Skip to content

Commit 4fdfcfc

Browse files
HoustonPutmanHoustonPutman
authored
Resolve dependency license handling (#229)
Docker releases will contain all necessary license/notice information for golang dependencies. The repo and helm chart contain the NOTICEs and LICENSEs that pertain to themselves.
1 parent 5ecd741 commit 4fdfcfc

20 files changed

+178
-105
lines changed

‎.github/workflows/docker.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,4 @@ jobs:
1717

1818
# Cleanup & Install dependencies
1919
- run: docker --version
20-
- run: make docker-vendor-build
20+
- run: make docker-build

‎LICENSE

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,7 @@
187187
same "printed page" as the copyright notice for easier
188188
identification within third-party archives.
189189

190-
Copyright 2017 Bloomberg Finance L.P.
190+
Copyright [yyyy] [name of copyright owner]
191191

192192
Licensed under the Apache License, Version 2.0 (the "License");
193193
you may not use this file except in compliance with the License.
@@ -199,4 +199,4 @@
199199
distributed under the License is distributed on an "AS IS" BASIS,
200200
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
201201
See the License for the specific language governing permissions and
202-
limitations under the License.
202+
limitations under the License.

‎Makefile

Lines changed: 23 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,9 @@ release: clean manifests lint
4343
# Building
4444
###
4545

46+
# Prepare the code for a PR or merge
47+
prepare: fmt generate manifests fetch-licenses-list
48+
4649
# Build solr-operator binary
4750
build: generate vet
4851
BIN=solr-operator VERSION=${VERSION} GIT_SHA=${GIT_SHA} ARCH=${ARCH} GOOS=${GOOS} ./build/build.sh
@@ -77,24 +80,39 @@ fmt:
7780
vet:
7881
go vet ./...
7982

83+
# Run go vet against code
84+
fetch-licenses-list:
85+
go-licenses csv . | grep -v -E "solr-operator" | sort > dependency_licenses.csv
86+
87+
# Run go vet against code
88+
fetch-licenses-full:
89+
go-licenses save . --save_path licenses --force
90+
8091
###
8192
# Tests and Checks
8293
###
8394

8495
check: lint test
8596

86-
lint: check-format check-license check-manifests check-helm
97+
lint: check-format check-licenses check-manifests check-generated check-helm
8798

8899
check-format:
89100
./hack/check_format.sh
90101

91-
check-license:
102+
check-licenses:
103+
@echo "Check license headers on necessary files"
92104
./hack/check_license.sh
105+
@echo "Check list of dependency licenses"
106+
go-licenses csv . 2>/dev/null | grep -v -E "solr-operator" | sort | diff dependency_licenses.csv -
93107

94108
check-manifests: manifests
95109
@echo "Check to make sure the manifests are up to date"
96110
git diff --exit-code -- config helm/solr-operator/crds
97111

112+
check-generated: generate
113+
@echo "Check to make sure the generated code is up to date"
114+
git diff --exit-code -- api/*/zz_generated.deepcopy.go
115+
98116
check-helm:
99117
helm lint helm/solr-operator
100118

@@ -119,29 +137,13 @@ CONTROLLER_GEN=$(shell which controller-gen)
119137
# Docker Building & Pushing
120138
###
121139

122-
# Build the base builder docker image
123-
# This can be a static go build or dynamic
124-
docker-base-build:
125-
docker build --build-arg VERSION=$(VERSION) --build-arg GIT_SHA=$(GIT_SHA) . -t solr-operator-build -f ./build/Dockerfile.build
126-
127-
# Build the docker image for the operator only
128-
docker-build: docker-base-build
129-
docker build --build-arg BUILD_IMG=solr-operator-build . -t solr-operator -f ./build/Dockerfile.slim
140+
# Build the docker image for the operator
141+
docker-build:
142+
docker build --build-arg VERSION=$(VERSION) --build-arg GIT_SHA=$(GIT_SHA) . -t solr-operator -f ./build/Dockerfile
130143
docker tag solr-operator ${IMG}:${VERSION}
131144
docker tag solr-operator ${IMG}:latest
132145

133-
# Build the docker image for the operator, containing the vendor deps as well
134-
docker-vendor-build: docker-build
135-
docker build --build-arg BUILD_IMG=solr-operator-build --build-arg SLIM_IMAGE=solr-operator . -t solr-operator-vendor -f ./build/Dockerfile.vendor
136-
docker tag solr-operator-vendor ${IMG}:${VERSION}-vendor
137-
docker tag solr-operator-vendor ${IMG}:latest-vendor
138-
139146
# Push the docker image for the operator
140147
docker-push:
141148
docker push ${IMG}:${VERSION}
142149
docker push ${IMG}:latest
143-
144-
# Push the docker image for the operator with vendor deps
145-
docker-vendor-push:
146-
docker push ${IMG}:${VERSION}-vendor
147-
docker push ${IMG}:latest-vendor

