Use go-licenses for Go license attributions

We're moving away from Snyk in the long term. In addition, Snyk would often be unable to detect the licenses for certain packages consistently.

Author: christian-stephen

.circleci/config.yml

@@ -14,10 +14,17 @@ orbs:
   slack: circleci/slack@5.1.1
   vuln-scanner: cci-internal/vuln-scanner@0.11.3
 
+x-data:
+  go_image: &goimage cimg/go:1.24.0
+
 executors:
+  go-medium:
+    docker:
+      - image: *goimage
+    resource_class: circleci-runner/rum
   go:
     docker:
-      - image: cimg/go:1.24
+      - image: *goimage
     resource_class: circleci-runner/rum-large
   ccc:
     docker:
@@ -47,8 +54,7 @@ workflows:
       - vuln-scanner/vuln_scan:
           context: [ security-scanning, dockerhub-readonly, github-readonly ]
           upload_on_merge: true
-      - oss-acknowledgement-check:
-          requires: [ vuln-scanner/vuln_scan ]
+      - check-license-attributions:
           context: [ org-global ]
       - images:
           context: [ org-global, runner-image-signing ]
@@ -199,27 +205,29 @@ jobs:
                 paths:
                   - environment
 
-  oss-acknowledgement-check:
-    environment:
-      SNYK_LICENSE_RESULT_FILE: "scan_results.csv"
-    executor: go
+  check-license-attributions:
+    executor: go-medium
     steps:
       - checkout
-      - run: 
-          name: "Check Current Direct Dependency Licenses"
-          command: ./do oss_acknowledge
+      - run: ./do license-attributions
       - run:
-          name: "Compare to Existing Licenses"
+          name: "Check all third-party Go licenses are attributed"
           command: |
-            diff <( cat "$SNYK_LICENSE_RESULT_FILE" | sort ) <( cat snyk-project-licenses.csv | sort )
-            if [[ ! "$?" -eq "0" ]];then
-              echo "Open source acknowledgments need to be updated."
-              echo "1) See `./do oss_acknowledgment` for generating new acknowledgements"
-              echo "2) Update the Open Source Acknowledgments documentation for runner-init at: https://github.com/circleci/circleci-docs/blob/master/jekyll/_cci2/runner-init.csv using the generated CSV file"
+            diff_output=$(git diff HEAD -- ./go-project-licenses.csv)
+            if [[ -n "$diff_output" ]]; then
+              echo "Changes detected in 'go-project-licenses.csv':"
+              echo
+              echo "${diff_output}"
+              echo
+              echo "1) Run './do license-attributions' locally and commit the results."
+              echo "2) Update the Open Source Acknowledgments in 'runner-init.csv':"
+              echo "   https://github.com/circleci/circleci-docs/blob/master/jekyll/_cci2/runner-init.csv"
+              echo "   Unknown licenses may require manual intervention."
               exit 1
+            else
+              echo "No changes detected in 'go-project-licenses.csv'."
             fi
-            cat $SNYK_LICENSE_RESULT_FILE
-  
+
   scan:
     executor: ccc
     parallelism: 4

.circleci/oss-scan.go

@@ -18,16 +18,10 @@ build() {
     echo "${BUILD_VERSION:-dev}" | tee ./target/version.txt
 }
 
-help_oss_acknowledge="Populate the license attribution file"
-oss_acknowledge() {
-   # to get around the hard fail for unbound variables
-   TOKEN=${SNYK_TOKEN:-}
-   if [[ -z "${TOKEN}" ]]; then
-      echo "Set \$SNYK_TOKEN with API token from https://app.snyk.io/account"
-      exit 1
-   fi
-   echo "updating snyk-project-licenses.csv with current direct dependency licenses"
-   SNYK_PROJECT_ID="fe17322a-c8ab-442d-96cb-1658da1cd57b" go run .circleci/oss-scan.go
+help_license_attributions="Regenerate the third-party license attributions file."
+license-attributions() {
+  go tool go-licenses report --ignore=gotest  ./... \
+    --template ./templates/licenses-csv.tpl >${LICENSE_ATTRIBUTIONS_FILE:-./go-project-licenses.csv}
 }
 
