MIT) @@ -8248,11 +8375,13 @@ SOFTWARE. ### github.com/munnerz/goautoneg +* Version: v0.0.0-20191010083416-a7dc8b61c822 * License: BSD-3-Clause -* Module: github.com/munnerz/goautoneg #### LICENSE + + ```text Copyright (c) 2011, Open Knowledge Foundation Ltd. All rights reserved. @@ -8291,11 +8420,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### github.com/opencontainers/cgroups/devices/config +* Version: v0.0.7 * License: Apache-2.0 -* Module: github.com/opencontainers/cgroups #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -8504,11 +8635,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### github.com/opencontainers/go-digest +* Version: v1.0.0 * License: Apache-2.0 -* Module: github.com/opencontainers/go-digest #### LICENSE + + ```text Apache License @@ -8705,14 +8838,449 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` +#### LICENSE.docs + + + +```text +Attribution-ShareAlike 4.0 International + +======================================================================= + +Creative Commons Corporation ("Creative Commons") is not a law firm and +does not provide legal services or legal advice. Distribution of +Creative Commons public licenses does not create a lawyer-client or +other relationship. Creative Commons makes its licenses and related +information available on an "as-is" basis. Creative Commons gives no +warranties regarding its licenses, any material licensed under their +terms and conditions, or any related information. Creative Commons +disclaims all liability for damages resulting from their use to the +fullest extent possible. + +Using Creative Commons Public Licenses + +Creative Commons public licenses provide a standard set of terms and +conditions that creators and other rights holders may use to share +original works of authorship and other material subject to copyright +and certain other rights specified in the public license below. The +following considerations are for informational purposes only, are not +exhaustive, and do not form part of our licenses. + + Considerations for licensors: Our public licenses are + intended for use by those authorized to give the public + permission to use material in ways otherwise restricted by + copyright and certain other rights. Our licenses are + irrevocable. Licensors should read and understand the terms + and conditions of the license they choose before applying it. + Licensors should also secure all rights necessary before + applying our licenses so that the public can reuse the + material as expected. Licensors should clearly mark any + material not subject to the license. This includes other CC- + licensed material, or material used under an exception or + limitation to copyright. More considerations for licensors: + wiki.creativecommons.org/Considerations_for_licensors + + Considerations for the public: By using one of our public + licenses, a licensor grants the public permission to use the + licensed material under specified terms and conditions. If + the licensor's permission is not necessary for any reason--for + example, because of any applicable exception or limitation to + copyright--then that use is not regulated by the license. Our + licenses grant only permissions under copyright and certain + other rights that a licensor has authority to grant. Use of + the licensed material may still be restricted for other + reasons, including because others have copyright or other + rights in the material. A licensor may make special requests, + such as asking that all changes be marked or described. + Although not required by our licenses, you are encouraged to + respect those requests where reasonable. More_considerations + for the public: + wiki.creativecommons.org/Considerations_for_licensees + +======================================================================= + +Creative Commons Attribution-ShareAlike 4.0 International Public +License + +By exercising the Licensed Rights (defined below), You accept and agree +to be bound by the terms and conditions of this Creative Commons +Attribution-ShareAlike 4.0 International Public License ("Public +License"). To the extent this Public License may be interpreted as a +contract, You are granted the Licensed Rights in consideration of Your +acceptance of these terms and conditions, and the Licensor grants You +such rights in consideration of benefits the Licensor receives from +making the Licensed Material available under these terms and +conditions. + + +Section 1 -- Definitions. + + a. Adapted Material means material subject to Copyright and Similar + Rights that is derived from or based upon the Licensed Material + and in which the Licensed Material is translated, altered, + arranged, transformed, or otherwise modified in a manner requiring + permission under the Copyright and Similar Rights held by the + Licensor. For purposes of this Public License, where the Licensed + Material is a musical work, performance, or sound recording, + Adapted Material is always produced where the Licensed Material is + synched in timed relation with a moving image. + + b. Adapter's License means the license You apply to Your Copyright + and Similar Rights in Your contributions to Adapted Material in + accordance with the terms and conditions of this Public License. + + c. BY-SA Compatible License means a license listed at + creativecommons.org/compatiblelicenses, approved by Creative + Commons as essentially the equivalent of this Public License. + + d. Copyright and Similar Rights means copyright and/or similar rights + closely related to copyright including, without limitation, + performance, broadcast, sound recording, and Sui Generis Database + Rights, without regard to how the rights are labeled or + categorized. For purposes of this Public License, the rights + specified in Section 2(b)(1)-(2) are not Copyright and Similar + Rights. + + e. Effective Technological Measures means those measures that, in the + absence of proper authority, may not be circumvented under laws + fulfilling obligations under Article 11 of the WIPO Copyright + Treaty adopted on December 20, 1996, and/or similar international + agreements. + + f. Exceptions and Limitations means fair use, fair dealing, and/or + any other exception or limitation to Copyright and Similar Rights + that applies to Your use of the Licensed Material. + + g. License Elements means the license attributes listed in the name + of a Creative Commons Public License. The License Elements of this + Public License are Attribution and ShareAlike. + + h. Licensed Material means the artistic or literary work, database, + or other material to which the Licensor applied this Public + License. + + i. Licensed Rights means the rights granted to You subject to the + terms and conditions of this Public License, which are limited to + all Copyright and Similar Rights that apply to Your use of the + Licensed Material and that the Licensor has authority to license. + + j. Licensor means the individual(s) or entity(ies) granting rights + under this Public License. + + k. Share means to provide material to the public by any means or + process that requires permission under the Licensed Rights, such + as reproduction, public display, public performance, distribution, + dissemination, communication, or importation, and to make material + available to the public including in ways that members of the + public may access the material from a place and at a time + individually chosen by them. + + l. Sui Generis Database Rights means rights other than copyright + resulting from Directive 96/9/EC of the European Parliament and of + the Council of 11 March 1996 on the legal protection of databases, + as amended and/or succeeded, as well as other essentially + equivalent rights anywhere in the world. + + m. You means the individual or entity exercising the Licensed Rights + under this Public License. Your has a corresponding meaning. + + +Section 2 -- Scope. + + a. License grant. + + 1. Subject to the terms and conditions of this Public License, + the Licensor hereby grants You a worldwide, royalty-free, + non-sublicensable, non-exclusive, irrevocable license to + exercise the Licensed Rights in the Licensed Material to: + + a. reproduce and Share the Licensed Material, in whole or + in part; and + + b. produce, reproduce, and Share Adapted Material. + + 2. Exceptions and Limitations. For the avoidance of doubt, where + Exceptions and Limitations apply to Your use, this Public + License does not apply, and You do not need to comply with + its terms and conditions. + + 3. Term. The term of this Public License is specified in Section + 6(a). + + 4. Media and formats; technical modifications allowed. The + Licensor authorizes You to exercise the Licensed Rights in + all media and formats whether now known or hereafter created, + and to make technical modifications necessary to do so. The + Licensor waives and/or agrees not to assert any right or + authority to forbid You from making technical modifications + necessary to exercise the Licensed Rights, including + technical modifications necessary to circumvent Effective + Technological Measures. For purposes of this Public License, + simply making modifications authorized by this Section 2(a) + (4) never produces Adapted Material. + + 5. Downstream recipients. + + a. Offer from the Licensor -- Licensed Material. Every + recipient of the Licensed Material automatically + receives an offer from the Licensor to exercise the + Licensed Rights under the terms and conditions of this + Public License. + + b. Additional offer from the Licensor -- Adapted Material. + Every recipient of Adapted Material from You + automatically receives an offer from the Licensor to + exercise the Licensed Rights in the Adapted Material + under the conditions of the Adapter's License You apply. + + c. No downstream restrictions. You may not offer or impose + any additional or different terms or conditions on, or + apply any Effective Technological Measures to, the + Licensed Material if doing so restricts exercise of the + Licensed Rights by any recipient of the Licensed + Material. + + 6. No endorsement. Nothing in this Public License constitutes or + may be construed as permission to assert or imply that You + are, or that Your use of the Licensed Material is, connected + with, or sponsored, endorsed, or granted official status by, + the Licensor or others designated to receive attribution as + provided in Section 3(a)(1)(A)(i). + + b. Other rights. + + 1. Moral rights, such as the right of integrity, are not + licensed under this Public License, nor are publicity, + privacy, and/or other similar personality rights; however, to + the extent possible, the Licensor waives and/or agrees not to + assert any such rights held by the Licensor to the limited + extent necessary to allow You to exercise the Licensed + Rights, but not otherwise. + + 2. Patent and trademark rights are not licensed under this + Public License. + + 3. To the extent possible, the Licensor waives any right to + collect royalties from You for the exercise of the Licensed + Rights, whether directly or through a collecting society + under any voluntary or waivable statutory or compulsory + licensing scheme. In all other cases the Licensor expressly + reserves any right to collect such royalties. + + +Section 3 -- License Conditions. + +Your exercise of the Licensed Rights is expressly made subject to the +following conditions. + + a. Attribution. + + 1. If You Share the Licensed Material (including in modified + form), You must: + + a. retain the following if it is supplied by the Licensor + with the Licensed Material: + + i. identification of the creator(s) of the Licensed + Material and any others designated to receive + attribution, in any reasonable manner requested by + the Licensor (including by pseudonym if + designated); + + ii. a copyright notice; + + iii. a notice that refers to this Public License; + + iv. a notice that refers to the disclaimer of + warranties; + + v. a URI or hyperlink to the Licensed Material to the + extent reasonably practicable; + + b. indicate if You modified the Licensed Material and + retain an indication of any previous modifications; and + + c. indicate the Licensed Material is licensed under this + Public License, and include the text of, or the URI or + hyperlink to, this Public License. + + 2. You may satisfy the conditions in Section 3(a)(1) in any + reasonable manner based on the medium, means, and context in + which You Share the Licensed Material. For example, it may be + reasonable to satisfy the conditions by providing a URI or + hyperlink to a resource that includes the required + information. + + 3. If requested by the Licensor, You must remove any of the + information required by Section 3(a)(1)(A) to the extent + reasonably practicable. + + b. ShareAlike. + + In addition to the conditions in Section 3(a), if You Share + Adapted Material You produce, the following conditions also apply. + + 1. The Adapter's License You apply must be a Creative Commons + license with the same License Elements, this version or + later, or a BY-SA Compatible License. + + 2. You must include the text of, or the URI or hyperlink to, the + Adapter's License You apply. You may satisfy this condition + in any reasonable manner based on the medium, means, and + context in which You Share Adapted Material. + + 3. You may not offer or impose any additional or different terms + or conditions on, or apply any Effective Technological + Measures to, Adapted Material that restrict exercise of the + rights granted under the Adapter's License You apply. + + +Section 4 -- Sui Generis Database Rights. + +Where the Licensed Rights include Sui Generis Database Rights that +apply to Your use of the Licensed Material: + + a. for the avoidance of doubt, Section 2(a)(1) grants You the right + to extract, reuse, reproduce, and Share all or a substantial + portion of the contents of the database; + + b. if You include all or a substantial portion of the database + contents in a database in which You have Sui Generis Database + Rights, then the database in which You have Sui Generis Database + Rights (but not its individual contents) is Adapted Material, + + including for purposes of Section 3(b); and + c. You must comply with the conditions in Section 3(a) if You Share + all or a substantial portion of the contents of the database. + +For the avoidance of doubt, this Section 4 supplements and does not +replace Your obligations under this Public License where the Licensed +Rights include other Copyright and Similar Rights. + + +Section 5 -- Disclaimer of Warranties and Limitation of Liability. + + a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE + EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS + AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF + ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS, + IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION, + WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR + PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS, + ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT + KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT + ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU. + + b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE + TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION, + NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT, + INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES, + COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR + USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN + ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR + DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR + IN PART, THIS LIMITATION MAY NOT APPLY TO YOU. + + c. The disclaimer of warranties and limitation of liability provided + above shall be interpreted in a manner that, to the extent + possible, most closely approximates an absolute disclaimer and + waiver of all liability. + + +Section 6 -- Term and Termination. + + a. This Public License applies for the term of the Copyright and + Similar Rights licensed here. However, if You fail to comply with + this Public License, then Your rights under this Public License + terminate automatically. + + b. Where Your right to use the Licensed Material has terminated under + Section 6(a), it reinstates: + + 1. automatically as of the date the violation is cured, provided + it is cured within 30 days of Your discovery of the + violation; or + + 2. upon express reinstatement by the Licensor. + + For the avoidance of doubt, this Section 6(b) does not affect any + right the Licensor may have to seek remedies for Your violations + of this Public License. + + c. For the avoidance of doubt, the Licensor may also offer the + Licensed Material under separate terms or conditions or stop + distributing the Licensed Material at any time; however, doing so + will not terminate this Public License. + + d. Sections 1, 5, 6, 7, and 8 survive termination of this Public + License. + + +Section 7 -- Other Terms and Conditions. + + a. The Licensor shall not be bound by any additional or different + terms or conditions communicated by You unless expressly agreed. + + b. Any arrangements, understandings, or agreements regarding the + Licensed Material not stated herein are separate from and + independent of the terms and conditions of this Public License. + + +Section 8 -- Interpretation. + + a. For the avoidance of doubt, this Public License does not, and + shall not be interpreted to, reduce, limit, restrict, or impose + conditions on any use of the Licensed Material that could lawfully + be made without permission under this Public License. + + b. To the extent possible, if any provision of this Public License is + deemed unenforceable, it shall be automatically reformed to the + minimum extent necessary to make it enforceable. If the provision + cannot be reformed, it shall be severed from this Public License + without affecting the enforceability of the remaining terms and + conditions. + + c. No term or condition of this Public License will be waived and no + failure to comply consented to unless expressly agreed to by the + Licensor. + + d. Nothing in this Public License constitutes or may be interpreted + as a limitation upon, or waiver of, any privileges and immunities + that apply to the Licensor or You, including from the legal + processes of any jurisdiction or authority. + + +======================================================================= + +Creative Commons is not a party to its public licenses. +Notwithstanding, Creative Commons may elect to apply one of its public +licenses to material it publishes and in those instances will be +considered the "Licensor." Except for the limited purpose of indicating +that material is shared under a Creative Commons public license or as +otherwise permitted by the Creative Commons policies published at +creativecommons.org/policies, Creative Commons does not authorize the +use of the trademark "Creative Commons" or any other trademark or logo +of Creative Commons without its prior written consent including, +without limitation, in connection with any unauthorized modifications +to any of its public licenses or any other arrangements, +understandings, or agreements concerning use of licensed material. For +the avoidance of doubt, this paragraph does not form part of the public +licenses. + +Creative Commons may be contacted at creativecommons.org. + +``` + ### github.com/opencontainers/runc/libcontainer/devices +* Version: v1.4.3 * License: Apache-2.0 -* Module: github.com/opencontainers/runc #### LICENSE + + ```text Apache License @@ -8910,6 +9478,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #### NOTICE + + ```text runc @@ -8934,11 +9504,13 @@ See also http://www.apache.org/dev/crypto.html and/or seek legal counsel. ### github.com/openshift/api +* Version: v0.0.0-20260727141720-967cc4c36c9b * License: Apache-2.0 -* Module: github.com/openshift/api #### LICENSE + + ```text Apache License @@ -9137,11 +9709,13 @@ See also http://www.apache.org/dev/crypto.html and/or seek legal counsel. ### github.com/openshift/client-go +* Version: v0.0.0-20260723174158-ae2315de9d73 * License: Apache-2.0 -* Module: github.com/openshift/client-go #### LICENSE + + ```text Apache License @@ -9340,11 +9914,13 @@ See also http://www.apache.org/dev/crypto.html and/or seek legal counsel. ### github.com/operator-framework/api/pkg +* Version: v0.45.0 * License: Apache-2.0 -* Module: github.com/operator-framework/api #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -9553,11 +10129,13 @@ See also http://www.apache.org/dev/crypto.html and/or seek legal counsel. ### github.com/peterbourgon/diskv +* Version: v2.0.1+incompatible * License: MIT -* Module: github.com/peterbourgon/diskv #### LICENSE + + ```text Copyright (c) 2011-2012 Peter Bourgon @@ -9584,11 +10162,13 @@ THE SOFTWARE. ### github.com/pmezard/go-difflib/difflib +* Version: v1.0.1-0.20181226105442-5d4384ee4fb2 * License: BSD-3-Clause -* Module: github.com/pmezard/go-difflib #### LICENSE + + ```text Copyright (c) 2013, Patrick Mezard All rights reserved. @@ -9623,11 +10203,13 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring +* Version: v0.93.1 * License: Apache-2.0 -* Module: github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -9836,11 +10418,13 @@ Apache License ### github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil +* Version: v1.24.1 * License: BSD-3-Clause -* Module: github.com/prometheus/client_golang #### LICENSE + + ```text Copyright (c) 2013 The Go Authors. All rights reserved. @@ -9875,11 +10459,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### github.com/prometheus/client_golang/prometheus +* Version: v1.24.1 * License: Apache-2.0 -* Module: github.com/prometheus/client_golang #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -10087,6 +10673,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #### NOTICE + + ```text Prometheus instrumentation library for Go applications Copyright 2012-2015 The Prometheus Authors @@ -10112,11 +10700,13 @@ See source code for license details. ### github.com/prometheus/client_model/go +* Version: v0.6.2 * License: Apache-2.0 -* Module: github.com/prometheus/client_model #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -10324,6 +10914,8 @@ See source code for license details. #### NOTICE + + ```text Data model artifacts for Prometheus. Copyright 2012-2015 The Prometheus Authors @@ -10336,11 +10928,13 @@ SoundCloud Ltd. (http://soundcloud.com/). ### github.com/prometheus/common +* Version: v0.70.1 * License: Apache-2.0 -* Module: github.com/prometheus/common #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -10548,6 +11142,8 @@ SoundCloud Ltd. (http://soundcloud.com/). #### NOTICE + + ```text Common libraries shared by Prometheus Go components. Copyright 2015 The Prometheus Authors @@ -10560,11 +11156,13 @@ SoundCloud Ltd. (http://soundcloud.com/). ### github.com/prometheus/procfs +* Version: v0.21.1 * License: Apache-2.0 -* Module: github.com/prometheus/procfs #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -10772,6 +11370,8 @@ SoundCloud Ltd. (http://soundcloud.com/). #### NOTICE + + ```text procfs provides functions to retrieve system, kernel and process metrics from the pseudo-filesystem proc. @@ -10786,11 +11386,13 @@ SoundCloud Ltd. (http://soundcloud.com/). ### github.com/regclient/regclient +* Version: v0.11.5 * License: Apache-2.0 -* Module: github.com/regclient/regclient #### LICENSE + + ```text Apache License @@ -10989,11 +11591,13 @@ SoundCloud Ltd. (http://soundcloud.com/). ### github.com/russross/blackfriday/v2 +* Version: v2.1.0 * License: BSD-2-Clause -* Module: github.com/russross/blackfriday/v2 #### LICENSE.txt + + ```text Blackfriday is distributed under the Simplified BSD License: @@ -11030,11 +11634,13 @@ Blackfriday is distributed under the Simplified BSD License: ### github.com/shopspring/decimal +* Version: v1.4.0 * License: MIT -* Module: github.com/shopspring/decimal #### LICENSE + + ```text The MIT License (MIT) @@ -11087,11 +11693,13 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ### github.com/sirupsen/logrus +* Version: v1.10.1 * License: MIT -* Module: github.com/sirupsen/logrus #### LICENSE + + ```text The MIT License (MIT) @@ -11120,11 +11728,13 @@ THE SOFTWARE. ### github.com/spf13/cast +* Version: v1.7.0 * License: MIT -* Module: github.com/spf13/cast #### LICENSE + + ```text The MIT License (MIT) @@ -11152,11 +11762,13 @@ SOFTWARE. ### github.com/spf13/cobra +* Version: v1.10.2 * License: Apache-2.0 -* Module: github.com/spf13/cobra #### LICENSE.txt + + ```text Apache License Version 2.0, January 2004 @@ -11338,11 +11950,13 @@ SOFTWARE. ### github.com/spf13/pflag +* Version: v1.0.10 * License: BSD-3-Clause -* Module: github.com/spf13/pflag #### LICENSE + + ```text Copyright (c) 2012 Alex Ogier. All rights reserved. Copyright (c) 2012 The Go Authors. All rights reserved. @@ -11378,11 +11992,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### github.com/stretchr/testify/assert/yaml +* Version: v1.12.0 * License: MIT -* Module: github.com/stretchr/testify #### LICENSE + + ```text MIT License @@ -11411,11 +12027,13 @@ SOFTWARE. ### github.com/ulikunitz/xz +* Version: v0.5.15 * License: BSD-3-Clause -* Module: github.com/ulikunitz/xz #### LICENSE + + ```text Copyright (c) 2014-2022 Ulrich Kunitz All rights reserved. @@ -11449,11 +12067,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### github.com/urfave/cli/v3 +* Version: v3.10.1 * License: MIT -* Module: github.com/urfave/cli/v3 #### LICENSE + + ```text MIT License @@ -11482,11 +12102,13 @@ SOFTWARE. ### github.com/x448/float16 +* Version: v0.8.4 * License: MIT -* Module: github.com/x448/float16 #### LICENSE + + ```text MIT License @@ -11516,11 +12138,13 @@ SOFTWARE. ### github.com/xlab/treeprint +* Version: v1.2.0 * License: MIT -* Module: github.com/xlab/treeprint #### LICENSE + + ```text The MIT License (MIT) Copyright © 2016 Maxim Kupriianov @@ -11548,11 +12172,13 @@ THE SOFTWARE. ### go.uber.org/multierr +* Version: v1.11.0 * License: MIT -* Module: go.uber.org/multierr #### LICENSE.txt + + ```text Copyright (c) 2017-2021 Uber Technologies, Inc. @@ -11579,11 +12205,13 @@ THE SOFTWARE. ### go.uber.org/zap +* Version: v1.28.0 * License: MIT -* Module: go.uber.org/zap #### LICENSE + + ```text Copyright (c) 2016-2024 Uber Technologies, Inc. @@ -11610,11 +12238,13 @@ THE SOFTWARE. ### go.yaml.in/yaml/v2 -* License: Apache-2.0 -* Module: go.yaml.in/yaml/v2 +* Version: v2.4.4 +* License: Apache-2.0 / MIT #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -11820,8 +12450,49 @@ THE SOFTWARE. ``` +#### LICENSE.libyaml + + + +```text +The following files were ported to Go from C files of libyaml, and thus +are still covered by their original copyright and license: + + apic.go + emitterc.go + parserc.go + readerc.go + scannerc.go + writerc.go + yamlh.go + yamlprivateh.go + +Copyright (c) 2006 Kirill Simonov + +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the "Software"), to deal in +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies +of the Software, and to permit persons to whom the Software is furnished to do +so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +``` + #### NOTICE + + ```text Copyright 2011-2016 Canonical Ltd. @@ -11842,11 +12513,13 @@ limitations under the License. ### go.yaml.in/yaml/v3 -* License: MIT -* Module: go.yaml.in/yaml/v3 +* Version: v3.0.4 +* License: Apache-2.0 / MIT #### LICENSE + + ```text This project is covered by two different licenses: MIT and Apache. @@ -11903,6 +12576,8 @@ limitations under the License. #### NOTICE + + ```text Copyright 2011-2016 Canonical Ltd. @@ -11923,11 +12598,13 @@ limitations under the License. ### golang.org/x/crypto +* Version: v0.55.0 * License: BSD-3-Clause -* Module: golang.org/x/crypto #### LICENSE + + ```text Copyright 2009 The Go Authors. @@ -11959,14 +12636,46 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` +#### PATENTS + + + +```text +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + +``` + ### golang.org/x/mod/semver +* Version: v0.40.0 * License: BSD-3-Clause -* Module: golang.org/x/mod #### LICENSE + + ```text Copyright 2009 The Go Authors. @@ -11998,14 +12707,46 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` +#### PATENTS + + + +```text +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + +``` + ### golang.org/x/net +* Version: v0.58.0 * License: BSD-3-Clause -* Module: golang.org/x/net #### LICENSE + + ```text Copyright 2009 The Go Authors. @@ -12037,14 +12778,46 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` +#### PATENTS + + + +```text +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + +``` + ### golang.org/x/oauth2 +* Version: v0.36.0 * License: BSD-3-Clause -* Module: golang.org/x/oauth2 #### LICENSE + + ```text Copyright 2009 The Go Authors. @@ -12079,11 +12852,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### golang.org/x/sync/errgroup +* Version: v0.22.0 * License: BSD-3-Clause -* Module: golang.org/x/sync #### LICENSE + + ```text Copyright 2009 The Go Authors. @@ -12115,14 +12890,46 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` +#### PATENTS + + + +```text +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + +``` + ### golang.org/x/sys/unix +* Version: v0.47.0 * License: BSD-3-Clause -* Module: golang.org/x/sys #### LICENSE + + ```text Copyright 2009 The Go Authors. @@ -12154,14 +12961,46 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` +#### PATENTS + + + +```text +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + +``` + ### golang.org/x/term +* Version: v0.45.0 * License: BSD-3-Clause -* Module: golang.org/x/term #### LICENSE + + ```text Copyright 2009 The Go Authors. @@ -12193,14 +13032,46 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` +#### PATENTS + + + +```text +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + +``` + ### golang.org/x/text +* Version: v0.41.0 * License: BSD-3-Clause -* Module: golang.org/x/text #### LICENSE + + ```text Copyright 2009 The Go Authors. @@ -12232,14 +13103,46 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` +#### PATENTS + + + +```text +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + +``` + ### golang.org/x/time/rate +* Version: v0.14.0 * License: BSD-3-Clause -* Module: golang.org/x/time #### LICENSE + + ```text Copyright 2009 The Go Authors. @@ -12271,14 +13174,46 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` +#### PATENTS + + + +```text +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + +``` + ### gomodules.xyz/jsonpatch/v2 +* Version: v2.4.0 * License: Apache-2.0 -* Module: gomodules.xyz/jsonpatch/v2 #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -12488,11 +13423,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### google.golang.org/protobuf +* Version: v1.36.12-0.20260120151049-f2248ac996af * License: BSD-3-Clause -* Module: google.golang.org/protobuf #### LICENSE + + ```text Copyright (c) 2018 The Go Authors. All rights reserved. @@ -12524,14 +13461,46 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` +#### PATENTS + + + +```text +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + +``` + ### gopkg.in/evanphx/json-patch.v4 +* Version: v4.13.0 * License: BSD-3-Clause -* Module: gopkg.in/evanphx/json-patch.v4 #### LICENSE + + ```text Copyright (c) 2014, Evan Phoenix All rights reserved. @@ -12564,11 +13533,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### gopkg.in/inf.v0 +* Version: v0.9.1 * License: BSD-3-Clause -* Module: gopkg.in/inf.v0 #### LICENSE + + ```text Copyright (c) 2012 Péter Surányi. Portions Copyright (c) 2009 The Go Authors. All rights reserved. @@ -12604,11 +13575,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### gopkg.in/yaml.v3 -* License: MIT -* Module: gopkg.in/yaml.v3 +* Version: v3.0.1 +* License: Apache-2.0 / MIT #### LICENSE + + ```text This project is covered by two different licenses: MIT and Apache. @@ -12665,6 +13638,8 @@ limitations under the License. #### NOTICE + + ```text Copyright 2011-2016 Canonical Ltd. @@ -12685,11 +13660,13 @@ limitations under the License. ### k8s.io/api +* Version: v0.36.4 * License: Apache-2.0 -* Module: k8s.io/api #### LICENSE + + ```text Apache License @@ -12899,11 +13876,13 @@ limitations under the License. ### k8s.io/apiextensions-apiserver/pkg +* Version: v0.36.4 * License: Apache-2.0 -* Module: k8s.io/apiextensions-apiserver #### LICENSE + + ```text Apache License @@ -13113,11 +14092,13 @@ limitations under the License. ### k8s.io/apimachinery/pkg +* Version: v0.36.4 * License: Apache-2.0 -* Module: k8s.io/apimachinery #### LICENSE + + ```text Apache License @@ -13327,11 +14308,13 @@ limitations under the License. ### k8s.io/apimachinery/third_party/forked/golang +* Version: v0.36.4 * License: BSD-3-Clause -* Module: k8s.io/apimachinery #### LICENSE + + ```text Copyright (c) 2009 The Go Authors. All rights reserved. @@ -13363,14 +14346,46 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` +#### PATENTS + + + +```text +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + +``` + ### k8s.io/cli-runtime/pkg +* Version: v0.36.0 * License: Apache-2.0 -* Module: k8s.io/cli-runtime #### LICENSE + + ```text Apache License @@ -13580,11 +14595,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### k8s.io/client-go +* Version: v0.36.4 * License: Apache-2.0 -* Module: k8s.io/client-go #### LICENSE + + ```text Apache License @@ -13794,11 +14811,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### k8s.io/client-go/third_party/forked/golang/template +* Version: v0.36.4 * License: BSD-3-Clause -* Module: k8s.io/client-go #### LICENSE + + ```text Copyright (c) 2009 The Go Authors. All rights reserved. @@ -13830,14 +14849,46 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` +#### PATENTS + + + +```text +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + +``` + ### k8s.io/client-go/third_party/forked/httpcache +* Version: v0.36.4 * License: MIT -* Module: k8s.io/client-go #### LICENSE + + ```text Copyright © 2012 Greg Jones (greg.jones@gmail.com) @@ -13851,11 +14902,13 @@ THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR I ### k8s.io/component-base/version +* Version: v0.36.4 * License: Apache-2.0 -* Module: k8s.io/component-base #### LICENSE + + ```text Apache License @@ -14065,11 +15118,13 @@ THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR I ### k8s.io/klog/v2 +* Version: v2.140.0 * License: Apache-2.0 -* Module: k8s.io/klog/v2 #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -14268,11 +15323,13 @@ third-party archives. ### k8s.io/kube-openapi/pkg +* Version: v0.0.0-20260603220949-865597e52e25 * License: Apache-2.0 -* Module: k8s.io/kube-openapi #### LICENSE + + ```text Apache License @@ -14482,11 +15539,24 @@ third-party archives. ### k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json +* Version: v0.0.0-20260603220949-865597e52e25 * License: BSD-3-Clause -* Module: k8s.io/kube-openapi + +#### AUTHORS + + + +```text +# This source code refers to The Go Authors for copyright purposes. +# The master list of authors is in the main Go distribution, +# visible at https://tip.golang.org/AUTHORS. + +``` #### LICENSE + + ```text Copyright (c) 2020 The Go Authors. All rights reserved. @@ -14521,11 +15591,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### k8s.io/kube-openapi/pkg/validation/spec +* Version: v0.0.0-20260603220949-865597e52e25 * License: Apache-2.0 -* Module: k8s.io/kube-openapi #### LICENSE + + ```text Apache License @@ -14735,11 +15807,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### k8s.io/kubectl/pkg +* Version: v0.36.0 * License: Apache-2.0 -* Module: k8s.io/kubectl #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -14948,11 +16022,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### k8s.io/utils +* Version: v0.0.0-20260507154919-ff6756f316d2 * License: Apache-2.0 -* Module: k8s.io/utils #### LICENSE + + ```text Apache License @@ -15162,11 +16238,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### k8s.io/utils/internal/third_party/forked/golang +* Version: v0.0.0-20260507154919-ff6756f316d2 * License: BSD-3-Clause -* Module: k8s.io/utils #### LICENSE + + ```text Copyright (c) 2012 The Go Authors. All rights reserved. @@ -15198,14 +16276,46 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` +#### PATENTS + + + +```text +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + +``` + ### k8s.io/utils/third_party/forked/golang/btree +* Version: v0.0.0-20260507154919-ff6756f316d2 * License: Apache-2.0 -* Module: k8s.io/utils #### LICENSE + + ```text Apache License @@ -15414,11 +16524,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### sigs.k8s.io/controller-runtime +* Version: v0.24.1 * License: Apache-2.0 -* Module: sigs.k8s.io/controller-runtime #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -15627,11 +16739,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### sigs.k8s.io/json +* Version: v0.0.0-20250730193827-2d320260d730 * License: Apache-2.0 / BSD-3-Clause -* Module: sigs.k8s.io/json #### LICENSE + + ```text Files other than internal/golang/* licensed under: @@ -15877,11 +16991,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### sigs.k8s.io/kustomize/api +* Version: v0.21.1 * License: Apache-2.0 -* Module: sigs.k8s.io/kustomize/api #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -16090,11 +17206,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### sigs.k8s.io/kustomize/kyaml +* Version: v0.21.1 * License: Apache-2.0 -* Module: sigs.k8s.io/kustomize/kyaml #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -16303,11 +17421,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ### sigs.k8s.io/randfill +* Version: v1.0.0 * License: Apache-2.0 -* Module: sigs.k8s.io/randfill #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -16516,6 +17636,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #### NOTICE + + ```text When donating the randfill project to the CNCF, we could not reach all the gofuzz contributors to sign the CNCF CLA. As such, according to the CNCF rules @@ -16547,11 +17669,13 @@ Submitted on behalf of a third-party: @disconnect3d (Disconnect3d) ### sigs.k8s.io/structured-merge-diff/v6 +* Version: v6.4.0 * License: Apache-2.0 -* Module: sigs.k8s.io/structured-merge-diff/v6 #### LICENSE + + ```text Apache License Version 2.0, January 2004 @@ -16760,11 +17884,13 @@ Submitted on behalf of a third-party: @disconnect3d (Disconnect3d) ### sigs.k8s.io/yaml +* Version: v1.6.0 * License: Apache-2.0 / BSD-3-Clause / MIT -* Module: sigs.k8s.io/yaml #### LICENSE + + ```text The MIT License (MIT) diff --git a/tools/generate-third-party-notices.sh b/tools/generate-third-party-notices.sh index cca33a7a3..dbd0944dd 100755 --- a/tools/generate-third-party-notices.sh +++ b/tools/generate-third-party-notices.sh @@ -48,14 +48,14 @@ log() { # Licenses that are themselves Markdown close a fixed ``` fence early and invert # every block after it, so open with one backtick more than the file's longest run. fence_for() { - local file="$1" longest width + local file="$1" longest_backtick_run fence_width # -a: a license holding a NUL byte would otherwise print "Binary file ... # matches" instead of the matches, on stdout or stderr depending on the grep. - longest=$(LC_ALL=C grep -oaE '`+' "${file}" 2>/dev/null \ - | awk '{ if (length($0) > m) m = length($0) } END { print m+0 }') - width=$(( longest + 1 )) - (( width < 3 )) && width=3 - printf '%*s' "${width}" '' | tr ' ' '`' + longest_backtick_run=$(LC_ALL=C grep -oaE '`+' "${file}" 2>/dev/null \ + | awk '{ if (length($0) > m) m = length($0) } END { print m+0 }' || true) + fence_width=$(( longest_backtick_run + 1 )) + (( fence_width < 3 )) && fence_width=3 + printf '%*s' "${fence_width}" '' | tr ' ' '`' } check_prerequisites() { @@ -71,10 +71,10 @@ check_prerequisites() { die "go-licenses is not installed." "Install it with 'make install-tools'." fi - local f - for f in "${MULTI_ARCH_MK}" "${MODULES_TXT}"; do - [[ -f "${f}" ]] \ - || die "${f} not found — run 'make third-party-notices' from the repo root." + local required_file + for required_file in "${MULTI_ARCH_MK}" "${MODULES_TXT}" "${LICENSE_OVERRIDES}"; do + [[ -f "${required_file}" ]] \ + || die "${required_file} not found — run 'make third-party-notices' from the repo root." done LOCAL_MODULE=$(go list -m 2>/dev/null || true) @@ -113,10 +113,10 @@ prepare_workspace() { mkdir -p "${LICENSES_DIR}" # Explicit templates: macOS mktemp ignores TMPDIR without one. - local t="${TMPDIR:-/tmp}/gpu-operator-notices" - SAVE_ROOT="$(mktemp -d "${t}.XXXXXX")" - COMBINED_CSV="$(mktemp "${t}-csv.XXXXXX")" - INDEX_FILE="$(mktemp "${t}-idx.XXXXXX")" + local workspace_template="${TMPDIR:-/tmp}/gpu-operator-notices" + SAVE_ROOT="$(mktemp -d "${workspace_template}.XXXXXX")" + COMBINED_CSV="$(mktemp "${workspace_template}-csv.XXXXXX")" + INDEX_FILE="$(mktemp "${workspace_template}-idx.XXXXXX")" # Composed beside its destination, not under TMPDIR, so the last step is a # same-filesystem rename(2) rather than a copy-then-unlink. @@ -180,10 +180,10 @@ collapse_index() { ' } -# Rows carry module names from modules.txt rather than a URL: in vendor mode -# go-licenses reports a URL into this repo at HEAD, which stops describing -# released content once main moves. Versions are intentionally omitted because -# the notices identify dependencies and their licenses, not an exact build. +# Rows carry the module path and version from modules.txt rather than a URL: +# in vendor mode go-licenses reports a URL into this repo at HEAD, which stops +# describing released content once main moves and names our copy, not +# upstream. The verified upstream location comes from tools/license-urls.tsv. # Longest prefix wins: a license may sit below the module root. annotate_modules() { awk -v modfile="${MODULES_TXT}" ' @@ -203,9 +203,11 @@ annotate_modules() { } mods[++m] = f[2] disp[f[2]] = f[r] + ver[f[2]] = f[r + 1] } else { mods[++m] = f[2] disp[f[2]] = f[2] + ver[f[2]] = f[3] } } close(modfile) @@ -221,7 +223,7 @@ annotate_modules() { mp = mods[i] if (($1 == mp || index($1, mp "/") == 1) && length(mp) > length(best)) best = mp } - print $0, (best == "" ? "unknown" : disp[best]) + print $0, (best == "" ? "unknown" : disp[best]), (best == "" ? "unknown" : ver[best]) } ' } @@ -238,6 +240,11 @@ build_indexes() { "Run 'go mod vendor' and re-run, rather than committing a file with unattributed entries." fi + if cut -d, -f5 "${INDEX_FILE}" | LC_ALL=C grep -qx 'unknown'; then + die "could not resolve a version for some packages from ${MODULES_TXT}." \ + "Run 'go mod vendor' and re-run, rather than committing a file with unattributed entries." + fi + # go-licenses reports a license it cannot classify as "Unknown" and exits 0. # Anchored both sides: licenses are joined with " / ", and an identifier # merely starting with "Unknown" must not match. @@ -247,57 +254,166 @@ build_indexes() { die "go-licenses could not identify a license for some dependencies." \ "Check the entries reported as Unknown before committing the file." fi + + check_override_coverage "${INDEX_FILE}" +} + +# A dropped dependency would otherwise leave its row in LICENSE_OVERRIDES +# silently asserting a license for a package no longer shipped. +check_override_coverage() { + local index="$1" override_package + while IFS=$'\t' read -r override_package _ _; do + case "${override_package}" in + ''|'#'*) continue ;; + esac + LC_ALL=C cut -d, -f1 "${index}" | LC_ALL=C grep -qFx "${override_package}" \ + || die "${LICENSE_OVERRIDES} has a row for ${override_package}, which is not in the generated index." \ + "Remove that row from ${LICENSE_OVERRIDES} — the dependency was likely dropped." + done < "${LICENSE_OVERRIDES}" } -# License-bearing files, sorted. Filter by name: for restricted licenses -# 'go-licenses save' copies the whole module source, which does not belong here. +# Filter by name: for restricted licenses 'go-licenses save' copies the whole +# module source, which does not belong here. license_files_for() { - local dir="$1" f - [[ -d "${dir}" ]] || return 0 - while IFS= read -r -d '' f; do - if printf '%s' "$(basename "${f}")" \ + local search_dir="$1" license_file file_basename + [[ -d "${search_dir}" ]] || return 0 + while IFS= read -r -d '' license_file; do + file_basename="$(basename "${license_file}")" + # Exclude source files: the name pattern below also matches source + # files that merely start with a license-shaped header, e.g. + # k8s.io/kube-openapi/pkg/validation/spec/license.go, a Go file + # beginning "// Copyright 2015 go-swagger maintainers". + case "${file_basename}" in + *.go|*.c|*.h|*.s|*.py|*.sh|*.java|*.ts|*.js) continue ;; + esac + if printf '%s' "${file_basename}" \ | LC_ALL=C grep -qiE '^(licen[cs]e|notice|copying|copyright|authors|patents)([-._].