Merge pull request #299 from SgtCoDFish/simplify-licenses

Simplify handling of licenses

Author: cert-manager-prow[bot]

modules/licenses/01_mod.mk

@@ -30,11 +30,11 @@ generate-go-licenses: #
 shared_generate_targets += generate-go-licenses
 
 define licenses_target
-$1/LICENSES: $1/go.mod $(licenses_go_work) | $(NEEDS_GO-LICENSES)
+$1/LICENSES: $1/go.mod $(licenses_go_work) $(dir $(lastword $(MAKEFILE_LIST)))/licenses.tmpl | $(NEEDS_GO-LICENSES)
 	cd $$(dir $$@) && \
 		GOWORK=$(abspath $(licenses_go_work)) \
 		GOOS=linux GOARCH=amd64 \
-		$(GO-LICENSES) report --ignore "$$(license_ignore)" ./... > LICENSES
+		$(GO-LICENSES) report --ignore "$$(license_ignore)" --template $(dir $(lastword $(MAKEFILE_LIST)))/licenses.tmpl ./... > LICENSES
 
 generate-go-licenses: $1/LICENSES
 # The /LICENSE targets make sure these files exist.

modules/licenses/licenses.tmpl

@@ -0,0 +1,24 @@
+This LICENSES file is generated by the `licenses` module in makefile-modules.
+
+The licenses below the "---" are determined by the go-licenses tool.
+
+The aim of this file is to collect the licenses of all dependencies, and provide
+a single source of truth for licenses used by this project.
+
+If CI reports that this file is out of date, you should be careful to check that the
+new licenses are acceptable for this project before running `make generate-go-licenses`
+to update this file.
+
+Acceptable licenses are those allowlisted by the CNCF[0].
+
+You MUST NOT add any new dependencies whose licenses are not allowlisted by the CNCF,
+or which do not have an explicit license exception[1].
+
+[0]: https://github.com/cncf/foundation/blob/db4179134ebe7fa00b140a050c19147db808b6fa/policies-guidance/allowed-third-party-license-policy.md#cncf-allowlist-license-policy
+[1]: https://github.com/cncf/foundation/blob/db4179134ebe7fa00b140a050c19147db808b6fa/license-exceptions/README.md
+
+---
+
+{{ range . -}}
+{{ .Name }},{{ .LicenseName }}
+{{ end -}}