Skip to content

Make the dependency license list deterministic #896

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
janhoy merged 1 commit into from
Nov 10, 2026
+109 −80
Merged

Make the dependency license list deterministic #896

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,8 @@ GO_LICENSES_VERSION=v2.0.1
# matter which platform a developer generates it on (e.g. darwin/arm64 would
# otherwise omit Linux-only deps such as github.com/prometheus/procfs).
GO_LICENSES_ENV=GOOS=linux GOARCH=amd64
# Report template that keeps the dependency license list deterministic, see the file's own comment.
LICENSE_REPORT_TEMPLATE=hack/licenses/dependency_licenses.csv.tmpl
GINKGO_VERSION = $(shell cat go.mod | grep 'github.com/onsi/ginkgo' | sed 's/.*\(v.*\)$$/\1/g')
KIND_VERSION=v0.33.0
YQ_VERSION=v4.54.1
Expand Down Expand Up @@ -138,7 +140,7 @@ fmt: ## Run go fmt against code.
.PHONY: fetch-licenses-list
# Ignore non-Go code warnings when it is supported natively: https://github.com/google/go-licenses/issues/120
fetch-licenses-list: mod-tidy go-licenses ## Fetch the list of license types
$(GO_LICENSES_ENV) $(GO_LICENSES) report . --ignore github.com/apache/solr-operator > dependency_licenses.csv
$(GO_LICENSES_ENV) $(GO_LICENSES) report . --ignore github.com/apache/solr-operator --template $(LICENSE_REPORT_TEMPLATE) > dependency_licenses.csv

.PHONY: fetch-licenses-full
fetch-licenses-full: go-licenses ## Fetch all licenses
Expand Down Expand Up @@ -259,7 +261,7 @@ check-licenses: go-licenses ## Ensure the licenses for dependencies are valid an
@echo "Check list of dependency licenses"
$(GO_LICENSES_ENV) $(GO_LICENSES) check . \
--allowed_licenses=Apache-2.0,Apache-1.1,MIT,BSD-3-Clause,BSD-2-Clause,ISC,ICU,X11,NCSA,W3C,AFL-3.0,MS-PL,CC0-1.0,BSL-1.0,WTFPL,Unicode-DFS-2015,Unicode-DFS-2016,ZPL-2.0,UPL-1.0,Unlicense,MPL-2.0
$(GO_LICENSES_ENV) $(GO_LICENSES) report . --ignore github.com/apache/solr-operator 2>/dev/null | diff dependency_licenses.csv -
$(GO_LICENSES_ENV) $(GO_LICENSES) report . --ignore github.com/apache/solr-operator --template $(LICENSE_REPORT_TEMPLATE) 2>/dev/null | diff dependency_licenses.csv -

.PHONY: check-zk-op-version
check-zk-op-version: export PATH:=$(LOCALBIN):${PATH}
Expand Down
156 changes: 78 additions & 78 deletions dependency_licenses.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,78 +1,78 @@
github.com/beorn7/perks/quantile,https://github.com/beorn7/perks/blob/v1.0.1/LICENSE,MIT
github.com/cespare/xxhash/v2,https://github.com/cespare/xxhash/blob/v2.3.0/LICENSE.txt,MIT
github.com/davecgh/go-spew/spew,https://github.com/davecgh/go-spew/blob/d8f796af33cc/LICENSE,ISC
github.com/emicklei/go-restful/v3,https://github.com/emicklei/go-restful/blob/v3.13.0/LICENSE,MIT
github.com/evanphx/json-patch/v5,https://github.com/evanphx/json-patch/blob/v5.9.11/v5/LICENSE,BSD-3-Clause
github.com/fsnotify/fsnotify,https://github.com/fsnotify/fsnotify/blob/v1.10.1/LICENSE,BSD-3-Clause
github.com/fxamacker/cbor/v2,https://github.com/fxamacker/cbor/blob/v2.9.2/LICENSE,MIT