‎NOTICE.txt renamed to ‎NOTICE

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,12 @@ distributed under the License is distributed on an "AS IS" BASIS,
2626
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
2727
See the License for the specific language governing permissions and
2828
limitations under the License.
29+
30+
The Solr Operator project is built using Kubebuilder, which is Apache 2.0 licensed.
31+
https://github.com/kubernetes-sigs/kubebuilder
32+
33+
The reconcileStorageFinalizer login in
34+
controllers/solrcloud_controller.go
35+
was influenced by the same logic in the Zookeeper Operator, which is Apache 2.0 licensed.
36+
https://github.com/pravega/zookeeper-operator/blob/v0.2.9/pkg/controller/zookeepercluster/zookeepercluster_controller.go#L629)
37+
Copyright (c) 2020 Dell Inc., or its subsidiaries. All Rights Reserved.

‎README.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,10 +132,18 @@ Have you had a good experience with the **Solr Operator**? Why not share some lo
132132

133133
We welcome issue reports [here](../../issues); be sure to choose the proper issue template for your issue, so that we can be sure you're providing the necessary information.
134134

135+
Before submitting a PR, please be sure to run `make prepare` before committing.
136+
Otherwise the github checks are likely to fail.
137+
135138
## License
136139

137140
Please read the [LICENSE](LICENSE) file here.
138141

142+
### Docker Image Licenses
143+
144+
The Solr Operator docker image contains NOTICE and LICENSE information in the `/etc/licenses` directory.
145+
This is different from the source release LICENSE and NOTICE files, so make sure to familiarize yourself when using the image.
146+
139147
## Code of Conduct
140148

141149
This space applies the ASF [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
@@ -150,3 +158,8 @@ can be found [here](https://www.apache.org/security/)
150158

151159
Please do NOT open an issue in the GitHub repository, as we'd prefer to keep vulnerability reports private until
152160
we've had an opportunity to review and address them.
161+
162+
## Acknowledgements
163+
164+
The Solr Operator was donated to Apache Solr by Bloomberg, after the v0.2.8 release.
165+
Many thanks to their contributions over the years!

‎build/Dockerfile

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Build the manager binary
2+
FROM golang:1.14 as builder
3+
4+
WORKDIR /workspace
5+
ARG GO111MODULE=on
6+
7+
# Download necessary libraries
8+
RUN go get sigs.k8s.io/controller-tools/cmd/[email protected]; \
9+
go get github.com/google/go-licenses
10+
11+
# Copy the Go Modules manifests
12+
COPY go.mod go.sum ./
13+
# cache deps before building and copying source so that we don't need to re-download as much
14+
# and so that source changes don't invalidate our downloaded layer
15+
RUN go mod download
16+
17+
# Copy development resources
18+
COPY .git/ .git/
19+
COPY hack/ hack/
20+
COPY build/build.sh build/build.sh
21+
COPY Makefile LICENSE NOTICE build/LICENSE-ADDITION build/NOTICE-ADDITION ./
22+
23+
# Add additional binary-release-only information to the LICENSE and NOTICES files
24+
RUN echo "\n\n" >> LICENSE; \
25+
cat LICENSE-ADDITION >> LICENSE; \
26+
echo "\n\n" >> NOTICE; \
27+
cat NOTICE-ADDITION >> NOTICE
28+
29+
# Copy the go source
30+
COPY main.go ./
31+
COPY api/ api/
32+
COPY controllers/ controllers/
33+
34+
ARG VERSION
35+
ARG GIT_SHA
36+
37+
# Build
38+
RUN CGO_ENABLED=0 make fetch-licenses-full build
39+
40+
# =============================================================================
41+
# Copy the controller-manager into a thin image
42+
# =============================================================================
43+
44+
# Use distroless as minimal base image to package the manager binary
45+
# Refer to https://github.com/GoogleContainerTools/distroless for more details
46+
# Debug is needed, so that the license files are viewable.
47+
# If there is another way to view these files, we can remove "debug-".
48+
FROM gcr.io/distroless/base:debug-nonroot
49+
50+
WORKDIR /
51+
COPY --from=builder workspace/bin/solr-operator .
52+
COPY --from=builder workspace/LICENSE workspace/NOTICE etc/licenses/
53+
COPY --from=builder workspace/licenses etc/licenses/dependencies
54+
USER nonroot:nonroot
55+
56+
ENTRYPOINT ["/solr-operator"]

‎build/Dockerfile.build

Lines changed: 0 additions & 32 deletions
This file was deleted.