*)?$'; then - printf '%s\n' "${f}" + printf '%s\n' "${license_file}" fi - done < <(find "${dir}" -maxdepth 1 -type f -print0 2>/dev/null | LC_ALL=C sort -z) + done < <(find "${search_dir}" -maxdepth 1 -type f -print0 2>/dev/null | LC_ALL=C sort -z) } -emit_index_table() { - local index="$1" pkg _ license module - printf '| Package | License | Dependency |\n' - printf '|---------|---------|------------|\n' +LICENSE_URLS="${LICENSE_URLS:-tools/license-urls.tsv}" +LICENSE_OVERRIDES="${LICENSE_OVERRIDES:-tools/license-overrides.tsv}" +VENDOR_DIR="${VENDOR_DIR:-vendor}" + +# Separate from check_prerequisites: tools/verify-license-urls.sh reuses the +# collection stages to discover which license files the document will link, and +# it is the command that produces this map, so it must run without it. +require_url_map() { + [[ -f "${LICENSE_URLS}" ]] \ + || die "${LICENSE_URLS} not found." \ + "Run 'make third-party-notices-urls' (needs network) and commit the result." +} - while IFS=, read -r pkg _ license module; do - [[ -z "${pkg}" ]] && continue +# A single license file can bundle more than one license, which go-licenses +# reports as whichever one it scores highest; LICENSE_OVERRIDES corrects the +# identifier by hand without touching the license text, which is unaffected. +license_identifier_for() { + local package="$1" default_identifier="$2" override_identifier + override_identifier="$(LC_ALL=C awk -F'\t' -v pkg="${package}" \ + '$1 == pkg { print $2; exit }' "${LICENSE_OVERRIDES}")" + printf '%s' "${override_identifier:-${default_identifier}}" +} + +# The first enclosing directory holding a license file wins, which is how +# go-licenses attributes them. +license_dir_within_module() { + local module="$2" dir="$1" relative + while :; do + if [[ -n "$(license_files_for "${VENDOR_DIR}/${dir}")" ]]; then + relative="${dir#"${module}"}" + printf '%s' "${relative#/}" + return 0 + fi + [[ "${dir}" == "${module}" ]] && return 1 + [[ "${dir}" != */* ]] && return 1 + dir="${dir%/*}" + done +} + +location_for() { + local url + url="$(LC_ALL=C awk -F'\t' -v m="$1" -v v="$2" -v p="$3" \ + '$1 == m && $2 == v && $3 == p { print $4; found = 1; exit } + END { exit !found }' "${LICENSE_URLS}")" || return 1 + [[ -n "${url}" ]] || return 1 + printf '%s' "${url}" +} + +# Mirrors how the License column joins identifiers. +location_cell() { + local package="$1" module="$2" version="$3" + local relative_license_dir license_file_name license_path url cell="" license_file governing_dir + relative_license_dir="$(license_dir_within_module "${package}" "${module}")" \ + || die "no license file found for ${package} under ${VENDOR_DIR}/${module}." \ + "Run 'go mod vendor' and re-run." + governing_dir="${VENDOR_DIR}/${module}${relative_license_dir:+/${relative_license_dir}}" + while IFS= read -r license_file; do + [[ -z "${license_file}" ]] && continue + license_file_name="$(basename "${license_file}")" + license_path="${relative_license_dir:+${relative_license_dir}/}${license_file_name}" + url="$(location_for "${module}" "${version}" "${license_path}")" \ + || die "${LICENSE_URLS} has no verified URL for ${module}@${version} ${license_path}." \ + "Run 'make third-party-notices-urls' (needs network) and commit the result." + cell="${cell:+${cell} / }[${license_file_name}](${url})" + done < <(license_files_for "${governing_dir}") + [[ -n "${cell}" ]] || die "no license file for ${package} under ${governing_dir}." \ + "Run 'go mod vendor' and re-run." + printf '%s' "${cell}" +} + +emit_index_table() { + local index="$1" package _ license module version location license_identifier + printf '| Package | Version | License | Location |\n' + printf '|---------|---------|---------|----------|\n' + + while IFS=, read -r package _ license module version; do + [[ -z "${package}" ]] && continue + location="$(location_cell "${package}" "${module}" "${version}")" + license_identifier="$(license_identifier_for "${package}" "${license:-Unknown}")" # shellcheck disable=SC2016 # backticks are literal markdown here. - printf '| `%s` | %s | `%s` |\n' "${pkg}" "${license:-Unknown}" "${module:-unknown}" + printf '| `%s` | %s | %s | %s |\n' \ + "${package}" "${version:-unknown}" \ + "${license_identifier}" "${location}" done < "${index}" } emit_sections() { - local index="$1" root="$2" - local pkg _ license module files lf fence + local index="$1" + local package _ license module version files license_file fence relative_license_dir license_file_name url governing_dir license_identifier - while IFS=, read -r pkg _ license module; do - [[ -z "${pkg}" ]] && continue + while IFS=, read -r package _ license module version; do + [[ -z "${package}" ]] && continue - printf '### %s\n\n' "${pkg}" - printf '* License: %s\n' "${license:-Unknown}" - printf '* Module: %s\n\n' "${module:-unknown}" + license_identifier="$(license_identifier_for "${package}" "${license:-Unknown}")" + printf '### %s\n\n' "${package}" + printf '* Version: %s\n' "${version:-unknown}" + printf '* License: %s\n\n' "${license_identifier}" + + relative_license_dir="$(license_dir_within_module "${package}" "${module}")" \ + || die "no license file found for ${package} under ${VENDOR_DIR}/${module}." \ + "Run 'go mod vendor' and re-run." + governing_dir="${VENDOR_DIR}/${module}${relative_license_dir:+/${relative_license_dir}}" files=() - while IFS= read -r lf; do - [[ -n "${lf}" ]] && files+=("${lf}") - done < <(license_files_for "${root}/${pkg}") + while IFS= read -r license_file; do + [[ -n "${license_file}" ]] && files+=("${license_file}") + done < <(license_files_for "${governing_dir}") if (( ${#files[@]} == 0 )); then printf 'License text unavailable. See upstream source for the full license.\n' else - for lf in "${files[@]}"; do - fence="$(fence_for "${lf}")" - printf '#### %s\n\n' "$(basename "${lf}")" + for license_file in "${files[@]}"; do + license_file_name="$(basename "${license_file}")" + url="$(location_for "${module}" "${version}" "${relative_license_dir:+${relative_license_dir}/}${license_file_name}")" \ + || die "${LICENSE_URLS} has no verified URL for ${module}@${version} ${relative_license_dir:+${relative_license_dir}/}${license_file_name}." \ + "Run 'make third-party-notices-urls' (needs network) and commit the result." + fence="$(fence_for "${license_file}")" + printf '#### %s\n\n' "${license_file_name}" + printf '<%s>\n\n' "${url}" printf '%stext\n' "${fence}" - cat "${lf}" + cat "${license_file}" echo printf '%s\n' "${fence}" echo @@ -308,6 +424,7 @@ emit_sections() { } compose_document() { + require_url_map log "Composing ${OUTPUT}..." { cat <<'EOF' @@ -325,6 +442,13 @@ shipped; its dependencies are listed here as well rather than excluded. Go standard library packages are excluded; they are covered by the license of the Go distribution itself. +Each dependency is listed with the version redistributed and a link to the +license file in that version's upstream source. Every link was verified by +fetching it and comparing its contents against the copy vendored here, so each +one resolves to the same license text reproduced below. Modules that no command +under `cmd/` links are not listed; those are vendored only for this module's own +tests and build tooling. + The `gpu-operator` image uses `nvcr.io/nvidia/distroless/cc` as a base image. All of the OSS packages and source included in this image can be found at . A statically @@ -343,7 +467,7 @@ EOF ## License Texts EOF - emit_sections "${INDEX_FILE}" "${LICENSES_DIR}" + emit_sections "${INDEX_FILE}" } > "${OUT_TMP}" # mktemp creates 0600, so fix the mode before the rename. mv, not cp: the # rename is atomic, so a failed run leaves the previous document intact. @@ -365,4 +489,8 @@ main() { log "Wrote ${OUTPUT} (${count} Go packages)" } -main "$@" +# Sourced by the tests and by tools/verify-license-urls.sh, which reuse these +# functions without the side effects of a full run. +if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then + main "$@" +fi diff --git a/tools/generate-third-party-notices_test.sh b/tools/generate-third-party-notices_test.sh new file mode 100644 index 000000000..e05518438 --- /dev/null +++ b/tools/generate-third-party-notices_test.sh @@ -0,0 +1,186 @@ +#!/usr/bin/env bash +# Copyright (c) NVIDIA CORPORATION. All rights reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +set -uo pipefail + +HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +# shellcheck source=tools/test-helpers.sh disable=SC1091 +source "${HERE}/test-helpers.sh" + +# If the guard ever regresses, sourcing must not overwrite the committed +# notices file. OUTPUT is honoured by compose_document. +OUTPUT="$(mktemp)" +export OUTPUT + +# shellcheck source=tools/generate-third-party-notices.sh disable=SC1091 +source "${HERE}/generate-third-party-notices.sh" + +# If the guard is missing, sourcing runs the generator and exits before here. +assert_eq "sourced" "sourced" "sourcing the generator does not execute main" + +# Environment-independent: proves the guard is present rather than relying on +# main failing fast, which it only does on a host without go-licenses. +assert_eq "1" \ + "$(LC_ALL=C grep -c 'BASH_SOURCE\[0\]' "${HERE}/generate-third-party-notices.sh")" \ + "the generator guards main against running on source" + +fixture="$(mktemp)" +trap 'rm -f "${fixture}"' EXIT +printf 'plain text, no backticks\n' > "${fixture}" +assert_eq '```' "$(fence_for "${fixture}")" "fence_for: minimum width is three" +printf 'a ```` b\n' > "${fixture}" +assert_eq '`````' "$(fence_for "${fixture}")" "fence_for: one wider than the longest run" + +modules_fixture="$(mktemp)" +cat > "${modules_fixture}" <<'MODULES' +# github.com/klauspost/compress v1.19.1 +## explicit +# k8s.io/api v0.36.4 +MODULES + +index_input="$(mktemp)" +cat > "${index_input}" <<'ROWS' +github.com/klauspost/compress,ignored,Apache-2.0 +github.com/klauspost/compress/zstd/internal/xxhash,ignored,MIT +k8s.io/api,ignored,Apache-2.0 +ROWS + +assert_eq "github.com/klauspost/compress/zstd/internal/xxhash,ignored,MIT,github.com/klauspost/compress,v1.19.1" \ + "$(MODULES_TXT="${modules_fixture}" annotate_modules < "${index_input}" | sed -n 2p)" \ + "annotate_modules appends module and version" +assert_eq "k8s.io/api,ignored,Apache-2.0,k8s.io/api,v0.36.4" \ + "$(MODULES_TXT="${modules_fixture}" annotate_modules < "${index_input}" | sed -n 3p)" \ + "annotate_modules resolves a root module" + +urls_fixture="$(mktemp)" +printf 'github.com/klauspost/compress\tv1.19.1\tLICENSE\thttps://example.invalid/root\n' > "${urls_fixture}" +printf 'github.com/klauspost/compress\tv1.19.1\tzstd/internal/xxhash/LICENSE.txt\thttps://example.invalid/xxhash\n' >> "${urls_fixture}" + +# No rows: exercises license_identifier_for's not-found path so the fixtures +# below that do not care about overrides are unaffected by them, without +# depending on the LICENSE_OVERRIDES default resolving from the test's cwd. +empty_overrides_fixture="$(mktemp)" +printf '# no overrides\n' > "${empty_overrides_fixture}" + +assert_eq "https://example.invalid/xxhash" \ + "$(LICENSE_URLS="${urls_fixture}" location_for \ + github.com/klauspost/compress v1.19.1 zstd/internal/xxhash/LICENSE.txt)" \ + "location_for finds a nested license path" +# $1 is expanded by the child bash -c, not here. +# shellcheck disable=SC2016 +assert_fails "location_for fails closed on a miss" \ + env LICENSE_URLS="${urls_fixture}" bash -c \ + 'source "$1"; location_for github.com/nope v1.0.0 LICENSE' \ + _ "${HERE}/generate-third-party-notices.sh" + +license_files_fixture="$(mktemp -d)" +touch "${license_files_fixture}/LICENSE" "${license_files_fixture}/LICENSE.md" "${license_files_fixture}/license.go" +assert_eq "$(printf '%s/LICENSE\n%s/LICENSE.md' "${license_files_fixture}" "${license_files_fixture}")" \ + "$(license_files_for "${license_files_fixture}")" \ + "license_files_for excludes a Go source file even when its name matches" +rm -rf "${license_files_fixture}" + +vendor_fixture="$(mktemp -d)" +mkdir -p "${vendor_fixture}/github.com/klauspost/compress/zstd/internal/xxhash" +touch "${vendor_fixture}/github.com/klauspost/compress/LICENSE" +touch "${vendor_fixture}/github.com/klauspost/compress/zstd/internal/xxhash/LICENSE.txt" +assert_eq "zstd/internal/xxhash" \ + "$(VENDOR_DIR="${vendor_fixture}" license_dir_within_module \ + github.com/klauspost/compress/zstd/internal/xxhash github.com/klauspost/compress)" \ + "license_dir_within_module finds the nearest enclosing license" +assert_eq "" \ + "$(VENDOR_DIR="${vendor_fixture}" license_dir_within_module \ + github.com/klauspost/compress