github.com/go-logr/logr,https://github.com/go-logr/logr/blob/v1.4.4/LICENSE,Apache-2.0
github.com/go-logr/zapr,https://github.com/go-logr/zapr/blob/v1.3.0/LICENSE,Apache-2.0
github.com/go-openapi/jsonpointer,https://github.com/go-openapi/jsonpointer/blob/v1.0.0/LICENSE,Apache-2.0
github.com/go-openapi/jsonreference,https://github.com/go-openapi/jsonreference/blob/v1.0.0/LICENSE,Apache-2.0
github.com/go-openapi/swag,https://github.com/go-openapi/swag/blob/v0.27.1/LICENSE,Apache-2.0
github.com/go-openapi/swag/cmdutils,https://github.com/go-openapi/swag/blob/cmdutils/v0.27.1/cmdutils/LICENSE,Apache-2.0
github.com/go-openapi/swag/conv,https://github.com/go-openapi/swag/blob/conv/v0.27.1/conv/LICENSE,Apache-2.0
github.com/go-openapi/swag/fileutils,https://github.com/go-openapi/swag/blob/fileutils/v0.27.1/fileutils/LICENSE,Apache-2.0
github.com/go-openapi/swag/jsonutils,https://github.com/go-openapi/swag/blob/jsonutils/v0.27.1/jsonutils/LICENSE,Apache-2.0
github.com/go-openapi/swag/loading,https://github.com/go-openapi/swag/blob/loading/v0.27.1/loading/LICENSE,Apache-2.0
github.com/go-openapi/swag/mangling,https://github.com/go-openapi/swag/blob/mangling/v0.27.1/mangling/LICENSE,Apache-2.0
github.com/go-openapi/swag/netutils,https://github.com/go-openapi/swag/blob/netutils/v0.27.1/netutils/LICENSE,Apache-2.0
github.com/go-openapi/swag/pools,https://github.com/go-openapi/swag/blob/pools/v0.27.1/pools/LICENSE,Apache-2.0
github.com/go-openapi/swag/stringutils,https://github.com/go-openapi/swag/blob/stringutils/v0.27.1/stringutils/LICENSE,Apache-2.0
github.com/go-openapi/swag/typeutils,https://github.com/go-openapi/swag/blob/typeutils/v0.27.1/typeutils/LICENSE,Apache-2.0
github.com/go-openapi/swag/yamlutils,https://github.com/go-openapi/swag/blob/yamlutils/v0.27.1/yamlutils/LICENSE,Apache-2.0
github.com/google/gnostic-models,https://github.com/google/gnostic-models/blob/v0.7.1/LICENSE,Apache-2.0
github.com/google/uuid,https://github.com/google/uuid/blob/v1.6.0/LICENSE,BSD-3-Clause
github.com/gorilla/websocket,https://github.com/gorilla/websocket/blob/e064f32e3674/LICENSE,BSD-2-Clause
github.com/json-iterator/go,https://github.com/json-iterator/go/blob/v1.1.12/LICENSE,MIT
github.com/moby/spdystream,https://github.com/moby/spdystream/blob/v0.5.1/LICENSE,Apache-2.0
github.com/moby/spdystream/spdy,https://github.com/moby/spdystream/blob/v0.5.1/spdy/LICENSE,BSD-3-Clause
github.com/modern-go/concurrent,https://github.com/modern-go/concurrent/blob/bacd9c7ef1dd/LICENSE,Apache-2.0
github.com/modern-go/reflect2,https://github.com/modern-go/reflect2/blob/35a7c28c31ee/LICENSE,Apache-2.0
github.com/munnerz/goautoneg,https://github.com/munnerz/goautoneg/blob/a7dc8b61c822/LICENSE,BSD-3-Clause
github.com/pmezard/go-difflib/difflib,https://github.com/pmezard/go-difflib/blob/5d4384ee4fb2/LICENSE,BSD-3-Clause
github.com/pravega/zookeeper-operator/api/v1beta1,https://github.com/pravega/zookeeper-operator/blob/v0.2.15/LICENSE,Apache-2.0
github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil,https://github.com/prometheus/client_golang/blob/v1.24.0/internal/github.com/golang/gddo/LICENSE,BSD-3-Clause
