Merge pull request #2502 from anders-swanson/third-party-attributions

Third party attributions in OpenCost artifacts

CONTRIBUTING.md

@@ -117,3 +117,34 @@ Please write a commit message with Fixes Issue # if there is an outstanding issu
 Please run `go fmt` on the project directory. Lint can be okay (for example, comments on exported functions are nice but not required on the server).
 
 Please reach us on [CNCF Slack](https://slack.cncf.io/) in the [#opencost](https://cloud-native.slack.com/archives/C03D56FPD4G) channel or attend the biweekly [OpenCost Working Group community meeting](https://bit.ly/opencost-meeting) from the [Community Calendar](https://bit.ly/opencost-calendar) to discuss OpenCost development.
+
+## Third Party Attributions
+
+The THIRD_PARTY_LICENSES.txt file should contain the up-to-date license, copyright, and notice information for dependencies used by Opencost.
+When adding, updating, or removing dependencies, please update the associate section(s) of the [THIRD_PARTY_LICENSES.txt](THIRD_PARTY_LICENSES.txt) file. 
+
+For example, the `github.com/opencost/opencost/core` dependency contains the following third party attributions.
+The license associated with the SPDX identifier should also be included in the attributions file, if it is not already present.
+
+```
+== Dependency
+github.com/opencost/opencost/core
+
+== License Type
+SPDX:Apache-2.0
+
+== Copyright
+Copyright 2019 - 2022 Stackwatch Incorporated. All Rights Reserved.
+Copyright 2022 - 2024 Cloud Native Computing Foundation
+
+== Notices
+OpenCost
+Copyright 2022 - 2024 Cloud Native Computing Foundation
+
+This product includes software developed at
+The Cloud Native Computing Foundation (http://www.cncf.io).
+
+The Initial Developer of some parts of the specification and project is
+Kubecost (http://www.kubecost.com).
+Copyright 2019 - 2022 Stackwatch Incorporated. All Rights Reserved.
+```

Dockerfile

@@ -43,6 +43,7 @@ LABEL org.opencontainers.image.url=https://github.com/opencost/opencost
 
 RUN apk add --update --no-cache ca-certificates
 COPY --from=build-env /go/bin/app /go/bin/app
+ADD --chmod=644 ./THIRD_PARTY_LICENSES.txt /THIRD_PARTY_LICENSES.txt
 ADD --chmod=644 ./configs/default.json /models/default.json
 ADD --chmod=644 ./configs/azure.json /models/azure.json
 ADD --chmod=644 ./configs/aws.json /models/aws.json

Dockerfile.cross

@@ -13,6 +13,7 @@ ARG binarypath
 
 RUN apk add --update --no-cache ca-certificates
 
+ADD --chmod=644 ./THIRD_PARTY_LICENSES.txt /THIRD_PARTY_LICENSES.txt
 ADD --chmod=644 ./configs/default.json /models/default.json
 ADD --chmod=644 ./configs/azure.json /models/azure.json
 ADD --chmod=644 ./configs/aws.json /models/aws.json

ui/Dockerfile

@@ -23,6 +23,7 @@ ENV API_PORT=9003
 ENV API_SERVER=0.0.0.0
 ENV UI_PORT=9090
 
+COPY THIRD_PARTY_LICENSES.txt /THIRD_PARTY_LICENSES.txt
 COPY --from=builder /opt/ui/dist /var/www
 COPY default.nginx.conf.template /etc/nginx/conf.d/default.nginx.conf.template
 COPY nginx.conf /etc/nginx/

ui/Dockerfile.cross

@@ -16,6 +16,7 @@ ENV API_PORT=9003
 ENV API_SERVER=0.0.0.0
 ENV UI_PORT=9090
 
+COPY THIRD_PARTY_LICENSES.txt /THIRD_PARTY_LICENSES.txt
 COPY ./dist /var/www
 COPY default.nginx.conf.template /etc/nginx/conf.d/default.nginx.conf.template
 COPY nginx.conf /etc/nginx/

ui/justfile

@@ -1,5 +1,6 @@
 version := `../tools/image-tag`
 commit := `git rev-parse --short HEAD`
+thirdPartyLicenseFile := "THIRD_PARTY_LICENSES.txt"
 
 default:
     just --list
@@ -10,6 +11,7 @@ build-local:
     npx parcel build src/index.html
 
 build IMAGETAG: build-local
+    cp ../{{thirdPartyLicenseFile}} .
     docker buildx build \
         --rm \
         --platform "linux/amd64" \
@@ -36,3 +38,6 @@ build IMAGETAG: build-local
         --platforms "linux/amd64,linux/arm64" \
         --template {{IMAGETAG}}-ARCH \
         --target {{IMAGETAG}}
+
+    rm -f {{thirdPartyLicenseFile}}
+