add verify-licenses.sh hack script (#108942)

[Priyankasaggu11929]

What type of PR is this?

/kind feature

What this PR does / why we need it:

The PR adds a new hack script hack/verify-licenses.sh to the project, to partly address the asks from the Issue #108942 (comment):

We need to monitor all kubernetes repos for (At least start with k/k)

• the licenses of dependencies listed in go.mod are valid ( https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md )
• ensure the project continues to use a license that is valid for us over time
• ensure that the dependency is still active/available for us to use.

Which issue(s) this PR fixes:

Part of the fix for https://github.com/kubernetes/kubernetes/issues/108942gi

Special notes for your reviewer:

The script assumes that the clone of the project has the following format of git remote origin:

❯ git remote -v
origin	https://github.com/kubernetes/kubernetes.git

In case if the format is git@github.com:kubernetes/kubernetes.git, the go-licenses library complains while fetching the URL to the dependency go-packages license from the project:

E0405 09:01:18.242103   88027 csv.go:84] Error discovering URL for "/Users/work/kubernetes/vendor/sigs.k8s.io/kustomize/kyaml/internal/forked/github.com/qri-io/starlib/util/LICENSE":
- the Git remote "origin" does not have a valid URL

Does this PR introduce a user-facing change?

NONE

[k8s-ci-robot]

@Priyankasaggu11929: This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[dims]

@Priyankasaggu11929 quick feedback, the verify script fails in CI, i had the same problem locally as well. I had to do the following to get a good run.

diff --git hack/verify-licenses.sh hack/verify-licenses.sh
index 7e7df5d8a821..0f60befb7118 100755
--- hack/verify-licenses.sh
+++ hack/verify-licenses.sh
@@ -66,7 +66,7 @@ go install github.com/google/go-licenses@v1.0.0
 # Scanning go-packages Under The Project & Verifying Against The CNCF Approved List Of Licenses
 echo -e "\nStarting license scan on go-packages...\n"
 printf '~%.0s' {1..120}; echo
-go-licenses csv "${KUBE_ROOT}"/... >> /tmp/licenses.csv
+go-licenses csv ./... >> /tmp/licenses.csv

 echo -e "${YELLOW}PACKAGE_NAME : LICENSE_NAME : LICENSE_URL${NC}" >> /tmp/licenses_dump

@@ -89,7 +89,7 @@ rm /tmp/licenses.json
 rm /tmp/licenses.csv
 rm /tmp/licenses_dump

-if [[ ${#packages_flagged[@]} -gt 0 ]]; then
+if [[ ${packages_flagged[@]} -gt 0 ]]; then
        echo -e "${YELLOW}\nThe following go-packages in the project are using non-CNCF approved licenses. Please check the CNCF allowed list of licenses for more details here: https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md\n${NC}"
        echo -e "${RED}${packages_flagged[*]}${NC}"
        exit 1

Also, please avoid /tmp hardcoded, see usages of mktemp in hack/ directory.

Let's do those two, get a clean run on CI and ping me back please.

[dims]

/assign

[Priyankasaggu11929]

Thanks @joakimr-axis for the review. Have addressed all the comments in the latest commit.

[Priyankasaggu11929]

/test pull-kubernetes-node-e2e-containerd

[dims]

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, Priyankasaggu11929

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• hack/OWNERS [dims]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dims]

thanks @joakimr-axis @Priyankasaggu11929

please do the follow up PR(s) Priyanka.

• CI periodic job, every 6 hours (and then we can drop to 12 when we feel comfortable - 6 helps in debugging)
• add this to the EXCLUDED_PATTERNS in ( make-rules/verify.sh )

[Priyankasaggu11929]

/test pull-kubernetes-integration

[Priyankasaggu11929]

/test pull-kubernetes-e2e-gce-ubuntu-containerd

[k8s-ci-robot]

@Priyankasaggu11929: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-kubernetes-integration	31a5e8a	link	true	/test pull-kubernetes-integration

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[Priyankasaggu11929]

@dims, following up on next steps:

CI periodic job, every 6 hours (and then we can drop to 12 when we feel comfortable - 6 helps in debugging)

Raised a WIP PR: kubernetes/test-infra#26220. Have added comment to gather some information.

add this to the EXCLUDED_PATTERNS in ( make-rules/verify.sh )

@jasonbraganza raised a PR for the above bit ^ #109859 (I'm helping him getting started with contributions to the Kubernetes project 🙂 )

[Priyankasaggu11929]

/test pull-kubernetes-integration

[dims]

thanks @Priyankasaggu11929 !