Re: [yocto] License reporting for golang (and rust)

["Irving ST" <irving@ssfivy.com>]

Hi,

For anyone else having the same problem, here's what I eventually did
for my go stuff:

I created a bbclass containing a task that gets inherited by all
packages, but the task only does some work when it detects that it is
inherited by a golang recipe.
The task basically sets up GOPATH and calls
https://github.com/rancher/trash - this tool populates all the source
dependencies and generate a trash.lock file in the repository.
Then I used https://github.com/pivotal/LicenseFinder to generate a
json report that can be postprocessed with python.

To me it seems that Go used the vendor directory approach in the past,
and there are multiple tools that can be used for this; and nowadays
go seems to have switched to a different approach called go modules.
With this multiple tools and methods of managing dependencies, I am
not sure whether it is feasible to integrate this in Yocto at all -
though I think I have seen mailing list posts on meta-virtualization
adding vendor information to their recipes, so maybe some progress is
happening there.

Best regards,
Irving Tjiptowarsono

On Tue, Jun 30, 2020 at 7:32 AM Robert Berger@yocto.user
<robert.berger.yocto.user@gmail.com> wrote:
>
> Hi,
>
> My comments are in-line
>
> On 22/06/2020 11:53, Irving ST wrote:
> > Hello,
> >
> > I am building a device that uses some Go (and Rust) dependencies. This
> > is on Yocto 2.7 / Warrior.
> >
> > I noticed that after building an image, the generated license.manifest
> > and package.manifest (in tmp/deploy/licenses/) does not contain any
> > mention of go packages or rust crates. The go packages seem to
> > generate directories in tmp/deploy/licenses/ but they do not seem to
> > be reported in the final image.
>
> On dunfell 3.1.1 I see this:
>
> licenses/
> └── github.com-influxdata-influxdb
>      ├── generic_MIT
>      ├── LICENSE
>      └── recipeinfo
>
> which is wrong, since I would need to add all the licenses of all the
> dependencies golang pulls in as well to the recipe. It's shows only the
> top level license.
>
> In my license manifest I do have the influxdb:
>
> tmp/deploy/licenses/image-influxdb-from-source-container-x86-64-20200629205620/license.manifest
>
> PACKAGE NAME: github.com-influxdata-influxdb
> PACKAGE VERSION: 1.8.0
> RECIPE NAME: github.com-influxdata-influxdb
> LICENSE: MIT
>
> Regards,
>
> Robert
>
>
>