github.com/klauspost/compress)" \ + "license_dir_within_module is empty at the module root" +# $1 is expanded by the child bash -c, not here. +# shellcheck disable=SC2016 +assert_fails "license_dir_within_module fails when no license exists" \ + env VENDOR_DIR="${vendor_fixture}" bash -c \ + 'source "$1"; license_dir_within_module github.com/absent/mod github.com/absent/mod' \ + _ "${HERE}/generate-third-party-notices.sh" + +render="$(mktemp -d)" +mkdir -p "${render}/cache/github.com/klauspost/compress/zstd/internal/xxhash" +printf 'MIT text\n' > "${render}/cache/github.com/klauspost/compress/zstd/internal/xxhash/LICENSE.txt" +cat > "${render}/index.csv" <<'IDX' +github.com/klauspost/compress/zstd/internal/xxhash,ignored,MIT,github.com/klauspost/compress,v1.19.1 +IDX + +assert_eq '| Package | Version | License | Location |' \ + "$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \ + LICENSE_OVERRIDES="${empty_overrides_fixture}" emit_index_table "${render}/index.csv" | sed -n 1p)" \ + "index header has four columns" +# Expected literal Markdown, not shell expansion. +# shellcheck disable=SC2016 +assert_eq '| `github.com/klauspost/compress/zstd/internal/xxhash` | v1.19.1 | MIT | [LICENSE.txt](https://example.invalid/xxhash) |' \ + "$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \ + LICENSE_OVERRIDES="${empty_overrides_fixture}" emit_index_table "${render}/index.csv" | sed -n 3p)" \ + "index row labels the link by filename" + +# Regression: a package whose module/version pair has no entry in the URL map +# must abort the whole table, not render with a blank Location cell. +mismatch_index="${render}/mismatch-index.csv" +cat > "${mismatch_index}" <<'IDX' +github.com/klauspost/compress/zstd/internal/xxhash,ignored,MIT,github.com/klauspost/compress,v9.9.9 +IDX +# $1/$2 are expanded by the child bash -c, not here. +# shellcheck disable=SC2016 +assert_fails "emit_index_table fails closed when the URL map has no entry for a row" \ + env LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \ + LICENSE_OVERRIDES="${empty_overrides_fixture}" \ + bash -c 'source "$1"; emit_index_table "$2"' _ "${HERE}/generate-third-party-notices.sh" "${mismatch_index}" + +section="$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \ + LICENSE_OVERRIDES="${empty_overrides_fixture}" emit_sections "${render}/index.csv" "${render}/cache")" +assert_eq "* Version: v1.19.1" "$(printf '%s' "${section}" | sed -n 3p)" "section names the version" +assert_eq "* License: MIT" "$(printf '%s' "${section}" | sed -n 4p)" "section names the license" +assert_eq "0" "$(printf '%s' "${section}" | LC_ALL=C grep -c '^\* Module: ')" "section no longer names the module" +assert_eq "" \ + "$(printf '%s' "${section}" | LC_ALL=C grep -m1 '^ "${overrides_fixture}" <<'OVERRIDES' +# package license reason +github.com/klauspost/compress Apache-2.0 / MIT test fixture +github.com/klauspost/compress/zstd/internal/xxhash Apache-2.0 / MIT test fixture +OVERRIDES + +assert_eq "Apache-2.0 / MIT" \ + "$(LICENSE_OVERRIDES="${overrides_fixture}" license_identifier_for github.com/klauspost/compress Apache-2.0)" \ + "license_identifier_for returns the override for a package that has one" +assert_eq "MIT" \ + "$(LICENSE_OVERRIDES="${overrides_fixture}" license_identifier_for k8s.io/api MIT)" \ + "license_identifier_for returns the passed-in default for a package without an override" + +# Expected literal Markdown, not shell expansion. +# shellcheck disable=SC2016 +assert_eq '| `github.com/klauspost/compress/zstd/internal/xxhash` | v1.19.1 | Apache-2.0 / MIT | [LICENSE.txt](https://example.invalid/xxhash) |' \ + "$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \ + LICENSE_OVERRIDES="${overrides_fixture}" emit_index_table "${render}/index.csv" | sed -n 3p)" \ + "emit_index_table renders the overridden identifier in the License column" + +stale_overrides="$(mktemp)" +printf 'github.com/absent/package\tApache-2.0 / MIT\ttest fixture\n' > "${stale_overrides}" +# $1/$2 are expanded by the child bash -c, not here. +# shellcheck disable=SC2016 +assert_fails "check_override_coverage fails when an override names a package absent from the index" \ + env LICENSE_OVERRIDES="${stale_overrides}" bash -c \ + 'source "$1"; check_override_coverage "$2"' _ "${HERE}/generate-third-party-notices.sh" "${render}/index.csv" + +rm -rf "${vendor_fixture}" "${render}" +rm -f "${modules_fixture}" "${index_input}" "${urls_fixture}" "${empty_overrides_fixture}" "${overrides_fixture}" "${stale_overrides}" + +finish diff --git a/tools/license-overrides.tsv b/tools/license-overrides.tsv new file mode 100644 index 000000000..ef79a3e7a --- /dev/null +++ b/tools/license-overrides.tsv @@ -0,0 +1,16 @@ +# Curated license identifiers for packages whose license file bundles more +# than one license as a single document. go-licenses classifies such a file +# as whichever license it scores highest and reports only that one, so the +# reported identifier understates the terms even though the license text +# reproduced in THIRD_PARTY_NOTICES.md already carries every license in full. +# +# Add a row here only when you have read the vendored license file yourself +# and confirmed by eye which licenses it actually contains — do not derive +# an entry by grepping license text for phrases, which cannot reliably tell +# similar licenses apart (e.g. BSD-2-Clause vs BSD-3-Clause) and risks adding +# a wrong claim to a legal document. +# +# package license reason +go.yaml.in/yaml/v2 Apache-2.0 / MIT ships LICENSE (Apache-2.0) and LICENSE.libyaml (MIT) as two files; go-licenses reports only the Apache-2.0 LICENSE +go.yaml.in/yaml/v3 Apache-2.0 / MIT single LICENSE file has a full-text MIT section plus a short-form Apache-2.0 grant; go-licenses reports only MIT +gopkg.in/yaml.v3 Apache-2.0 / MIT single LICENSE file has a full-text MIT section plus a short-form Apache-2.0 grant; go-licenses reports only MIT diff --git a/tools/license-url-lib.sh b/tools/license-url-lib.sh new file mode 100644 index 000000000..d30f50ab8 --- /dev/null +++ b/tools/license-url-lib.sh @@ -0,0 +1,156 @@ +#!/usr/bin/env bash +# Copyright (c) NVIDIA CORPORATION. All rights reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# Pure string transforms shared by the resolvers and the notices generator. +# No network and (except base64_decode, which reads stdin) no I/O, so every +# rule here is testable offline. + +# The module proxy case-encodes an uppercase letter as '!' plus its lowercase +# form: github.com/NVIDIA -> github.com/!n!v!i!d!i!a. This MUST NOT be done with +# sed: 's/\([A-Z]\)/!\l\1/g' yields '!lN!lV...' on BSD sed, which the proxy +# rejects as an invalid escaped module path. +proxy_escape() { + printf '%s' "$1" | awk '{ + n = split($0, chars, "") + out = "" + for (i = 1; i <= n; i++) { + c = chars[i] + out = out (c ~ /[A-Z]/ ? "!" tolower(c) : c) + } + print out + }' +} + +strip_major_suffix() { + if [[ "$1" =~ ^(.*)/v[0-9]+$ ]]; then + printf '%s' "${BASH_REMATCH[1]}" + else + printf '%s' "$1" + fi +} + +normalize_version() { + printf '%s' "${1%+incompatible}" +} + +# A pseudo-version ends in <14-digit UTC timestamp>-<12-hex commit>. That +# trailing hash is the only ref such a module has; there is no tag. +# Pre-release versions have an optional 0. prefix before the timestamp. +pseudo_version_hash() { + if [[ "$1" =~ -[0-9.]*[0-9]{14}-([0-9a-f]{12})$ ]]; then + printf '%s' "${BASH_REMATCH[1]}" + fi +} + +normalize_repo_url() { + local url="${1%/}" + printf '%s' "${url%.git}" +} + +github_repo_from_path() { + local module rest org repo + module="$(strip_major_suffix "$1")" + case "${module}" in github.com/*) ;; *) return 0 ;; esac + rest="${module#github.com/}" + org="${rest%%/*}" + rest="${rest#*/}" + repo="${rest%%/*}" + [[ -n "${org}" && -n "${repo}" && "${org}" != "${module}" ]] || return 0 + printf 'https://github.com/%s/%s' "${org}" "${repo}" +} + +# The module's directory inside a github repository, derived from the path +# alone. GitHub serves no go-import meta, so when the proxy has no Origin this +# is the only source of the submodule tag prefix; without it a module such as +# github.com/Mellanox/maintenance-operator/api loses its 'api/' tag and no +# candidate URL can match. +github_subdir_from_path() { + local module rest + module="$(strip_major_suffix "$1")" + case "${module}" in github.com/*) ;; *) return 0 ;; esac + rest="${module#github.com/}" + [[ "${rest}" == */* ]] || return 0 + rest="${rest#*/}" # drop org + [[ "${rest}" == */* ]] || return 0 + printf '%s' "${rest#*/}" # drop repo +} + +# gopkg.in publishes a go-import pointing at itself, which serves no blobs. +# Its documented convention maps onto GitHub. +gopkg_in_repo() { + local rest user pkg + case "$1" in gopkg.in/*) ;; *) return 0 ;; esac + rest="${1#gopkg.in/}" + if [[ "${rest}" == */* ]]; then + user="${rest%%/*}" + pkg="${rest#*/}" + printf 'https://github.com/%s/%s' "${user}" "${pkg%.v*}" + else + pkg="${rest%.v*}" + printf 'https://github.com/go-%s/%s' "${pkg}" "${pkg}" + fi +} + +derived_subdir() { + local module prefix + module="$(strip_major_suffix "$1")" + prefix="$(strip_major_suffix "$2")" + [[ "${module}" == "${prefix}" ]] && return 0 + [[ "${module}" == "${prefix}/"* ]] || return 0 + printf '%s' "${module#"${prefix}/"}" +} + +# Gerrit serves blobs under /+//, not /blob//. +blob_url() { + local repo="$1" ref="$2" path="$3" + case "${repo}" in + https://go.googlesource.com/*) printf '%s/+/%s/%s' "${repo}" "${ref}" "${path}" ;; + *) printf '%s/blob/%s/%s' "${repo}" "${ref}" "${path}" ;; + esac +} + +raw_url_for() { + local blob="$1" rest owner repo + case "${blob}" in + https://github.com/*) + rest="${blob#https://github.com/}" + owner="${rest%%/*}"; rest="${rest#*/}" + repo="${rest%%/*}"; rest="${rest#*/}" + rest="${rest#blob/}" + printf 'https://raw.githubusercontent.com/%s/%s/%s' "${owner}" "${repo}" "${rest}" + ;; + https://go.googlesource.com/*) + printf '%s?format=TEXT' "${blob}" + ;; + esac +} + +raw_is_base64() { + case "$1" in https://go.googlesource.com/*) return 0 ;; *) return 1 ;; esac +} + +# GNU coreutils spells the decode flag -d; BSD documents -D. Probe once rather +# than assuming, or every Gerrit-hosted module fails to hash on a strict BSD. +base64_decode() { + if [[ -z "${BASE64_DECODE_FLAG:-}" ]]; then + if printf '' | base64 -d >/dev/null 2>&1; then + BASE64_DECODE_FLAG="-d" + else + BASE64_DECODE_FLAG="-D" + fi + fi + base64 "${BASE64_DECODE_FLAG}" +} diff --git a/tools/license-url-lib_test.sh b/tools/license-url-lib_test.sh new file mode 100644 index 000000000..c5e64f512 --- /dev/null +++ b/tools/license-url-lib_test.sh @@ -0,0 +1,88 @@ +#!/usr/bin/env bash +# Copyright (c) NVIDIA CORPORATION. All rights reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +set -uo pipefail +HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +# shellcheck source=tools/test-helpers.sh disable=SC1091 +source "${HERE}/test-helpers.sh" +# shellcheck source=tools/license-url-lib.sh disable=SC1091 +source "${HERE}/license-url-lib.sh" + +# The bug that silently broke proxy resolution for all ten uppercase modules. +assert_eq "github.com/!n!v!i!d!i!a/go-nvlib" \ + "$(proxy_escape github.com/NVIDIA/go-nvlib)" "proxy_escape lowercases with a bang" +assert_eq "github.com/!mellanox/maintenance-operator/api" \ + "$(proxy_escape github.com/Mellanox/maintenance-operator/api)" "proxy_escape single capital" +assert_eq "k8s.io/api" "$(proxy_escape k8s.io/api)" "proxy_escape leaves lowercase alone" + +assert_eq "github.com/Masterminds/semver" \ + "$(strip_major_suffix github.com/Masterminds/semver/v3)" "strip /v3" +assert_eq "go.yaml.in/yaml" \ + "$(strip_major_suffix go.yaml.in/yaml/v3)" "strip /v3 from a vanity path" +assert_eq "gopkg.in/inf.v0" \ + "$(strip_major_suffix gopkg.in/inf.v0)" "gopkg.in .vN is not a /vN suffix" + +assert_eq "v2.0.1" "$(normalize_version 'v2.0.1+incompatible')" "strip +incompatible" +assert_eq "faa5f7b0171c" \ + "$(pseudo_version_hash v0.0.0-20250102033503-faa5f7b0171c)" "pseudo-version hash" +assert_eq "d8f796af33cc" \ + "$(pseudo_version_hash v1.1.2-0.20180830191138-d8f796af33cc)" "pre-release pseudo-version" +assert_eq "" "$(pseudo_version_hash v1.19.1)" "a tagged version has no hash" + +assert_eq "https://github.com/klauspost/compress" \ + "$(github_repo_from_path github.com/klauspost/compress)" "github root module" +assert_eq "https://github.com/Mellanox/maintenance-operator" \ + "$(github_repo_from_path github.com/Mellanox/maintenance-operator/api)" "github submodule" +assert_eq "" "$(github_repo_from_path k8s.io/api)" "non-github yields empty" + +# Without this the github fallback loses the submodule tag prefix entirely. +assert_eq "api" \ + "$(github_subdir_from_path github.com/Mellanox/maintenance-operator/api)" "github subdir" +assert_eq "pkg/apis/monitoring" \ + "$(github_subdir_from_path github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring)" \ + "multi-segment github subdir" +assert_eq "" "$(github_subdir_from_path github.com/Masterminds/semver/v3)" "/vN is not a subdir" +assert_eq "" "$(github_subdir_from_path github.com/klauspost/compress)" "root module has no subdir" + +assert_eq "https://github.com/go-inf/inf" "$(gopkg_in_repo gopkg.in/inf.v0)" "gopkg.in single segment" +assert_eq "https://github.com/go-yaml/yaml" "$(gopkg_in_repo gopkg.in/yaml.v3)" "gopkg.in yaml" +assert_eq "https://github.com/evanphx/json-patch" \ + "$(gopkg_in_repo gopkg.in/evanphx/json-patch.v4)" "gopkg.in user/pkg" +assert_eq "" "$(gopkg_in_repo github.com/foo/bar)" "non-gopkg.in yields empty" + +assert_eq "https://github.com/cyphar/libpathrs" \ + "$(normalize_repo_url 'https://github.com/cyphar/libpathrs.git')" "strip .git" +assert_eq "https://github.com/foo/bar" \ + "$(normalize_repo_url 'https://github.com/foo/bar/')" "strip trailing slash" + +assert_eq "api" "$(derived_subdir sigs.k8s.io/kustomize/api sigs.k8s.io/kustomize)" "subdir from prefix" +assert_eq "" "$(derived_subdir github.com/klauspost/compress github.com/klauspost/compress)" "root module" + +assert_eq "https://github.com/klauspost/compress/blob/v1.19.1/LICENSE" \ + "$(blob_url https://github.com/klauspost/compress v1.19.1 LICENSE)" "github blob template" +assert_eq "https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE" \ + "$(blob_url https://go.googlesource.com/crypto refs/tags/v0.55.0 LICENSE)" "gerrit blob template" + +assert_eq "https://raw.githubusercontent.com/klauspost/compress/v1.19.1/zstd/internal/xxhash/LICENSE.txt" \ + "$(raw_url_for https://github.com/klauspost/compress/blob/v1.19.1/zstd/internal/xxhash/LICENSE.txt)" \ + "github raw URL" +assert_eq "https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE?format=TEXT" \ + "$(raw_url_for https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE)" "gerrit raw URL" +assert_fails "github raw is not base64" raw_is_base64 https://github.com/a/b/blob/v1/LICENSE + +assert_eq "hello" "$(printf 'aGVsbG8=' | base64_decode)" "base64_decode works on this host" + +finish diff --git a/tools/license-urls.tsv b/tools/license-urls.tsv new file mode 100644 index 000000000..4d87caa0a --- /dev/null +++ b/tools/license-urls.tsv @@ -0,0 +1,158 @@ +# Verified upstream URL for every license file the notices document links. +# Generated by tools/verify-license-urls.sh. Each URL was fetched and its +# sha256 matched against the vendored copy, so no entry is a dead or wrong link. +# Covers the shipped set only: build- and test-only dependencies are excluded. +# module version license-path url +dario.cat/mergo v1.0.1 LICENSE https://github.com/imdario/mergo/blob/v1.0.1/LICENSE +github.com/MakeNowJust/heredoc v1.0.0 LICENSE https://github.com/makenowjust/heredoc/blob/v1.0.0/LICENSE +github.com/Masterminds/goutils v1.1.1 LICENSE.txt https://github.com/Masterminds/goutils/blob/v1.1.1/LICENSE.txt +github.com/Masterminds/semver/v3 v3.5.0 LICENSE.txt https://github.com/Masterminds/semver/blob/v3.5.0/LICENSE.txt +github.com/Masterminds/sprig/v3 v3.3.0 LICENSE.txt https://github.com/Masterminds/sprig/blob/v3.3.0/LICENSE.txt +github.com/Mellanox/maintenance-operator/api v0.3.0 LICENSE https://github.com/Mellanox/maintenance-operator/blob/api/v0.3.0/LICENSE +github.com/NVIDIA/go-nvlib v0.12.0 LICENSE https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/LICENSE +github.com/NVIDIA/go-nvlib v0.12.0 NOTICE https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/NOTICE +github.com/NVIDIA/k8s-kata-manager v0.2.3 LICENSE https://github.com/NVIDIA/k8s-kata-manager/blob/v0.2.3/LICENSE +github.com/NVIDIA/k8s-operator-libs v0.0.0-20260629200812-d720f2557494 LICENSE https://github.com/NVIDIA/k8s-operator-libs/blob/d720f2557494/LICENSE +github.com/NVIDIA/nvidia-container-toolkit v1.20.0 LICENSE https://github.com/NVIDIA/nvidia-container-toolkit/blob/v1.20.0/LICENSE +github.com/beorn7/perks v1.0.1 LICENSE https://github.com/beorn7/perks/blob/v1.0.1/LICENSE +github.com/blang/semver/v4 v4.0.0 LICENSE https://github.com/blang/semver/blob/v4.0.0/LICENSE +github.com/cespare/xxhash/v2 v2.3.0 LICENSE.txt https://github.com/cespare/xxhash/blob/v2.3.0/LICENSE.txt +github.com/chai2010/gettext-go v1.0.2 LICENSE https://github.com/chai2010/gettext-go/blob/v1.0.2/LICENSE +github.com/cyphar/filepath-securejoin v0.7.0 COPYING.md https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/COPYING.md +github.com/cyphar/filepath-securejoin v0.7.0 LICENSE.BSD https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.BSD +github.com/cyphar/filepath-securejoin v0.7.0 LICENSE.MPL-2.0 https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.MPL-2.0 +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc LICENSE https://github.com/davecgh/go-spew/blob/d8f796af33cc/LICENSE +github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 LICENSE https://github.com/docker-archive-public/docker.libtrust/blob/aabc10ec26b7/LICENSE +github.com/emicklei/go-restful/v3 v3.13.0 LICENSE https://github.com/emicklei/go-restful/blob/v3.13.0/LICENSE +github.com/evanphx/json-patch/v5 v5.9.11 LICENSE https://github.com/evanphx/json-patch/blob/v5.9.11/LICENSE +github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f LICENSE https://github.com/exponent-io/jsonpath/blob/1de76d718b3f/LICENSE +github.com/fsnotify/fsnotify v1.9.0 LICENSE https://github.com/fsnotify/fsnotify/blob/v1.9.0/LICENSE +github.com/fxamacker/cbor/v2 v2.9.2 LICENSE https://github.com/fxamacker/cbor/blob/v2.9.2/LICENSE +github.com/go-errors/errors v1.5.1 LICENSE.MIT https://github.com/go-errors/errors/blob/v1.5.1/LICENSE.MIT +github.com/go-logr/logr v1.4.4 LICENSE https://github.com/go-logr/logr/blob/v1.4.4/LICENSE +github.com/go-logr/zapr v1.3.0 LICENSE https://github.com/go-logr/zapr/blob/v1.3.0/LICENSE +github.com/go-openapi/jsonpointer v0.22.4 LICENSE https://github.com/go-openapi/jsonpointer/blob/v0.22.4/LICENSE +github.com/go-openapi/jsonpointer v0.22.4 NOTICE https://github.com/go-openapi/jsonpointer/blob/v0.22.4/NOTICE +github.com/go-openapi/jsonreference v0.21.4 LICENSE https://github.com/go-openapi/jsonreference/blob/v0.21.4/LICENSE +github.com/go-openapi/jsonreference v0.21.4 NOTICE https://github.com/go-openapi/jsonreference/blob/v0.21.4/NOTICE +github.com/go-openapi/swag v0.25.4 LICENSE https://github.com/go-openapi/swag/blob/v0.25.4/LICENSE +github.com/go-openapi/swag/cmdutils v0.25.4 LICENSE https://github.com/go-openapi/swag/blob/cmdutils/v0.25.4/LICENSE +github.com/go-openapi/swag/conv v0.25.4 LICENSE https://github.com/go-openapi/swag/blob/conv/v0.25.4/LICENSE +github.com/go-openapi/swag/fileutils v0.25.4 LICENSE https://github.com/go-openapi/swag/blob/fileutils/v0.25.4/LICENSE +github.com/go-openapi/swag/jsonname v0.25.4 LICENSE https://github.com/go-openapi/swag/blob/jsonname/v0.25.4/LICENSE +github.com/go-openapi/swag/jsonutils v0.25.4 LICENSE https://github.com/go-openapi/swag/blob/jsonutils/v0.25.4/LICENSE +github.com/go-openapi/swag/loading v0.25.4 LICENSE https://github.com/go-openapi/swag/blob/loading/v0.25.4/LICENSE +github.com/go-openapi/swag/mangling v0.25.4 LICENSE https://github.com/go-openapi/swag/blob/mangling/v0.25.4/LICENSE +github.com/go-openapi/swag/netutils v0.25.4 LICENSE https://github.com/go-openapi/swag/blob/netutils/v0.25.4/LICENSE +github.com/go-openapi/swag/stringutils v0.25.4 LICENSE https://github.com/go-openapi/swag/blob/stringutils/v0.25.4/LICENSE +github.com/go-openapi/swag/typeutils v0.25.4 LICENSE https://github.com/go-openapi/swag/blob/typeutils/v0.25.4/LICENSE +github.com/go-openapi/swag/yamlutils v0.25.4 LICENSE https://github.com/go-openapi/swag/blob/yamlutils/v0.25.4/LICENSE +github.com/google/btree v1.1.3 LICENSE https://github.com/google/btree/blob/v1.1.3/LICENSE +github.com/google/gnostic-models v0.7.1 LICENSE https://github.com/google/gnostic-models/blob/v0.7.1/LICENSE +github.com/google/uuid v1.6.0 LICENSE https://github.com/google/uuid/blob/v1.6.0/LICENSE +github.com/huandu/xstrings v1.5.0 LICENSE https://github.com/huandu/xstrings/blob/v1.5.0/LICENSE +github.com/json-iterator/go v1.1.12 LICENSE https://github.com/json-iterator/go/blob/v1.1.12/LICENSE +github.com/klauspost/compress v1.19.1 LICENSE https://github.com/klauspost/compress/blob/v1.19.1/LICENSE +github.com/klauspost/compress v1.19.1 internal/snapref/LICENSE https://github.com/klauspost/compress/blob/v1.19.1/internal/snapref/LICENSE +github.com/klauspost/compress v1.19.1 zstd/internal/xxhash/LICENSE.txt https://github.com/klauspost/compress/blob/v1.19.1/zstd/internal/xxhash/LICENSE.txt +github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de LICENSE https://github.com/liggitt/tabwriter/blob/89fcab3d43de/LICENSE +github.com/mitchellh/copystructure v1.2.0 LICENSE https://github.com/mitchellh/copystructure/blob/v1.2.0/LICENSE +github.com/mitchellh/go-wordwrap v1.0.1 LICENSE.md https://github.com/mitchellh/go-wordwrap/blob/v1.0.1/LICENSE.md +github.com/mitchellh/reflectwalk v1.0.2 LICENSE https://github.com/mitchellh/reflectwalk/blob/v1.0.2/LICENSE +github.com/moby/term v0.5.2 LICENSE https://github.com/moby/term/blob/v0.5.2/LICENSE +github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd LICENSE https://github.com/modern-go/concurrent/blob/bacd9c7ef1dd/LICENSE +github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee LICENSE https://github.com/modern-go/reflect2/blob/35a7c28c31ee/LICENSE +github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 LICENSE https://github.com/monochromegane/go-gitignore/blob/205db1a8cc00/LICENSE +github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 LICENSE https://github.com/munnerz/goautoneg/blob/a7dc8b61c822/LICENSE +github.com/opencontainers/cgroups v0.0.7 LICENSE https://github.com/opencontainers/cgroups/blob/v0.0.7/LICENSE +github.com/opencontainers/go-digest v1.0.0 LICENSE https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE +github.com/opencontainers/go-digest v1.0.0 LICENSE.docs https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE.docs +github.com/opencontainers/runc v1.4.3 LICENSE https://github.com/opencontainers/runc/blob/v1.4.3/LICENSE +github.com/opencontainers/runc v1.4.3 NOTICE https://github.com/opencontainers/runc/blob/v1.4.3/NOTICE +github.com/openshift/api v0.0.0-20260727141720-967cc4c36c9b LICENSE https://github.com/openshift/api/blob/967cc4c36c9b/LICENSE +github.com/openshift/client-go v0.0.0-20260723174158-ae2315de9d73 LICENSE https://github.com/openshift/client-go/blob/ae2315de9d73/LICENSE +github.com/operator-framework/api v0.45.0 LICENSE https://github.com/operator-framework/api/blob/v0.45.0/LICENSE +github.com/peterbourgon/diskv v2.0.1+incompatible LICENSE https://github.com/peterbourgon/diskv/blob/v2.0.1/LICENSE +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 LICENSE https://github.com/pmezard/go-difflib/blob/5d4384ee4fb2/LICENSE +github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.93.1 LICENSE https://github.com/prometheus-operator/prometheus-operator/blob/pkg/apis/monitoring/v0.93.1/LICENSE +github.com/prometheus/client_golang v1.24.1 LICENSE https://github.com/prometheus/client_golang/blob/v1.24.1/LICENSE +github.com/prometheus/client_golang v1.24.1 NOTICE https://github.com/prometheus/client_golang/blob/v1.24.1/NOTICE +github.com/prometheus/client_golang v1.24.1 internal/github.com/golang/gddo/LICENSE https://github.com/prometheus/client_golang/blob/v1.24.1/internal/github.com/golang/gddo/LICENSE +github.com/prometheus/client_model v0.6.2 LICENSE https://github.com/prometheus/client_model/blob/v0.6.2/LICENSE +github.com/prometheus/client_model v0.6.2 NOTICE https://github.com/prometheus/client_model/blob/v0.6.2/NOTICE +github.com/prometheus/common v0.70.1 LICENSE https://github.com/prometheus/common/blob/v0.70.1/LICENSE +github.com/prometheus/common v0.70.1 NOTICE https://github.com/prometheus/common/blob/v0.70.1/NOTICE +github.com/prometheus/procfs v0.21.1 LICENSE https://github.com/prometheus/procfs/blob/v0.21.1/LICENSE +github.com/prometheus/procfs v0.21.1 NOTICE https://github.com/prometheus/procfs/blob/v0.21.1/NOTICE +github.com/regclient/regclient v0.11.5 LICENSE https://github.com/regclient/regclient/blob/v0.11.5/LICENSE +github.com/russross/blackfriday/v2 v2.1.0 LICENSE.txt https://github.com/russross/blackfriday/blob/v2.1.0/LICENSE.txt +github.com/shopspring/decimal v1.4.0 LICENSE https://github.com/shopspring/decimal/blob/v1.4.0/LICENSE +github.com/sirupsen/logrus v1.10.1 LICENSE https://github.com/sirupsen/logrus/blob/v1.10.1/LICENSE +github.com/spf13/cast v1.7.0 LICENSE https://github.com/spf13/cast/blob/v1.7.0/LICENSE +github.com/spf13/cobra v1.10.2 LICENSE.txt https://github.com/spf13/cobra/blob/v1.10.2/LICENSE.txt +github.com/spf13/pflag v1.0.10 LICENSE https://github.com/spf13/pflag/blob/v1.0.10/LICENSE +github.com/stretchr/testify v1.12.0 LICENSE https://github.com/stretchr/testify/blob/v1.12.0/LICENSE +github.com/ulikunitz/xz v0.5.15 LICENSE https://github.com/ulikunitz/xz/blob/v0.5.15/LICENSE +github.com/urfave/cli/v3 v3.10.1 LICENSE https://github.com/urfave/cli/blob/v3.10.1/LICENSE +github.com/x448/float16 v0.8.4 LICENSE https://github.com/x448/float16/blob/v0.8.4/LICENSE +github.com/xlab/treeprint v1.2.0 LICENSE https://github.com/xlab/treeprint/blob/v1.2.0/LICENSE +go.uber.org/multierr v1.11.0 LICENSE.txt https://github.com/uber-go/multierr/blob/v1.11.0/LICENSE.txt +go.uber.org/zap v1.28.0 LICENSE https://github.com/uber-go/zap/blob/v1.28.0/LICENSE +go.yaml.in/yaml/v2 v2.4.4 LICENSE https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE +go.yaml.in/yaml/v2 v2.4.4 LICENSE.libyaml https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE.libyaml +go.yaml.in/yaml/v2 v2.4.4 NOTICE https://github.com/yaml/go-yaml/blob/v2.4.4/NOTICE +go.yaml.in/yaml/v3 v3.0.4 LICENSE https://github.com/yaml/go-yaml/blob/v3.0.4/LICENSE +go.yaml.in/yaml/v3 v3.0.4 NOTICE https://github.com/yaml/go-yaml/blob/v3.0.4/NOTICE +golang.org/x/crypto v0.55.0 LICENSE https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE +golang.org/x/crypto v0.55.0 PATENTS https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/PATENTS +golang.org/x/mod v0.40.0 LICENSE https://go.googlesource.com/mod/+/refs/tags/v0.40.0/LICENSE +golang.org/x/mod v0.40.0 PATENTS https://go.googlesource.com/mod/+/refs/tags/v0.40.0/PATENTS +golang.org/x/net v0.58.0 LICENSE https://go.googlesource.com/net/+/refs/tags/v0.58.0/LICENSE +golang.org/x/net v0.58.0 PATENTS https://go.googlesource.com/net/+/refs/tags/v0.58.0/PATENTS +golang.org/x/oauth2 v0.36.0 LICENSE https://go.googlesource.com/oauth2/+/refs/tags/v0.36.0/LICENSE +golang.org/x/sync v0.22.0 LICENSE https://go.googlesource.com/sync/+/refs/tags/v0.22.0/LICENSE +golang.org/x/sync v0.22.0 PATENTS https://go.googlesource.com/sync/+/refs/tags/v0.22.0/PATENTS +golang.org/x/sys v0.47.0 LICENSE https://go.googlesource.com/sys/+/refs/tags/v0.47.0/LICENSE +golang.org/x/sys v0.47.0 PATENTS https://go.googlesource.com/sys/+/refs/tags/v0.47.0/PATENTS +golang.org/x/term v0.45.0 LICENSE https://go.googlesource.com/term/+/refs/tags/v0.45.0/LICENSE +golang.org/x/term v0.45.0 PATENTS https://go.googlesource.com/term/+/refs/tags/v0.45.0/PATENTS +golang.org/x/text v0.41.0 LICENSE https://go.googlesource.com/text/+/refs/tags/v0.41.0/LICENSE +golang.org/x/text v0.41.0 PATENTS https://go.googlesource.com/text/+/refs/tags/v0.41.0/PATENTS +golang.org/x/time v0.14.0 LICENSE https://go.googlesource.com/time/+/refs/tags/v0.14.0/LICENSE +golang.org/x/time v0.14.0 PATENTS https://go.googlesource.com/time/+/refs/tags/v0.14.0/PATENTS +gomodules.xyz/jsonpatch/v2 v2.4.0 LICENSE https://github.com/gomodules/jsonpatch/blob/v2.4.0/LICENSE +google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af LICENSE https://go.googlesource.com/protobuf/+/f2248ac996af/LICENSE +google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af PATENTS