 # This variable is used, but shellcheck can't tell.

do

@@ -0,0 +1,59 @@
+Name,License,URL
+github.com/DataDog/datadog-go/statsd,MIT,https://github.com/DataDog/datadog-go/blob/v4.8.3/LICENSE.txt
+github.com/alecthomas/kong,MIT,https://github.com/alecthomas/kong/blob/v1.8.1/COPYING
+github.com/cenkalti/backoff/v4,MIT,https://github.com/cenkalti/backoff/blob/v4.3.0/LICENSE
+github.com/circleci/ex,MIT,https://github.com/circleci/ex/blob/v1.0.14377-f64ffce/LICENSE
+github.com/circleci/runner-init,Apache-2.0,https://github.com/circleci/runner-init/blob/HEAD/LICENSE
+github.com/facebookgo/clock,MIT,https://github.com/facebookgo/clock/blob/600d898af40a/LICENSE
+github.com/facebookgo/limitgroup,BSD-3-Clause,https://github.com/facebookgo/limitgroup/blob/6abd8d71ec01/license
+github.com/facebookgo/muster,BSD-3-Clause,https://github.com/facebookgo/muster/blob/fd3d7953fd52/license
+github.com/fsnotify/fsnotify,BSD-3-Clause,https://github.com/fsnotify/fsnotify/blob/v1.8.0/LICENSE
+github.com/gabriel-vasile/mimetype,MIT,https://github.com/gabriel-vasile/mimetype/blob/v1.4.8/LICENSE
+github.com/gin-contrib/sse,MIT,https://github.com/gin-contrib/sse/blob/v0.1.0/LICENSE
+github.com/gin-gonic/gin,MIT,https://github.com/gin-gonic/gin/blob/v1.10.0/LICENSE
+github.com/go-logr/logr,Apache-2.0,https://github.com/go-logr/logr/blob/v1.4.2/LICENSE
+github.com/go-logr/stdr,Apache-2.0,https://github.com/go-logr/stdr/blob/v1.2.2/LICENSE
+github.com/go-playground/locales,MIT,https://github.com/go-playground/locales/blob/v0.14.1/LICENSE
+github.com/go-playground/universal-translator,MIT,https://github.com/go-playground/universal-translator/blob/v0.18.1/LICENSE
+github.com/go-playground/validator/v10,MIT,https://github.com/go-playground/validator/blob/v10.24.0/LICENSE
+github.com/goccy/go-json,MIT,https://github.com/goccy/go-json/blob/v0.10.5/LICENSE
+github.com/google/go-cmp/cmp,BSD-3-Clause,https://github.com/google/go-cmp/blob/v0.7.0/LICENSE
+github.com/google/uuid,BSD-3-Clause,https://github.com/google/uuid/blob/v1.6.0/LICENSE
+github.com/grpc-ecosystem/grpc-gateway/v2,BSD-3-Clause,https://github.com/grpc-ecosystem/grpc-gateway/blob/v2.25.1/LICENSE
+github.com/hashicorp/go-reap,MPL-2.0,https://github.com/hashicorp/go-reap/blob/bf69c61a7b71/LICENSE
+github.com/hellofresh/health-go/v5,Apache-2.0,https://github.com/hellofresh/health-go/blob/v5.5.3/LICENSE.txt
+github.com/honeycombio/beeline-go,Apache-2.0,https://github.com/honeycombio/beeline-go/blob/v1.18.0/LICENSE
+github.com/honeycombio/dynsampler-go,Apache-2.0,https://github.com/honeycombio/dynsampler-go/blob/v0.6.0/LICENSE
+github.com/honeycombio/libhoney-go,Apache-2.0,https://github.com/honeycombio/libhoney-go/blob/v1.25.0/LICENSE
+github.com/klauspost/compress,MIT,https://github.com/klauspost/compress/blob/v1.18.0/LICENSE
+github.com/klauspost/compress,Apache-2.0,https://github.com/klauspost/compress/blob/v1.18.0/LICENSE
+github.com/klauspost/compress,BSD-3-Clause,https://github.com/klauspost/compress/blob/v1.18.0/LICENSE
+github.com/klauspost/compress/internal/snapref,BSD-3-Clause,https://github.com/klauspost/compress/blob/v1.18.0/internal/snapref/LICENSE
+github.com/klauspost/compress/zstd/internal/xxhash,MIT,https://github.com/klauspost/compress/blob/v1.18.0/zstd/internal/xxhash/LICENSE.txt
+github.com/leodido/go-urn,MIT,https://github.com/leodido/go-urn/blob/v1.4.0/LICENSE
+github.com/mattn/go-isatty,MIT,https://github.com/mattn/go-isatty/blob/v0.0.20/LICENSE
+github.com/pelletier/go-toml/v2,MIT,https://github.com/pelletier/go-toml/blob/v2.2.3/LICENSE
+github.com/rollbar/rollbar-go,MIT,https://github.com/rollbar/rollbar-go/blob/v1.4.5/LICENSE
+github.com/ugorji/go/codec,MIT,https://github.com/ugorji/go/blob/codec/v1.2.12/codec/LICENSE
