Need to check if kubernetes-image-puller dependencies are EPL compatible

[ibuziuk]

Is your task related to a problem? Please describe.

As a first step before contributing 'kubernetes-image-puller' to the Eclipse Foundation we need to make sure that all the deps are EPL compatible - https://github.com/che-incubator/kubernetes-image-puller/blob/master/go.mod

[tomgeorge]

does this include transitive dependencies or just the first level dependencies?

[ibuziuk]

ideally would be great to find a tool for checking the whole tree but first level dependencies should be fine as part of this task.

I quickly tried go-licenses and glice but none of them did the job for me e.g.

[ibuziuk@fedora kubernetes-image-puller]$ glice
+--------------------------------------+---------+---------+
|              DEPENDENCY              | REPOURL | LICENSE |
+--------------------------------------+---------+---------+
| k8s.io/client-go/kubernetes          |         |         |
| k8s.io/client-go/rest                |         |         |
| k8s.io/client-go/tools/clientcmd     |         |         |
| k8s.io/api/apps/v1                   |         |         |
| k8s.io/api/core/v1                   |         |         |
| k8s.io/apimachinery/pkg/api/errors   |         |         |
| k8s.io/apimachinery/pkg/api/resource |         |         |
| k8s.io/apimachinery/pkg/apis/meta/v1 |         |         |
| k8s.io/apimachinery/pkg/watch        |         |         |
+--------------------------------------+---------+---------+
[ibuziuk@fedora kubernetes-image-puller]$ glice -c
+--------------------------------------+---------+---------+-------+
|              DEPENDENCY              | REPOURL | LICENSE | COUNT |
+--------------------------------------+---------+---------+-------+
| k8s.io/client-go/kubernetes          |         |         |     2 |
| k8s.io/client-go/rest                |         |         |     1 |
| k8s.io/client-go/tools/clientcmd     |         |         |     1 |
| k8s.io/api/apps/v1                   |         |         |     1 |
| k8s.io/api/core/v1                   |         |         |     1 |
| k8s.io/apimachinery/pkg/api/errors   |         |         |     1 |
| k8s.io/apimachinery/pkg/api/resource |         |         |     1 |
| k8s.io/apimachinery/pkg/apis/meta/v1 |         |         |     1 |
| k8s.io/apimachinery/pkg/watch        |         |         |     1 |
+--------------------------------------+---------+---------+-------+
[ibuziuk@fedora kubernetes-image-puller]$ 

[ibuziuk]

looks like I found a proper tool https://github.com/mitchellh/golicense

[ibuziuk@fedora bin]$ golicense kubernetes-image-puller 
github.com/spf13/pflag          BSD 3-Clause "New" or "Revised" License                                 
github.com/modern-go/concurrent Apache License 2.0                                                      
k8s.io/apimachinery             Apache License 2.0                                                      
k8s.io/client-go                Apache License 2.0                                                      
github.com/golang/protobuf      BSD 3-Clause "New" or "Revised" License                                 
k8s.io/api                      Apache License 2.0                                                      
🚫 github.com/gogo/protobuf        <license not found or detected>                                      
github.com/modern-go/reflect2   Apache License 2.0                                                      
golang.org/x/oauth2             BSD 3-Clause "New" or "Revised" License                                 
github.com/gregjones/httpcache  MIT License                                                             
🚫 sigs.k8s.io/yaml                <license not found or detected>                                      
github.com/google/btree         Apache License 2.0                                                      
github.com/imdario/mergo        BSD 3-Clause "New" or "Revised" License                                 
gopkg.in/inf.v0                 BSD 3-Clause "New" or "Revised" License                                 
golang.org/x/sys                BSD 3-Clause "New" or "Revised" License                                 
k8s.io/klog                     Apache License 2.0                                                      
github.com/peterbourgon/diskv   MIT License                                                             
github.com/googleapis/gnostic   Apache License 2.0                                                      
golang.org/x/crypto             BSD 3-Clause "New" or "Revised" License                                 
github.com/json-iterator/go     MIT License                                                             
github.com/google/gofuzz        Apache License 2.0                                                      
golang.org/x/text               BSD 3-Clause "New" or "Revised" License                                 
golang.org/x/net                BSD 3-Clause "New" or "Revised" License                                 
golang.org/x/time               BSD 3-Clause "New" or "Revised" License                                 
gopkg.in/yaml.v2                Apache License 2.0      

Dependencies that were not detected by the tool:

• sigs.k8s.io/yaml -> MIT
• github.com/gogo/protobuf -> https://github.com/gogo/protobuf/blob/master/LICENSE

So, the set of licenses:

• BSD 3-Clause "New" or "Revised" License
• Apache License 2.0
• MIT License
• https://github.com/gogo/protobuf/blob/master/LICENSE

The last license seems to be the custom one and some clarity from the legals team would be nice to have.

BSD 3-Clause "New" or "Revised" License, Apache License 2.0, MIT License are listed in the https://www.eclipse.org/legal/licenses.php#

[ibuziuk]

@tomgeorge could you please take if we really need both and github.com/gogo/protobuf in the repo which is the github.com/golang/protobuf fork?

[ibuziuk]

so, it looks like github.com/golang/protobuf is an indirect dependency of the k8s.io/api/apps/v1 (Apache 2.0)

├ github.com/che-incubator/kubernetes-image-puller/cfg
      ├ k8s.io/api/apps/v1
        ├ fmt
        ├ io
        ├ math
        ├ reflect
        ├ strings
        ├ github.com/gogo/protobuf/proto

So, I believe we can close the issue and treat all the k8s-image-puller docs as EPL compatible:

• BSD 3-Clause "New" or "Revised" License
• Apache License 2.0
• MIT License