https://go.googlesource.com/protobuf/+/f2248ac996af/PATENTS +gopkg.in/evanphx/json-patch.v4 v4.13.0 LICENSE https://github.com/evanphx/json-patch/blob/v4.13.0/LICENSE +gopkg.in/inf.v0 v0.9.1 LICENSE https://github.com/go-inf/inf/blob/v0.9.1/LICENSE +gopkg.in/yaml.v3 v3.0.1 LICENSE https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE +gopkg.in/yaml.v3 v3.0.1 NOTICE https://github.com/go-yaml/yaml/blob/v3.0.1/NOTICE +k8s.io/api v0.36.4 LICENSE https://github.com/kubernetes/api/blob/v0.36.4/LICENSE +k8s.io/apiextensions-apiserver v0.36.4 LICENSE https://github.com/kubernetes/apiextensions-apiserver/blob/v0.36.4/LICENSE +k8s.io/apimachinery v0.36.4 LICENSE https://github.com/kubernetes/apimachinery/blob/v0.36.4/LICENSE +k8s.io/apimachinery v0.36.4 third_party/forked/golang/LICENSE https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/LICENSE +k8s.io/apimachinery v0.36.4 third_party/forked/golang/PATENTS https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/PATENTS +k8s.io/cli-runtime v0.36.0 LICENSE https://github.com/kubernetes/cli-runtime/blob/v0.36.0/LICENSE +k8s.io/client-go v0.36.4 LICENSE https://github.com/kubernetes/client-go/blob/v0.36.4/LICENSE +k8s.io/client-go v0.36.4 third_party/forked/golang/LICENSE https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/LICENSE +k8s.io/client-go v0.36.4 third_party/forked/golang/PATENTS https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/PATENTS +k8s.io/client-go v0.36.4 third_party/forked/httpcache/LICENSE https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/httpcache/LICENSE +k8s.io/component-base v0.36.4 LICENSE https://github.com/kubernetes/component-base/blob/v0.36.4/LICENSE +k8s.io/klog/v2 v2.140.0 LICENSE https://github.com/kubernetes/klog/blob/v2.140.0/LICENSE +k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25 LICENSE https://github.com/kubernetes/kube-openapi/blob/865597e52e25/LICENSE +k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25 pkg/internal/third_party/go-json-experiment/json/AUTHORS https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/AUTHORS +k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25 pkg/internal/third_party/go-json-experiment/json/LICENSE https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/LICENSE +k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25 pkg/validation/spec/LICENSE https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/validation/spec/LICENSE +k8s.io/kubectl v0.36.0 LICENSE https://github.com/kubernetes/kubectl/blob/v0.36.0/LICENSE +k8s.io/utils v0.0.0-20260507154919-ff6756f316d2 LICENSE https://github.com/kubernetes/utils/blob/ff6756f316d2/LICENSE +k8s.io/utils v0.0.0-20260507154919-ff6756f316d2 internal/third_party/forked/golang/LICENSE https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/LICENSE +k8s.io/utils v0.0.0-20260507154919-ff6756f316d2 internal/third_party/forked/golang/PATENTS https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/PATENTS +k8s.io/utils v0.0.0-20260507154919-ff6756f316d2 third_party/forked/golang/btree/LICENSE https://github.com/kubernetes/utils/blob/ff6756f316d2/third_party/forked/golang/btree/LICENSE +sigs.k8s.io/controller-runtime v0.24.1 LICENSE https://github.com/kubernetes-sigs/controller-runtime/blob/v0.24.1/LICENSE +sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 LICENSE https://github.com/kubernetes-sigs/json/blob/2d320260d730/LICENSE +sigs.k8s.io/kustomize/api v0.21.1 LICENSE https://github.com/kubernetes-sigs/kustomize/blob/api/v0.21.1/LICENSE +sigs.k8s.io/kustomize/kyaml v0.21.1 LICENSE https://github.com/kubernetes-sigs/kustomize/blob/kyaml/v0.21.1/LICENSE +sigs.k8s.io/randfill v1.0.0 LICENSE https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/LICENSE +sigs.k8s.io/randfill v1.0.0 NOTICE https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/NOTICE +sigs.k8s.io/structured-merge-diff/v6 v6.4.0 LICENSE https://github.com/kubernetes-sigs/structured-merge-diff/blob/v6.4.0/LICENSE +sigs.k8s.io/yaml v1.6.0 LICENSE https://github.com/kubernetes-sigs/yaml/blob/v1.6.0/LICENSE diff --git a/tools/module-repos.tsv b/tools/module-repos.tsv new file mode 100644 index 000000000..98cdc2cfc --- /dev/null +++ b/tools/module-repos.tsv @@ -0,0 +1,128 @@ +# Upstream repository for each vendored module. +# Generated by tools/resolve-module-repos.sh from the module proxy Origin, +# the go-import meta tag, and the github.com path shape. Not hand-edited. +# module repo-url subdir +cyphar.com/go-pathrs https://github.com/cyphar/libpathrs go-pathrs +dario.cat/mergo https://github.com/imdario/mergo +github.com/Azure/go-ansiterm https://github.com/Azure/go-ansiterm +github.com/MakeNowJust/heredoc https://github.com/makenowjust/heredoc +github.com/Masterminds/goutils https://github.com/Masterminds/goutils +github.com/Masterminds/semver/v3 https://github.com/Masterminds/semver +github.com/Masterminds/sprig/v3 https://github.com/Masterminds/sprig +github.com/Mellanox/maintenance-operator/api https://github.com/Mellanox/maintenance-operator api +github.com/NVIDIA/go-nvlib https://github.com/NVIDIA/go-nvlib +github.com/NVIDIA/k8s-kata-manager https://github.com/NVIDIA/k8s-kata-manager +github.com/NVIDIA/k8s-operator-libs https://github.com/NVIDIA/k8s-operator-libs +github.com/NVIDIA/nvidia-container-toolkit https://github.com/NVIDIA/nvidia-container-toolkit +github.com/beorn7/perks https://github.com/beorn7/perks +github.com/blang/semver/v4 https://github.com/blang/semver +github.com/cespare/xxhash/v2 https://github.com/cespare/xxhash +github.com/chai2010/gettext-go https://github.com/chai2010/gettext-go +github.com/cyphar/filepath-securejoin https://github.com/cyphar/filepath-securejoin +github.com/davecgh/go-spew https://github.com/davecgh/go-spew +github.com/docker/libtrust https://github.com/docker-archive-public/docker.libtrust +github.com/emicklei/go-restful/v3 https://github.com/emicklei/go-restful +github.com/evanphx/json-patch https://github.com/evanphx/json-patch +github.com/evanphx/json-patch/v5 https://github.com/evanphx/json-patch +github.com/exponent-io/jsonpath https://github.com/exponent-io/jsonpath +github.com/fsnotify/fsnotify https://github.com/fsnotify/fsnotify +github.com/fxamacker/cbor/v2 https://github.com/fxamacker/cbor +github.com/go-errors/errors https://github.com/go-errors/errors +github.com/go-logr/logr https://github.com/go-logr/logr +github.com/go-logr/zapr https://github.com/go-logr/zapr +github.com/go-openapi/jsonpointer https://github.com/go-openapi/jsonpointer +github.com/go-openapi/jsonreference https://github.com/go-openapi/jsonreference +github.com/go-openapi/swag https://github.com/go-openapi/swag +github.com/go-openapi/swag/cmdutils https://github.com/go-openapi/swag cmdutils +github.com/go-openapi/swag/conv https://github.com/go-openapi/swag conv +github.com/go-openapi/swag/fileutils https://github.com/go-openapi/swag fileutils +github.com/go-openapi/swag/jsonname https://github.com/go-openapi/swag jsonname +github.com/go-openapi/swag/jsonutils https://github.com/go-openapi/swag jsonutils +github.com/go-openapi/swag/loading https://github.com/go-openapi/swag loading +github.com/go-openapi/swag/mangling https://github.com/go-openapi/swag mangling +github.com/go-openapi/swag/netutils https://github.com/go-openapi/swag netutils +github.com/go-openapi/swag/stringutils https://github.com/go-openapi/swag stringutils +github.com/go-openapi/swag/typeutils https://github.com/go-openapi/swag typeutils +github.com/go-openapi/swag/yamlutils https://github.com/go-openapi/swag yamlutils +github.com/go-task/slim-sprig/v3 https://github.com/go-task/slim-sprig +github.com/google/btree https://github.com/google/btree +github.com/google/gnostic-models https://github.com/google/gnostic-models +github.com/google/go-cmp https://github.com/google/go-cmp +github.com/google/pprof https://github.com/google/pprof +github.com/google/uuid https://github.com/google/uuid +github.com/huandu/xstrings https://github.com/huandu/xstrings +github.com/inconshreveable/mousetrap https://github.com/inconshreveable/mousetrap +github.com/json-iterator/go https://github.com/json-iterator/go +github.com/klauspost/compress https://github.com/klauspost/compress +github.com/liggitt/tabwriter https://github.com/liggitt/tabwriter +github.com/mitchellh/copystructure https://github.com/mitchellh/copystructure +github.com/mitchellh/go-wordwrap https://github.com/mitchellh/go-wordwrap +github.com/mitchellh/reflectwalk https://github.com/mitchellh/reflectwalk +github.com/moby/term https://github.com/moby/term +github.com/modern-go/concurrent https://github.com/modern-go/concurrent +github.com/modern-go/reflect2 https://github.com/modern-go/reflect2 +github.com/monochromegane/go-gitignore https://github.com/monochromegane/go-gitignore +github.com/munnerz/goautoneg https://github.com/munnerz/goautoneg +github.com/onsi/ginkgo/v2 https://github.com/onsi/ginkgo +github.com/onsi/gomega https://github.com/onsi/gomega +github.com/opencontainers/cgroups https://github.com/opencontainers/cgroups +github.com/opencontainers/go-digest https://github.com/opencontainers/go-digest +github.com/opencontainers/runc https://github.com/opencontainers/runc +github.com/openshift/api https://github.com/openshift/api +github.com/openshift/client-go https://github.com/openshift/client-go +github.com/operator-framework/api https://github.com/operator-framework/api +github.com/peterbourgon/diskv https://github.com/peterbourgon/diskv +github.com/pmezard/go-difflib https://github.com/pmezard/go-difflib +github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring https://github.com/prometheus-operator/prometheus-operator pkg/apis/monitoring +github.com/prometheus/client_golang https://github.com/prometheus/client_golang +github.com/prometheus/client_model https://github.com/prometheus/client_model +github.com/prometheus/common https://github.com/prometheus/common +github.com/prometheus/procfs https://github.com/prometheus/procfs +github.com/regclient/regclient https://github.com/regclient/regclient +github.com/russross/blackfriday/v2 https://github.com/russross/blackfriday +github.com/shopspring/decimal https://github.com/shopspring/decimal +github.com/sirupsen/logrus https://github.com/sirupsen/logrus +github.com/spf13/cast https://github.com/spf13/cast +github.com/spf13/cobra https://github.com/spf13/cobra +github.com/spf13/pflag https://github.com/spf13/pflag +github.com/stretchr/testify https://github.com/stretchr/testify +github.com/ulikunitz/xz https://github.com/ulikunitz/xz +github.com/urfave/cli/v3 https://github.com/urfave/cli +github.com/x448/float16 https://github.com/x448/float16 +github.com/xlab/treeprint https://github.com/xlab/treeprint +go.uber.org/multierr https://github.com/uber-go/multierr +go.uber.org/zap https://github.com/uber-go/zap +go.yaml.in/yaml/v2 https://github.com/yaml/go-yaml +go.yaml.in/yaml/v3 https://github.com/yaml/go-yaml +golang.org/x/crypto https://go.googlesource.com/crypto +golang.org/x/mod https://go.googlesource.com/mod +golang.org/x/net https://go.googlesource.com/net +golang.org/x/oauth2 https://go.googlesource.com/oauth2 +golang.org/x/sync https://go.googlesource.com/sync +golang.org/x/sys https://go.googlesource.com/sys +golang.org/x/term https://go.googlesource.com/term +golang.org/x/text https://go.googlesource.com/text +golang.org/x/time https://go.googlesource.com/time +golang.org/x/tools https://go.googlesource.com/tools +gomodules.xyz/jsonpatch/v2 https://github.com/gomodules/jsonpatch +google.golang.org/protobuf https://go.googlesource.com/protobuf +gopkg.in/evanphx/json-patch.v4 https://github.com/evanphx/json-patch +gopkg.in/inf.v0 https://github.com/go-inf/inf +gopkg.in/yaml.v3 https://github.com/go-yaml/yaml +k8s.io/api https://github.com/kubernetes/api +k8s.io/apiextensions-apiserver https://github.com/kubernetes/apiextensions-apiserver +k8s.io/apimachinery https://github.com/kubernetes/apimachinery +k8s.io/cli-runtime https://github.com/kubernetes/cli-runtime +k8s.io/client-go https://github.com/kubernetes/client-go +k8s.io/component-base https://github.com/kubernetes/component-base +k8s.io/klog/v2 https://github.com/kubernetes/klog +k8s.io/kube-openapi https://github.com/kubernetes/kube-openapi +k8s.io/kubectl https://github.com/kubernetes/kubectl +k8s.io/utils https://github.com/kubernetes/utils +sigs.k8s.io/controller-runtime https://github.com/kubernetes-sigs/controller-runtime +sigs.k8s.io/json https://github.com/kubernetes-sigs/json +sigs.k8s.io/kustomize/api https://github.com/kubernetes-sigs/kustomize api +sigs.k8s.io/kustomize/kyaml https://github.com/kubernetes-sigs/kustomize kyaml +sigs.k8s.io/randfill https://github.com/kubernetes-sigs/randfill +sigs.k8s.io/structured-merge-diff/v6 https://github.com/kubernetes-sigs/structured-merge-diff +sigs.k8s.io/yaml https://github.com/kubernetes-sigs/yaml diff --git a/tools/resolve-module-repos.sh b/tools/resolve-module-repos.sh new file mode 100755 index 000000000..58c7a16f9 --- /dev/null +++ b/tools/resolve-module-repos.sh @@ -0,0 +1,173 @@ +#!/usr/bin/env bash +# Copyright (c) NVIDIA CORPORATION. All rights reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# Resolves every module in vendor/modules.txt to its upstream repository and +# writes tools/module-repos.tsv. +# +# Needs network; run via 'make third-party-notices-repos'. Keyed by module and +# not by version: a repository normally does not move when a dependency is +# bumped, so this file survives bumps and changes only when a new module enters +# the tree. That is a convenience, not a guarantee — Task 5's content +# verification is what actually enforces correctness, and it fails loudly if a +# mapping has gone stale. + +set -euo pipefail + +HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +# shellcheck source=tools/license-url-lib.sh disable=SC1091 +source "${HERE}/license-url-lib.sh" + +MODULES_TXT="${MODULES_TXT:-vendor/modules.txt}" +OUTPUT="${OUTPUT:-tools/module-repos.tsv}" +PROXY="${PROXY:-https://proxy.golang.org}" + +die() { + printf 'ERROR: %s\n' "$1" >&2 + shift + (( $# > 0 )) && printf '%s\n' "$@" >&2 + exit 1 +} +log() { printf '%s\n' "$*" >&2; } + +# Retries cover genuine network flakiness only. Absence of Origin is a real, +# permanent property of older proxy cache entries, not a transient failure. +fetch_retry() { + local url="$1" attempt body + for attempt in 1 2 3; do + body="$(curl -sfL --max-time 30 "${url}" 2>/dev/null)" || body="" + [[ -n "${body}" ]] && { printf '%s' "${body}"; return 0; } + sleep $(( attempt * 2 )) + done + return 1 +} + +origin_field() { + printf '%s' "$1" | python3 -c ' +import json, sys +try: + origin = json.load(sys.stdin).get("Origin") or {} +except Exception: + origin = {} +print(origin.get(sys.argv[1], "")) +' "$2" 2>/dev/null || printf '' +} + +# go-import content is " ". The meta tag is +# frequently split across lines, so newlines are folded before matching. +go_import_meta() { + fetch_retry "https://$1?go-get=1" 2>/dev/null \ + | tr '\n' ' ' | tr -s ' ' \ + | LC_ALL=C grep -oE 'name="go-import"[^>]*content="[^"]*"' \ + | head -1 \ + | LC_ALL=C sed -E 's/.