Generate NOTICE.txt and dependencies.asciidoc

.ci/Jenkinsfile

@@ -51,6 +51,16 @@ pipeline {
             }
           }
         }
+        withGithubNotify(context: "NOTICE.txt") {
+          dir("${BASE_DIR}"){
+            withGoEnv(){
+              sh(label: 'notice', script: '''
+                bash ./apm-lambda-extension/scripts/notice.sh
+                git diff --exit-code --quiet && exit 0 || echo "regenerate NOTICE.txt" && exit 1
+              ''')
+            }
+          }
+        }
       }
     }
     stage('Test') {

apm-lambda-extension/Makefile

@@ -21,6 +21,10 @@ export AWS_FOLDER GOARCH ARCHITECTURE DOCKER_IMAGE_NAME DOCKER_REGISTRY
 .PHONY: all
 all: build
 
+.PHONY: gen-notice
+gen-notice:
+	@bash ./scripts/notice.sh
+
 check-licenses:
 	go install github.com/elastic/[email protected]
 	go run github.com/elastic/[email protected] -d .
@@ -34,7 +38,7 @@ lint:
 	golangci-lint --version
 	golangci-lint run
 
-build: check-licenses
+build: check-licenses gen-notice
 	GOOS=linux go build -o bin/extensions/apm-lambda-extension main.go
 	chmod +x bin/extensions/apm-lambda-extension
 build-and-publish: check-licenses validate-layer-name validate-aws-default-region

apm-lambda-extension/dependencies.asciidoc

@@ -0,0 +1,50 @@
+// Generated documentation. Please do not edit.
+:page_id: dependencies
+
+[id="{p}-{page_id}"]
+= Third-party dependencies
+
+This page lists the third-party dependencies used to build {n}.
+
+[float]
+[id="{p}-dependencies-direct"]
+== Direct dependencies
+
+[options="header"]
+|===
+| Name | Version | Licence
+
+| link:https://github.com/google/uuid[$$github.com/google/uuid$$] | v1.3.0 | BSD-3-Clause
+| link:https://github.com/joho/godotenv[$$github.com/joho/godotenv$$] | v1.4.0 | MIT
+| link:https://github.com/pkg/errors[$$github.com/pkg/errors$$] | v0.9.1 | BSD-2-Clause
+| link:https://github.com/stretchr/testify[$$github.com/stretchr/testify$$] | v1.7.0 | MIT
+| link:https://go.elastic.co/ecszap[$$go.elastic.co/ecszap$$] | v1.0.1 | Apache-2.0
+| link:https://go.uber.org/zap[$$go.uber.org/zap$$] | v1.21.0 | MIT
+| link:https://gotest.tools[$$gotest.tools$$] | v2.2.0+incompatible | Apache-2.0
+|===
+
+
+[float]
+[id="{p}-dependencies-indirect"]
+== Indirect dependencies
+
+[options="header"]
+|===
+| Name | Version | Licence
+
+| link:https://github.com/benbjohnson/clock[$$github.com/benbjohnson/clock$$] | v1.1.0 | MIT
+| link:https://github.com/davecgh/go-spew[$$github.com/davecgh/go-spew$$] | v1.1.1 | ISC
+| link:https://github.com/google/go-cmp[$$github.com/google/go-cmp$$] | v0.5.6 | BSD-3-Clause
+| link:https://github.com/kr/pretty[$$github.com/kr/pretty$$] | v0.1.0 | MIT
+| link:https://github.com/kr/text[$$github.com/kr/text$$] | v0.1.0 | MIT
+| link:https://github.com/magefile/mage[$$github.com/magefile/mage$$] | v1.13.0 | Apache-2.0
+| link:https://github.com/pmezard/go-difflib[$$github.com/pmezard/go-difflib$$] | v1.0.0 | BSD-3-Clause
+| link:https://go.uber.org/atomic[$$go.uber.org/atomic$$] | v1.9.0 | MIT
+| link:https://go.uber.org/goleak[$$go.uber.org/goleak$$] | v1.1.11 | MIT
+| link:https://go.uber.org/multierr[$$go.uber.org/multierr$$] | v1.8.0 | MIT
+| link:https://golang.org/x/xerrors[$$golang.org/x/xerrors$$] | v0.0.0-20200804184101-5ec99f83aff1 | BSD-3-Clause
+| link:https://gopkg.in/check.v1[$$gopkg.in/check.v1$$] | v1.0.0-20180628173108-788fd7840127 | BSD-2-Clause
+| link:https://gopkg.in/yaml.v2[$$gopkg.in/yaml.v2$$] | v2.2.8 | Apache-2.0
+| link:https://gopkg.in/yaml.v3[$$gopkg.in/yaml.v3$$] | v3.0.0-20210107192922-496545a6307b | MIT
+|===
+