+github.com/vmihailenco/msgpack/v5,BSD-2-Clause,https://github.com/vmihailenco/msgpack/blob/v5.4.1/LICENSE
+github.com/vmihailenco/tagparser/v2,BSD-2-Clause,https://github.com/vmihailenco/tagparser/blob/v2.0.0/LICENSE
+go.opentelemetry.io/auto/sdk,Apache-2.0,https://github.com/open-telemetry/opentelemetry-go-instrumentation/blob/sdk/v1.1.0/sdk/LICENSE
+go.opentelemetry.io/otel,Apache-2.0,https://github.com/open-telemetry/opentelemetry-go/blob/v1.34.0/LICENSE
+go.opentelemetry.io/otel/exporters/otlp/otlptrace,Apache-2.0,https://github.com/open-telemetry/opentelemetry-go/blob/exporters/otlp/otlptrace/v1.34.0/exporters/otlp/otlptrace/LICENSE
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc,Apache-2.0,https://github.com/open-telemetry/opentelemetry-go/blob/exporters/otlp/otlptrace/otlptracegrpc/v1.34.0/exporters/otlp/otlptrace/otlptracegrpc/LICENSE
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp,Apache-2.0,https://github.com/open-telemetry/opentelemetry-go/blob/exporters/otlp/otlptrace/otlptracehttp/v1.34.0/exporters/otlp/otlptrace/otlptracehttp/LICENSE
+go.opentelemetry.io/otel/metric,Apache-2.0,https://github.com/open-telemetry/opentelemetry-go/blob/metric/v1.34.0/metric/LICENSE
+go.opentelemetry.io/otel/sdk,Apache-2.0,https://github.com/open-telemetry/opentelemetry-go/blob/sdk/v1.34.0/sdk/LICENSE
+go.opentelemetry.io/otel/trace,Apache-2.0,https://github.com/open-telemetry/opentelemetry-go/blob/trace/v1.34.0/trace/LICENSE
+go.opentelemetry.io/proto/otlp,Apache-2.0,https://github.com/open-telemetry/opentelemetry-proto-go/blob/otlp/v1.5.0/otlp/LICENSE
+golang.org/x/crypto/sha3,BSD-3-Clause,https://cs.opensource.google/go/x/crypto/+/v0.33.0:LICENSE
+golang.org/x/net,BSD-3-Clause,https://cs.opensource.google/go/x/net/+/v0.35.0:LICENSE
+golang.org/x/sync/errgroup,BSD-3-Clause,https://cs.opensource.google/go/x/sync/+/v0.11.0:LICENSE
+golang.org/x/sys,BSD-3-Clause,https://cs.opensource.google/go/x/sys/+/v0.30.0:LICENSE
+golang.org/x/text,BSD-3-Clause,https://cs.opensource.google/go/x/text/+/v0.22.0:LICENSE
+google.golang.org/genproto/googleapis/api/httpbody,Apache-2.0,https://github.com/googleapis/go-genproto/blob/1a7da9e5054f/googleapis/api/LICENSE
+google.golang.org/genproto/googleapis/rpc,Apache-2.0,https://github.com/googleapis/go-genproto/blob/29210b9bc287/googleapis/rpc/LICENSE
+google.golang.org/grpc,Apache-2.0,https://github.com/grpc/grpc-go/blob/v1.70.0/LICENSE
+google.golang.org/protobuf,BSD-3-Clause,https://github.com/protocolbuffers/protobuf-go/blob/v1.36.5/LICENSE
+gopkg.in/alexcesaro/statsd.v2,MIT,https://github.com/alexcesaro/statsd/blob/v2.0.0/LICENSE
+gopkg.in/yaml.v3,MIT,https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE

go-project-licenses.csv

@@ -274,9 +274,11 @@ require (
 	github.com/google/go-containerregistry v0.20.3 // indirect
 	github.com/google/go-github/v55 v55.0.0 // indirect
 	github.com/google/go-github/v63 v63.0.0 // indirect
+	github.com/google/go-licenses/v2 v2.0.0-alpha.1 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/ko v0.15.4 // indirect
+	github.com/google/licenseclassifier/v2 v2.0.0 // indirect
 	github.com/google/rpmpack v0.6.1-0.20240329070804-c2247cbb881a // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/safetext v0.0.0-20220905092116-b49f7bc46da2 // indirect
@@ -412,6 +414,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
+	github.com/otiai10/copy v1.14.0 // indirect
 	github.com/pborman/uuid v1.2.1 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
@@ -619,6 +622,7 @@ require (
 
 tool (
 	github.com/golangci/golangci-lint/cmd/golangci-lint
+	github.com/google/go-licenses/v2
 	github.com/goreleaser/goreleaser/v2
 	github.com/sigstore/cosign/v2/cmd/cosign
 	gotest.tools/gotestsum