[YUNIKORN-2430] [UMBRELLA] Third-party license attribution

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.5.0
• Component/s: core - common, scheduler-interface, shim - kubernetes, webapp
• Target Version: 1.5.0
• Assignee: Craig Condit
• Reporter: Craig Condit
• Created: 21/Feb/24 17:39
• Updated: 20/Mar/24 14:32
• Resolved: 22/Feb/24 16:05

Description

Currently, we do not include license files from third-party components. As some licenses require attribution, we should include the correct license files from components we depend on.

For the go modules we can probably leverage https://github.com/google/go-licenses to provide the metadata. This provides both dependency checking of forbidden licenses, and automatic downloads of license files.

The yunikorn-web repository only needs our own LICENSE/NOTICE files, as we have no 3rd party go dependencies, and javascript deps are written to /html/3rdpartydependencies.txt in the generated image.

Sub-Tasks

• Web: Bundle LICENSE/NOTICE into Docker image: Closed
• Shim: Bundle LICENSE/NOTICE and third-party-licenses into Docker images: Closed