dep-collector

README

dep-collector

dep-collector is a tool for gathering up a collection of licenses for Go dependencies that have been pulled into the idiomatic vendor/ directory. The resulting file from running dep-collector is intended for inclusion in container images to respect the licenses of the included software.

Basic Usage

You can run dep-collector on one or more Go import paths as entrypoints, and it will:

1. Walk the transitive dependencies to identify vendored software packages,
2. Search for licenses for each vendored dependency,
3. Dump a file containing the licenses for each vendored import.

For example (single import path):

$ dep-collector .
===========================================================
Import: github.com/mattmoor/dep-collector/vendor/github.com/google/licenseclassifier

                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/
...

For example (multiple import paths):

$ dep-collector ./cmd/controller ./cmd/sleeper

===========================================================
Import: github.com/mattmoor/warm-image/vendor/cloud.google.com/go

                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

CSV Usage

You can also run dep-collector in a mode that produces CSV output, including basic classification of the license.

In order to run dep-collector in this mode, you must first run: go get github.com/google/licenseclassifier

For example:

$ dep-collector -csv .
github.com/google/licenseclassifier,Static,,https://github.com/mattmoor/dep-collector/blob/master/vendor/github.com/google/licenseclassifier/LICENSE,Apache-2.0
github.com/google/licenseclassifier/stringclassifier,Static,,https://github.com/mattmoor/dep-collector/blob/master/vendor/github.com/google/licenseclassifier/stringclassifier/LICENSE,Apache-2.0
github.com/sergi/go-diff,Static,,https://github.com/mattmoor/dep-collector/blob/master/vendor/github.com/sergi/go-diff/LICENSE,MIT

The columns here are:

• Import Path,
• How the dependency is linked in (always reports "static"),
• A column for whether any modifications have been made (always empty),
• The URL by which to access the license file (assumes master),
• A classification of what license this is (using this).

Check mode

dep-collector also includes a mode that will check for "forbidden" licenses.

In order to run dep-collector in this mode, you must first run: go get github.com/google/licenseclassifier

For example (failing):

$ dep-collector -check ./foo/bar/baz
2018/07/20 22:01:29 Error checking license collection: Errors validating licenses:
Found matching forbidden license in "foo.io/bar/vendor/github.com/BurntSushi/toml":WTFPL

For example (passing):

$ dep-collector -check .
2018/07/20 22:29:09 No errors found.