*content="([^"]*)".*/\1/' +} + +main() { + command -v curl >/dev/null 2>&1 || die "curl is not installed." + command -v python3 >/dev/null 2>&1 || die "python3 is not installed." + [[ -f "${MODULES_TXT}" ]] \ + || die "${MODULES_TXT} not found — run 'make third-party-notices-repos' from the repo root." + + local repos_tmp_file unresolved=0 + repos_tmp_file="$(mktemp "${TMPDIR:-/tmp}/gpu-operator-repos.XXXXXX")" + trap 'rm -f "${repos_tmp_file}"' EXIT + + local module version module_info_json repo import_prefix subdir go_import_meta_content converted_repo_url + local unresolved_modules="" + while read -r module version; do + [[ -z "${module}" ]] && continue + + repo=""; import_prefix=""; subdir=""; module_info_json="" + + if module_info_json="$(fetch_retry "${PROXY}/$(proxy_escape "${module}")/@v/${version}.info")"; then + repo="$(origin_field "${module_info_json}" URL)" + subdir="$(origin_field "${module_info_json}" Subdir)" + fi + + if [[ -z "${repo}" ]]; then + go_import_meta_content="$(go_import_meta "${module}")" || go_import_meta_content="" + if [[ -n "${go_import_meta_content}" ]]; then + import_prefix="$(printf '%s' "${go_import_meta_content}" | awk '{print $1}')" + repo="$(printf '%s' "${go_import_meta_content}" | awk '{print $3}')" + fi + fi + + [[ -z "${repo}" ]] && repo="$(github_repo_from_path "${module}")" + repo="$(normalize_repo_url "${repo}")" + + # gopkg.in points at itself and serves no blobs. + case "${repo}" in + https://gopkg.in/*|"") + converted_repo_url="$(gopkg_in_repo "${module}")" + [[ -n "${converted_repo_url}" ]] && repo="${converted_repo_url}" + ;; + esac + + if [[ -z "${repo}" ]]; then + log "UNRESOLVED ${module}: no repository could be determined" + unresolved=$(( unresolved + 1 )) + unresolved_modules="${unresolved_modules}${unresolved_modules:+ }${module}" + continue + fi + + # Subdir precedence: proxy Origin, then the go-import prefix, then the + # github path shape. The last matters because GitHub serves no + # go-import, so a github submodule with no Origin would otherwise lose + # its tag prefix and never verify. + if [[ -z "${subdir}" && -n "${import_prefix}" ]]; then + subdir="$(derived_subdir "${module}" "${import_prefix}")" + fi + if [[ -z "${subdir}" ]]; then + subdir="$(github_subdir_from_path "${module}")" + fi + + printf '%s\t%s\t%s\n' "${module}" "${repo}" "${subdir}" >> "${repos_tmp_file}" + done < <(LC_ALL=C grep '^# ' "${MODULES_TXT}" | awk '{print $2, $3}') + + # A warning, not a die: this resolves every module in modules.txt, including + # the ten-odd build/test-only ones out of scope for the notices document, so + # an unreachable vanity host on one of those must not block refreshing + # notices for an unrelated shipped bump. Fail-closed is still preserved — + # tools/verify-license-urls.sh dies when an IN-SCOPE module has no entry in + # this map. Do not turn this back into a die without also scoping the loop + # above to shipped modules only. + if (( unresolved > 0 )); then + log "WARNING: ${unresolved} module(s) could not be resolved to a repository: ${unresolved_modules}" + log "Re-run; if the warning persists the module's vanity host is unreachable." + fi + + { + printf '# Upstream repository for each vendored module.\n' + printf '# Generated by tools/resolve-module-repos.sh from the module proxy Origin,\n' + printf '# the go-import meta tag, and the github.com path shape. Not hand-edited.\n' + printf '# module\trepo-url\tsubdir\n' + LC_ALL=C sort "${repos_tmp_file}" + } > "${OUTPUT}" + + log "Wrote ${OUTPUT} ($(LC_ALL=C grep -vc '^#' "${OUTPUT}") modules)" + + # Exit here, not by falling off the end: the EXIT trap above references + # repos_tmp_file, a variable local to this function. If main merely + # returns, the process's implicit exit fires that trap after + # repos_tmp_file has gone out of scope, and 'set -u' turns the cleanup + # itself into an unbound-variable failure that clobbers this function's + # success with exit 1. + exit 0 +} + +if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then + main "$@" +fi diff --git a/tools/test-helpers.sh b/tools/test-helpers.sh new file mode 100644 index 000000000..2a37e1f6a --- /dev/null +++ b/tools/test-helpers.sh @@ -0,0 +1,45 @@ +#!/usr/bin/env bash +# Copyright (c) NVIDIA CORPORATION. All rights reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +TESTS_RUN=0 +TESTS_FAILED=0 + +assert_eq() { + local expected="$1" actual="$2" description="$3" + TESTS_RUN=$(( TESTS_RUN + 1 )) + if [[ "${expected}" != "${actual}" ]]; then + TESTS_FAILED=$(( TESTS_FAILED + 1 )) + printf 'FAIL: %s\n expected: [%s]\n actual: [%s]\n' \ + "${description}" "${expected}" "${actual}" >&2 + fi +} + +# Output is captured so an expected failure does not pollute the log. +assert_fails() { + local description="$1" + shift + TESTS_RUN=$(( TESTS_RUN + 1 )) + if "$@" >/dev/null 2>&1; then + TESTS_FAILED=$(( TESTS_FAILED + 1 )) + printf 'FAIL: %s\n expected non-zero exit, got 0\n' "${description}" >&2 + fi +} + +finish() { + printf '%s: %d assertions, %d failures\n' \ + "$(basename "${0}")" "${TESTS_RUN}" "${TESTS_FAILED}" >&2 + (( TESTS_FAILED == 0 )) +} diff --git a/tools/verify-license-urls.sh b/tools/verify-license-urls.sh new file mode 100644 index 000000000..3df4cbb17 --- /dev/null +++ b/tools/verify-license-urls.sh @@ -0,0 +1,226 @@ +#!/usr/bin/env bash +# Copyright (c) NVIDIA CORPORATION. All rights reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Resolves and verifies the upstream URL of every license file the notices +# document links, writing tools/license-urls.tsv. +# +# Needs network; run via 'make third-party-notices-urls'. A URL is written ONLY +# if the bytes it serves hash to the same sha256 as the vendored copy, so no +# entry can be a dead link or point at the wrong licence. +# +# Scope is the shipped set: this sources the notices generator and runs its +# collection stages, so it verifies exactly the packages go-licenses attributes +# to ./cmd/..., never the build- and test-only modules vendor/ also contains. + +set -euo pipefail + +HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +# shellcheck source=tools/license-url-lib.sh disable=SC1091 +source "${HERE}/license-url-lib.sh" +# shellcheck source=tools/generate-third-party-notices.sh disable=SC1091 +source "${HERE}/generate-third-party-notices.sh" + +REPOS_MAP="${REPOS_MAP:-tools/module-repos.tsv}" +URLS_OUTPUT="${URLS_OUTPUT:-tools/license-urls.tsv}" +PROXY="${PROXY:-https://proxy.golang.org}" + +sha256_of_file() { + if command -v sha256sum >/dev/null 2>&1; then + sha256sum "$1" | cut -d' ' -f1 + else + shasum -a 256 "$1" | cut -d' ' -f1 + fi +} + +sha256_of_stdin() { + if command -v sha256sum >/dev/null 2>&1; then + sha256sum | cut -d' ' -f1 + else + shasum -a 256 | cut -d' ' -f1 + fi +} + +remote_sha() { + local blob="$1" raw + raw="$(raw_url_for "${blob}")" + [[ -n "${raw}" ]] || return 1 + if raw_is_base64 "${blob}"; then + curl -sfL --max-time 30 "${raw}" 2>/dev/null | base64_decode 2>/dev/null | sha256_of_stdin + else + curl -sfL --max-time 30 "${raw}" 2>/dev/null | sha256_of_stdin + fi +} + +repo_field() { + LC_ALL=C awk -F'\t' -v m="$1" -v want="$2" \ + '$1 == m { print (want == "repo" ? $2 : $3); found = 1; exit } + END { exit !found }' "${REPOS_MAP}" +} + +# Version-specific provenance. Fetched here rather than stored in the repos map, +# which is deliberately version-independent. Origin.Hash is the only pinned ref +# left when upstream deletes or rewrites a tag. +origin_ref_and_hash() { + local module="$1" version="$2" info + info="$(curl -sfL --max-time 30 \ + "${PROXY}/$(proxy_escape "${module}")/@v/${version}.info" 2>/dev/null)" || return 0 + printf '%s' "${info}" | python3 -c ' +import json, sys +try: + origin = json.load(sys.stdin).get("Origin") or {} +except Exception: + origin = {} +ref = origin.get("Ref", "") +# Only a tag pins a release. Every golang.org/x module reports +# refs/heads/master, and a branch ref would float. +print(ref[len("refs/tags/"):] if ref.startswith("refs/tags/") else "") +print(origin.get("Hash", "")) +' 2>/dev/null || printf '\n\n' +} + +main() { + command -v curl >/dev/null 2>&1 || die "curl is not installed." + command -v python3 >/dev/null 2>&1 || die "python3 is not installed." + [[ -f "${REPOS_MAP}" ]] \ + || die "${REPOS_MAP} not found — run 'make third-party-notices-repos' first." + + check_prerequisites + verify_platform_matrix + prepare_workspace + collect_licenses + build_indexes + + local verified_urls_tmp_file failures=0 + verified_urls_tmp_file="$(mktemp "${TMPDIR:-/tmp}/gpu-operator-urls.XXXXXX")" + + local package _ module version repo subdir relative + local origin_tag origin_hash plain_version pseudo_version_hash_value license_file name path_in_module want_sha found_url + while IFS=, read -r package _ _ module version; do + [[ -z "${package}" ]] && continue + + repo="$(repo_field "${module}" repo)" \ + || die "${REPOS_MAP} has no entry for ${module}." \ + "Run 'make third-party-notices-repos' and commit the result." + subdir="$(repo_field "${module}" subdir)" || subdir="" + + origin_tag="$(origin_ref_and_hash "${module}" "${version}" | sed -n 1p)" + origin_hash="$(origin_ref_and_hash "${module}" "${version}" | sed -n 2p)" + + # Ref candidates, most specific first. Never a branch ref. Commit + # hashes (pseudo-version hash, Origin.Hash) are tracked apart from tag + # names: go.googlesource.com serves a tag under refs/tags/ but a raw + # commit only under its bare hash, so qualifying a hash the same way + # 404s a pseudo-versioned module such as google.golang.org/protobuf. + local tag_refs=() hash_refs=() + plain_version="$(normalize_version "${version}")" + pseudo_version_hash_value="$(pseudo_version_hash "${version}")" + [[ -n "${origin_tag}" ]] && tag_refs+=( "${origin_tag}" ) + if [[ -n "${pseudo_version_hash_value}" ]]; then + hash_refs+=( "${pseudo_version_hash_value}" ) + else + [[ -n "${subdir}" ]] && tag_refs+=( "${subdir}/${plain_version}" ) + tag_refs+=( "${plain_version}" ) + fi + [[ -n "${origin_hash}" ]] && hash_refs+=( "${origin_hash}" ) + + local refs=() tag_ref + if (( ${#tag_refs[@]} > 0 )); then + case "${repo}" in + https://go.googlesource.com/*) + for tag_ref in "${tag_refs[@]}"; do refs+=( "refs/tags/${tag_ref}" ); done + ;; + *) + refs+=( "${tag_refs[@]}" ) + ;; + esac + fi + (( ${#hash_refs[@]} > 0 )) && refs+=( "${hash_refs[@]}" ) + (( ${#refs[@]} > 0 )) || die "no ref candidates for ${module}@${version}." + + relative="$(license_dir_within_module "${package}" "${module}")" \ + || die "no license file found for ${package} under ${VENDOR_DIR}/${module}." + + local license_file_count=0 + while IFS= read -r license_file; do + [[ -z "${license_file}" ]] && continue + license_file_count=$(( license_file_count + 1 )) + name="$(basename "${license_file}")" + path_in_module="${relative:+${relative}/}${name}" + [[ -f "${VENDOR_DIR}/${module}/${path_in_module}" ]] \ + || die "${VENDOR_DIR}/${module}/${path_in_module} does not exist." + want_sha="$(sha256_of_file "${VENDOR_DIR}/${module}/${path_in_module}")" + + # Both layouts: a submodule may ship its own licence or inherit the + # repository root's. Content decides which is real. Built as an + # array rather than an unquoted ${x:+...} expansion, which would + # word-split a path containing whitespace or a glob character. + local paths=() + [[ -n "${subdir}" ]] && paths+=( "${subdir}/${path_in_module}" ) + paths+=( "${path_in_module}" ) + + found_url="" + local try_ref try_path candidate remote_sha_value + for try_ref in "${refs[@]}"; do + for try_path in "${paths[@]}"; do + candidate="$(blob_url "${repo}" "${try_ref}" "${try_path}")" + # remote_sha's own exit status must gate the match: curl + # failing (404, DNS, timeout, rate-limit) yields no bytes, + # and sha256 of no bytes is a real, fixed hash value — so + # checking only the printed string would treat a failed + # fetch as a match against any zero-byte vendored file. + if remote_sha_value="$(remote_sha "${candidate}")" && [[ "${remote_sha_value}" == "${want_sha}" ]]; then + found_url="${candidate}" + break 2 + fi + done + done + + if [[ -z "${found_url}" ]]; then + log "UNVERIFIED ${module}@${version} ${path_in_module}" + failures=$(( failures + 1 )) + continue + fi + printf '%s\t%s\t%s\t%s\n' "${module}" "${version}" "${path_in_module}" "${found_url}" >> "${verified_urls_tmp_file}" + done < <(license_files_for "${VENDOR_DIR}/${module}${relative:+/${relative}}") + + if (( license_file_count == 0 )); then + log "UNVERIFIED ${module}@${version} — no license file found for ${package}" + failures=$(( failures + 1 )) + fi + done < "${INDEX_FILE}" + + (( failures == 0 )) || die \ + "${failures} license file(s) could not be matched to a verified upstream URL." \ + "Every URL must serve bytes identical to the vendored copy; none of the" \ + "candidates did. The repository mapping may be stale — re-run" \ + "'make third-party-notices-repos' before investigating further." + + { + printf '# Verified upstream URL for every license file the notices document links.\n' + printf '# Generated by tools/verify-license-urls.sh. Each URL was fetched and its\n' + printf '# sha256 matched against the vendored copy, so no entry is a dead or wrong link.\n' + printf '# Covers the shipped set only: build- and test-only dependencies are excluded.\n' + printf '# module\tversion\tlicense-path\turl\n' + LC_ALL=C sort -u "${verified_urls_tmp_file}" + } > "${URLS_OUTPUT}" + rm -f "${verified_urls_tmp_file}" + + log "Wrote ${URLS_OUTPUT} ($(LC_ALL=C grep -vc '^#' "${URLS_OUTPUT}") verified URLs)" + exit 0 +} + +if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then + main "$@" +fi