‎build/Dockerfile.slim

Lines changed: 0 additions & 16 deletions
This file was deleted.

‎build/Dockerfile.vendor

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎build/LICENSE-ADDITION

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
All golang dependency LICENSE and NOTICE information can be found under /etc/licenses/dependencies.

‎build/NOTICE-ADDITION

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
This project uses the hashicorp/golang-lru project, which is MPL 2.0 licensed. The source code can be found at
2+
https://github.com/hashicorp/golang-lru

‎dependency_licenses.csv

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
cloud.google.com/go/compute/metadata,Unknown,Apache-2.0
2+
github.com/beorn7/perks/quantile,https://github.com/beorn7/perks/blob/master/quantile/LICENSE,MIT
3+
github.com/cespare/xxhash/v2,https://github.com/cespare/xxhash/blob/master/v2/LICENSE.txt,MIT
4+
github.com/davecgh/go-spew/spew,https://github.com/davecgh/go-spew/blob/master/spew/LICENSE,ISC
5+
github.com/docker/spdystream,https://github.com/docker/spdystream/blob/master/LICENSE,Apache-2.0
6+
github.com/evanphx/json-patch,https://github.com/evanphx/json-patch/blob/master/LICENSE,BSD-3-Clause
7+
github.com/fsnotify/fsnotify,https://github.com/fsnotify/fsnotify/blob/master/LICENSE,BSD-3-Clause
8+
github.com/go-logr/logr,https://github.com/go-logr/logr/blob/master/LICENSE,Apache-2.0
9+
github.com/go-logr/zapr,https://github.com/go-logr/zapr/blob/master/LICENSE,Apache-2.0
10+
github.com/gogo/protobuf,https://github.com/gogo/protobuf/blob/master/LICENSE,BSD-3-Clause
11+
github.com/golang/groupcache/lru,https://github.com/golang/groupcache/blob/master/lru/LICENSE,Apache-2.0
12+
github.com/golang/protobuf,https://github.com/golang/protobuf/blob/master/LICENSE,BSD-3-Clause
13+
github.com/google/go-cmp/cmp,https://github.com/google/go-cmp/blob/master/cmp/LICENSE,BSD-3-Clause
14+
github.com/google/gofuzz,https://github.com/google/gofuzz/blob/master/LICENSE,Apache-2.0
15+
github.com/google/uuid,https://github.com/google/uuid/blob/master/LICENSE,BSD-3-Clause
16+
github.com/googleapis/gnostic,https://github.com/googleapis/gnostic/blob/master/LICENSE,Apache-2.0
17+
github.com/hashicorp/golang-lru,https://github.com/hashicorp/golang-lru/blob/master/LICENSE,MPL-2.0
18+
github.com/imdario/mergo,https://github.com/imdario/mergo/blob/master/LICENSE,BSD-3-Clause
19+
github.com/json-iterator/go,https://github.com/json-iterator/go/blob/master/LICENSE,MIT
20+
github.com/matttproud/golang_protobuf_extensions/pbutil,https://github.com/matttproud/golang_protobuf_extensions/blob/master/pbutil/LICENSE,Apache-2.0
21+
github.com/modern-go/concurrent,https://github.com/modern-go/concurrent/blob/master/LICENSE,Apache-2.0
22+
github.com/modern-go/reflect2,https://github.com/modern-go/reflect2/blob/master/LICENSE,Apache-2.0
23+
github.com/pkg/errors,https://github.com/pkg/errors/blob/master/LICENSE,BSD-2-Clause
24+
github.com/pravega/zookeeper-operator/pkg/apis,https://github.com/pravega/zookeeper-operator/blob/master/pkg/apis/LICENSE,Apache-2.0
25+
github.com/prometheus/client_golang/prometheus,https://github.com/prometheus/client_golang/blob/master/prometheus/LICENSE,Apache-2.0
26+
github.com/prometheus/client_model/go,https://github.com/prometheus/client_model/blob/master/go/LICENSE,Apache-2.0
27+
github.com/prometheus/common,https://github.com/prometheus/common/blob/master/LICENSE,Apache-2.0
28+
github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg,https://github.com/prometheus/common/blob/master/internal/bitbucket.org/ww/goautoneg/README.txt,BSD-3-Clause
29+
github.com/prometheus/procfs,https://github.com/prometheus/procfs/blob/master/LICENSE,Apache-2.0
30+
github.com/spf13/pflag,https://github.com/spf13/pflag/blob/master/LICENSE,BSD-3-Clause
31+
go.uber.org/atomic,Unknown,MIT
32+
go.uber.org/multierr,Unknown,MIT
33+
go.uber.org/zap,Unknown,MIT
34+
golang.org/x/crypto/ssh/terminal,Unknown,BSD-3-Clause
35+
golang.org/x/net,Unknown,BSD-3-Clause
36+
golang.org/x/oauth2,Unknown,BSD-3-Clause
37+
golang.org/x/sys,Unknown,BSD-3-Clause
38+
golang.org/x/text,Unknown,BSD-3-Clause
39+
golang.org/x/time/rate,Unknown,BSD-3-Clause
40+
gomodules.xyz/jsonpatch/v2,Unknown,Apache-2.0
41+
google.golang.org/protobuf,Unknown,BSD-3-Clause
42+
gopkg.in/inf.v0,Unknown,BSD-3-Clause
43+
gopkg.in/yaml.v2,Unknown,Apache-2.0
44+
k8s.io/api,Unknown,Apache-2.0
45+
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions,Unknown,Apache-2.0
46+
k8s.io/apimachinery,Unknown,Apache-2.0
47+
k8s.io/client-go,Unknown,Apache-2.0
48+
k8s.io/klog/v2,Unknown,Apache-2.0
49+
k8s.io/kube-openapi/pkg/util/proto,Unknown,Apache-2.0
50+
k8s.io/utils,Unknown,Apache-2.0
51+
sigs.k8s.io/controller-runtime,Unknown,Apache-2.0
52+
sigs.k8s.io/structured-merge-diff/v4/value,Unknown,Apache-2.0
53+
sigs.k8s.io/yaml,Unknown,MIT