github.com/prometheus/client_golang/prometheus,https://github.com/prometheus/client_golang/blob/v1.24.0/LICENSE,Apache-2.0
github.com/prometheus/client_model/go,https://github.com/prometheus/client_model/blob/v0.6.2/LICENSE,Apache-2.0
github.com/prometheus/common,https://github.com/prometheus/common/blob/v0.70.0/LICENSE,Apache-2.0
github.com/prometheus/procfs,https://github.com/prometheus/procfs/blob/v0.21.1/LICENSE,Apache-2.0
github.com/robfig/cron/v3,https://github.com/robfig/cron/blob/v3.0.1/LICENSE,MIT
github.com/spf13/pflag,https://github.com/spf13/pflag/blob/v1.0.10/LICENSE,BSD-3-Clause
github.com/x448/float16,https://github.com/x448/float16/blob/v0.8.4/LICENSE,MIT
go.uber.org/multierr,https://github.com/uber-go/multierr/blob/v1.11.0/LICENSE.txt,MIT
go.uber.org/zap,https://github.com/uber-go/zap/blob/v1.28.0/LICENSE,MIT
go.yaml.in/yaml/v2,https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE,Apache-2.0
go.yaml.in/yaml/v3,https://github.com/yaml/go-yaml/blob/v3.0.5/LICENSE,MIT
golang.org/x/net,https://cs.opensource.google/go/x/net/+/v0.61.0:LICENSE,BSD-3-Clause
golang.org/x/oauth2,https://cs.opensource.google/go/x/oauth2/+/v0.36.0:LICENSE,BSD-3-Clause
golang.org/x/sync/errgroup,https://cs.opensource.google/go/x/sync/+/v0.24.0:LICENSE,BSD-3-Clause
golang.org/x/sys/unix,https://cs.opensource.google/go/x/sys/+/v0.49.0:LICENSE,BSD-3-Clause
golang.org/x/term,https://cs.opensource.google/go/x/term/+/v0.47.0:LICENSE,BSD-3-Clause
golang.org/x/text,https://cs.opensource.google/go/x/text/+/v0.43.0:LICENSE,BSD-3-Clause
golang.org/x/time/rate,https://cs.opensource.google/go/x/time/+/v0.15.0:LICENSE,BSD-3-Clause
gomodules.xyz/jsonpatch/v2,https://github.com/gomodules/jsonpatch/blob/v2.5.0/v2/LICENSE,Apache-2.0
google.golang.org/protobuf,https://github.com/protocolbuffers/protobuf-go/blob/f2248ac996af/LICENSE,BSD-3-Clause
gopkg.in/evanphx/json-patch.v4,https://github.com/evanphx/json-patch/blob/v4.13.0/LICENSE,BSD-3-Clause
gopkg.in/inf.v0,https://github.com/go-inf/inf/blob/v0.9.1/LICENSE,BSD-3-Clause
k8s.io/api,https://github.com/kubernetes/api/blob/v0.37.1/LICENSE,Apache-2.0
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions,https://github.com/kubernetes/apiextensions-apiserver/blob/v0.37.1/LICENSE,Apache-2.0
k8s.io/apimachinery/pkg,https://github.com/kubernetes/apimachinery/blob/v0.37.1/LICENSE,Apache-2.0
k8s.io/apimachinery/third_party/forked/golang,https://github.com/kubernetes/apimachinery/blob/v0.37.1/third_party/forked/golang/LICENSE,BSD-3-Clause
k8s.io/client-go,https://github.com/kubernetes/client-go/blob/v0.37.1/LICENSE,Apache-2.0
k8s.io/klog/v2,https://github.com/kubernetes/klog/blob/v2.140.0/LICENSE,Apache-2.0
k8s.io/kube-openapi/pkg,https://github.com/kubernetes/kube-openapi/blob/d427ff9ee9ad/LICENSE,Apache-2.0
k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json,https://github.com/kubernetes/kube-openapi/blob/d427ff9ee9ad/pkg/internal/third_party/go-json-experiment/json/LICENSE,BSD-3-Clause
k8s.io/kube-openapi/pkg/validation/spec,https://github.com/kubernetes/kube-openapi/blob/d427ff9ee9ad/pkg/validation/spec/LICENSE,Apache-2.0
