[janhoy]

🤖 AI assisted 🤖

Problem

make lint and the smoke test fail at random on check-licenses, on whichever PR runs while a shared runner is throttled. #889 passed at 00:30 and failed at 08:07 with no dependency change in between, and an unrelated branch failed in the same window on the same two rows.

< gomodules.xyz/jsonpatch/v2,https://github.com/gomodules/jsonpatch/blob/v2.5.0/v2/LICENSE,Apache-2.0
---
> gomodules.xyz/jsonpatch/v2,https://github.com/gomodules/jsonpatch/blob/v2.5.0/LICENSE,Apache-2.0

go-licenses report resolves the second column, the link to each license file, over the network: for a major version above v1 it probes the remote to tell the "major branch" and "major subdirectory" conventions apart. Running the current command four ways gives three different answers for that row, .../v2/LICENSE when the probe succeeds, .../LICENSE or Unknown when it fails. Only two dependencies can move, the two whose license file sits at the repository root rather than beside the go.mod.

The answer a successful probe gives is the wrong one, so the link in the file today is dead:

404  https://github.com/gomodules/jsonpatch/blob/v2.5.0/v2/LICENSE
200  https://github.com/gomodules/jsonpatch/blob/v2.5.0/LICENSE

And not only those two. Checking all 78 URLs in the file, 13 are dead: the other 11 are go-openapi/swag submodules, wrong the same way but consistently rather than intermittently, so they have never broken CI. The column has been 17% dead links.

Upstream #73 has the analysis and #131 the resulting 404s, both open: the Go module cache copies a repository-root LICENSE into a nested module that lacks one, so the tool finds it at the module root and guesses a path that was never there. Not new to us either, the bad URL has been in the file since the v1.5.0 bump in November 2022.

Solution

Render the report through --template, a documented go-licenses flag, and put the module version in that column instead of the link. The version comes from the module graph, so it needs no network and cannot drift.

gomodules.xyz/jsonpatch/v2,v2.5.0,Apache-2.0

The report now hashes identically across repeated runs, with the network blocked, and against the committed file. No license data changes: same 78 rows, and diff <(cut -d, -f1,3 old) <(cut -d, -f1,3 new) is empty. The GOOS=linux GOARCH=amd64 prefix is untouched, so the list still reflects the Linux build graph.

Rejected alternatives

• Bump go-licenses. v2.0.1 is the latest release and the upstream fix is unmerged.
• Just regenerate the CSV. The correct URL only appears when the probe fails, so the next regeneration on a healthy network restores the 404 form.
• Compare only columns 1 and 3. Green CI, but leaves all 13 dead URLs in a compliance artifact and make prepare still rewrites them.
• Build a pkg.go.dev link. Tried it; the template exposes the package path, not the module path, so three k8s.io/kube-openapi entries came out as 404s.
• Drop the column. Also deterministic, but the version is worth keeping: it is information the file never recorded, and for license review it beats a link that may not resolve.

[janhoy]

@HoustonPutman This has been an issue for a few years but we have not encountered it before due to not updating the file very often. And it's a flaky condition that most often would be fixed with a CI check re-run. But that's annoying so if we sacrifice the URLs as proposed, at least we'd get a stable check, but you'd need to find the license URL yourself based on module and version.