‎docker_deploy.sh

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
#!/bin/sh
22

33
docker login -u "$DOCKER_USER" -p "$DOCKER_PASSWORD" \
4-
&& make docker-push \
5-
&& make docker-vendor-push
4+
&& make docker-push

‎docs/development.md

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,6 @@ Building and releasing a test operator image with a custom Docker namespace.
7676
$ NAMESPACE=your-namespace/ make docker-build docker-push
7777
```
7878

79-
You can test the vendor docker container by running
80-
81-
```bash
82-
$ NAMESPACE=your-namespace/ make docker-vendor-build docker-vendor-push
83-
```
84-
8579
You can control the namespace and version for your solr-operator docker image via the ENV variables:
8680
- `NAMESPACE`, defaults to `apache/`. **This must end with a forward slash.** This can also include the docker repository information for private repos.
8781
- `NAME`, defaults to `solr-operator`.
@@ -122,10 +116,11 @@ $ make test
122116

123117
## Before you create a PR
124118

125-
The CRD should be updated anytime you update the API.
119+
The github actions will auto-check that linting is successful on your PR.
120+
To make sure that the linting will succeed, run the following command before committing.
126121

127122
```bash
128-
$ make manifests
123+
$ make prepare
129124
```
130125

131126

‎docs/running-the-operator.md

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -54,13 +54,9 @@ After inspecting the status of you Kube cluster, you should see a deployment for
5454

5555
## Solr Operator Docker Images
5656

57-
Two Docker images are published to [DockerHub](https://hub.docker.com/r/apache/solr-operator), both based off of the same base image.
58-
59-
- [Builder Image](build/Dockerfile.build) - Downloads gomod dependencies, builds operator executable (This is not published, only used to build the following images)
60-
- [Slim Image](build/Dockerfile.slim) - Contains only the operator executable, with the operator as the entry point
61-
- [Vendor Image](build/Dockerfile.slim) - Contains the operator executable as well as all dependencies (at `/solr-operator-vendor-sources`)
62-
63-
In order to run the Solr Operator, you will only need the Slim Image.
57+
The Solr Operator Docker image is published to Dockerhub at [apache/solr-operator](https://hub.docker.com/r/apache/solr-operator).
58+
The [Dockerfile](/build/Dockerfile) builds from scratch source, and copies all necessary information to a very limited image.
59+
The final image will only contain the solr-operator binary and necessary License information.
6460

6561
## Solr Operator Input Args
6662

0 commit comments

Comments
 (0)