apm-lambda-extension/scripts/notice.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+# Copyright 2022 Elasticsearch BV
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Script to generate a NOTICE file containing licence information from dependencies.
+
+# cf. https://github.com/elastic/cloud-on-k8s/tree/main/hack/licence-detector
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR=${SCRIPT_DIR}/..
+TEMP_DIR=$(mktemp -d)
+LICENCE_DETECTOR="go.elastic.co/[email protected]"
+
+trap '[[ $TEMP_DIR ]] && rm -rf "$TEMP_DIR"' EXIT
+
+get_licence_detector() {
+    GOBIN="$TEMP_DIR" go install "$LICENCE_DETECTOR"
+}
+
+generate_notice() {
+    (
+        cd "$PROJECT_DIR"
+        go mod download
+        go list -m -json all | "${TEMP_DIR}"/go-licence-detector \
+            -depsTemplate="${SCRIPT_DIR}"/templates/dependencies.asciidoc.tmpl \
+            -depsOut="${PROJECT_DIR}"/dependencies.asciidoc \
+            -noticeTemplate="${SCRIPT_DIR}"/templates/NOTICE.txt.tmpl \
+            -noticeOut="${PROJECT_DIR}"/NOTICE.txt \
+            -overrides="${SCRIPT_DIR}"/overrides/overrides.json \
+            -rules="${SCRIPT_DIR}"/rules.json \
+            -includeIndirect
+    )
+}
+
+echo "Generating notice file and dependency list"
+get_licence_detector
+generate_notice

apm-lambda-extension/scripts/rules.json

@@ -0,0 +1,12 @@
+{
+  "allowlist": [
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-2-Clause-FreeBSD",
+    "BSD-3-Clause",
+    "ISC",
+    "MIT",
+    "MPL-2.0",
+    "Public Domain"
+  ]
+}

apm-lambda-extension/scripts/templates/NOTICE.txt.tmpl

@@ -0,0 +1,38 @@
+{{- define "depInfo" -}}
+{{- range $i, $dep := . }}
+{{ "-" | line }}
+Module  : {{ $dep.Name }}
+Version : {{ $dep.Version }}
+Time    : {{ $dep.VersionTime }}
+Licence : {{ $dep.LicenceType }}
+
+{{ $dep | licenceText }}
+{{ end }}
+{{- end -}}
+
+Copyright {{ currentYear }} Elasticsearch BV
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+{{ "=" | line }}
+Third party libraries used by the Elastic APM AWS Lambda extension.
+{{ "=" | line }}
+
+{{ template "depInfo" .Direct }}
+
+{{ if .Indirect }}
+{{ "=" | line }}
+Indirect dependencies
+
+{{ template "depInfo" .Indirect }}
+{{ end }}

apm-lambda-extension/scripts/templates/dependencies.asciidoc.tmpl

@@ -0,0 +1,34 @@
+{{- define "depRow" -}}
+{{- range $i, $dep := . }}
+| link:{{ $dep.URL }}[$${{ $dep.Name }}$$] | {{ $dep.Version }} | {{ $dep.LicenceType }}
+{{- end }}
+{{- end -}}
+// Generated documentation. Please do not edit.
+:page_id: dependencies
+
+[id="{p}-{page_id}"]
+= Third-party dependencies
+
+This page lists the third-party dependencies used to build {n}.
+
+[float]
+[id="{p}-dependencies-direct"]
+== Direct dependencies
+
+[options="header"]
+|===
+| Name | Version | Licence
+{{ template "depRow" .Direct  }}
+|===
+
+{{ if .Indirect }}
+[float]
+[id="{p}-dependencies-indirect"]
+== Indirect dependencies
+
+[options="header"]
+|===
+| Name | Version | Licence
+{{ template "depRow" .Indirect  }}
+|===
+{{ end }}