k8s.io/streaming/pkg,https://github.com/kubernetes/streaming/blob/v0.37.1/LICENSE,Apache-2.0
k8s.io/utils,https://github.com/kubernetes/utils/blob/ca04ba58ecab/LICENSE,Apache-2.0
k8s.io/utils/internal/third_party/forked/golang,https://github.com/kubernetes/utils/blob/ca04ba58ecab/internal/third_party/forked/golang/LICENSE,BSD-3-Clause
k8s.io/utils/third_party/forked/golang/btree,https://github.com/kubernetes/utils/blob/ca04ba58ecab/third_party/forked/golang/btree/LICENSE,Apache-2.0
sigs.k8s.io/controller-runtime,https://github.com/kubernetes-sigs/controller-runtime/blob/v0.25.2/LICENSE,Apache-2.0
sigs.k8s.io/json,https://github.com/kubernetes-sigs/json/blob/2d320260d730/LICENSE,Apache-2.0
sigs.k8s.io/json,https://github.com/kubernetes-sigs/json/blob/2d320260d730/LICENSE,BSD-3-Clause
sigs.k8s.io/randfill,https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/LICENSE,Apache-2.0
sigs.k8s.io/structured-merge-diff/v6,https://github.com/kubernetes-sigs/structured-merge-diff/blob/v6.4.2/LICENSE,Apache-2.0
sigs.k8s.io/yaml,https://github.com/kubernetes-sigs/yaml/blob/v1.6.0/LICENSE,MIT
sigs.k8s.io/yaml,https://github.com/kubernetes-sigs/yaml/blob/v1.6.0/LICENSE,Apache-2.0
sigs.k8s.io/yaml,https://github.com/kubernetes-sigs/yaml/blob/v1.6.0/LICENSE,BSD-3-Clause
github.com/beorn7/perks/quantile,v1.0.1,MIT
github.com/cespare/xxhash/v2,v2.3.0,MIT
github.com/davecgh/go-spew/spew,v1.1.2-0.20180830191138-d8f796af33cc,ISC
github.com/emicklei/go-restful/v3,v3.13.0,MIT
github.com/evanphx/json-patch/v5,v5.9.11,BSD-3-Clause
github.com/fsnotify/fsnotify,v1.10.1,BSD-3-Clause
github.com/fxamacker/cbor/v2,v2.9.2,MIT
github.com/go-logr/logr,v1.4.4,Apache-2.0
github.com/go-logr/zapr,v1.3.0,Apache-2.0
github.com/go-openapi/jsonpointer,v1.0.0,Apache-2.0
github.com/go-openapi/jsonreference,v1.0.0,Apache-2.0
github.com/go-openapi/swag,v0.27.1,Apache-2.0
github.com/go-openapi/swag/cmdutils,v0.27.1,Apache-2.0
github.com/go-openapi/swag/conv,v0.27.1,Apache-2.0
github.com/go-openapi/swag/fileutils,v0.27.1,Apache-2.0
github.com/go-openapi/swag/jsonutils,v0.27.1,Apache-2.0
github.com/go-openapi/swag/loading,v0.27.1,Apache-2.0
github.com/go-openapi/swag/mangling,v0.27.1,Apache-2.0
github.com/go-openapi/swag/netutils,v0.27.1,Apache-2.0
github.com/go-openapi/swag/pools,v0.27.1,Apache-2.0
github.com/go-openapi/swag/stringutils,v0.27.1,Apache-2.0
github.com/go-openapi/swag/typeutils,v0.27.1,Apache-2.0
github.com/go-openapi/swag/yamlutils,v0.27.1,Apache-2.0
github.com/google/gnostic-models,v0.7.1,Apache-2.0
github.com/google/uuid,v1.6.0,BSD-3-Clause
github.com/gorilla/websocket,v1.5.4-0.20250319132907-e064f32e3674,BSD-2-Clause
github.com/json-iterator/go,v1.1.12,MIT
github.com/moby/spdystream,v0.5.1,Apache-2.0
github.com/moby/spdystream/spdy,v0.5.1,BSD-3-Clause
github.com/modern-go/concurrent,v0.0.0-20180306012644-bacd9c7ef1dd,Apache-2.0
github.com/modern-go/reflect2,v1.0.3-0.20250322232337-35a7c28c31ee,Apache-2.0
github.com/munnerz/goautoneg,v0.0.0-20191010083416-a7dc8b61c822,BSD-3-Clause
github.com/pmezard/go-difflib/difflib,v1.0.1-0.20181226105442-5d4384ee4fb2,BSD-3-Clause
github.com/pravega/zookeeper-operator/api/v1beta1,v0.2.15,Apache-2.0
github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil,v1.24.0,BSD-3-Clause
github.com/prometheus/client_golang/prometheus,v1.24.0,Apache-2.0
github.com/prometheus/client_model/go,v0.6.2,Apache-2.0
github.com/prometheus/common,v0.70.0,Apache-2.0
github.com/prometheus/procfs,v0.21.1,Apache-2.0
github.com/robfig/cron/v3,v3.0.1,MIT
github.com/spf13/pflag,v1.0.10,BSD-3-Clause
github.com/x448/float16,v0.8.4,MIT
go.uber.org/multierr,v1.11.0,MIT
go.uber.org/zap,v1.28.0,MIT
go.yaml.in/yaml/v2,v2.4.4,Apache-2.0
go.yaml.in/yaml/v3,v3.0.5,MIT
golang.org/x/net,v0.61.0,BSD-3-Clause
golang.org/x/oauth2,v0.36.0,BSD-3-Clause
golang.org/x/sync/errgroup,v0.24.0,BSD-3-Clause
golang.org/x/sys/unix,v0.49.0,BSD-3-Clause
golang.org/x/term,v0.47.0,BSD-3-Clause
golang.org/x/text,v0.43.0,BSD-3-Clause
golang.org/x/time/rate,v0.15.0,BSD-3-Clause
gomodules.xyz/jsonpatch/v2,v2.5.0,Apache-2.0
google.golang.org/protobuf,v1.36.12-0.20260120151049-f2248ac996af,BSD-3-Clause
gopkg.in/evanphx/json-patch.v4,v4.13.0,BSD-3-Clause
gopkg.in/inf.v0,v0.9.1,BSD-3-Clause
k8s.io/api,v0.37.1,Apache-2.0
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions,v0.37.1,Apache-2.0
k8s.io/apimachinery/pkg,v0.37.1,Apache-2.0
k8s.io/apimachinery/third_party/forked/golang,v0.37.1,BSD-3-Clause
k8s.io/client-go,v0.37.1,Apache-2.0
k8s.io/klog/v2,v2.140.0,Apache-2.0
k8s.io/kube-openapi/pkg,v0.0.0-20260721132016-d427ff9ee9ad,Apache-2.0
k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json,v0.0.0-20260721132016-d427ff9ee9ad,BSD-3-Clause
k8s.io/kube-openapi/pkg/validation/spec,v0.0.0-20260721132016-d427ff9ee9ad,Apache-2.0
k8s.io/streaming/pkg,v0.37.1,Apache-2.0
k8s.io/utils,v0.0.0-20261023123148-ca04ba58ecab,Apache-2.0
k8s.io/utils/internal/third_party/forked/golang,v0.0.0-20261023123148-ca04ba58ecab,BSD-3-Clause
k8s.io/utils/third_party/forked/golang/btree,v0.0.0-20261023123148-ca04ba58ecab,Apache-2.0
sigs.k8s.io/controller-runtime,v0.25.2,Apache-2.0
sigs.k8s.io/json,v0.0.0-20250730193827-2d320260d730,Apache-2.0
sigs.k8s.io/json,v0.0.0-20250730193827-2d320260d730,BSD-3-Clause
sigs.k8s.io/randfill,v1.0.0,Apache-2.0
sigs.k8s.io/structured-merge-diff/v6,v6.4.2,Apache-2.0
sigs.k8s.io/yaml,v1.6.0,MIT
sigs.k8s.io/yaml,v1.6.0,Apache-2.0
sigs.k8s.io/yaml,v1.6.0,BSD-3-Clause
27 changes: 27 additions & 0 deletions hack/licenses/dependency_licenses.csv.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Report template for "go-licenses report", producing
"<import path>,<version>,<license type>".

go-licenses' default report puts a link to the license file in the second
column, which it resolves over the network. That lookup makes the report
non-deterministic, and when it succeeds it points into the module's major
version directory, where no license file exists (google/go-licenses#131).
The version is taken from the module graph, so it is stable offline.
*/ -}}
{{ range . }}{{ .Name }},{{ .Version }},{{ .LicenseName }}
{{ end -}}
Loading