diff --git a/.gitignore b/.gitignore index 42e1c380..75fe3a85 100644 --- a/.gitignore +++ b/.gitignore @@ -29,4 +29,5 @@ Defaults.mk userdocs/_* userdocs/reference/* /warewulf-?.?.?/ -*.coverprofile \ No newline at end of file +*.coverprofile +LICENSE_DEPENDENCIES.csv diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 097445f4..9dbe67bd 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -2,23 +2,205 @@ ## Contributor's Agreement -You are under no obligation whatsoever to provide any bug fixes, patches, or -upgrades to the features, functionality or performance of the source code -("Enhancements") to anyone; however, if you choose to make your Enhancements -available either publicly, or directly to the project, without imposing a -separate written license agreement for such Enhancements, then you hereby grant -the following license: a non-exclusive, royalty-free perpetual license to -install, use, modify, prepare derivative works, incorporate into other computer -software, distribute, and sublicense such enhancements or derivative works +You are under no obligation whatsoever to provide any bug fixes, +patches, or upgrades to the features, functionality or performance of +the source code ("Enhancements") to anyone; however, if you choose to +make your Enhancements available either publicly, or directly to the +project, without imposing a separate written license agreement for +such Enhancements, then you hereby grant the following license: a +non-exclusive, royalty-free perpetual license to install, use, modify, +prepare derivative works, incorporate into other computer software, +distribute, and sublicense such enhancements or derivative works thereof, in binary and source code form. -## Getting Started +## Technical Steering Committee -When contributing to Warewulf, it is important to properly communicate the gist -of the contribution. If it is a simple code or editorial fix, simply explaining -this within the GitHub Pull Request (PR) will suffice. But if this is a larger -fix or Enhancement, you are advised to first discuss the change with the -project leader or developers. +(in alphabetical order by surname) -All commits must be "Signed-off" by using `git commit -s`, acknowledging that -you agree to the [Developer Certificate of Origin](DCO.txt). +- [Anderson, Jonathon](janderson@ciq.com) (CIQ) +- [Goll, Christian](cgoll@suse.de) (SUSE) +- [Hanks, John](griznog@gmail.com) (Chan Zuckerburg Biohub) +- [Kurtzer, Greg](gmk@ciq.com) (CIQ) +- [Siadal, Jeremy](jeremy.c.siadal@intel.com) (Intel) + +## Pull requests + +- All commits must be "Signed-off" (i.e., by using `git commit -s`), + acknowledging that you agree to the [Developer Certificate of + Origin](DCO.txt). + +- All PRs should summarize the purpose of the PR in the attached + GitHub conversation. + +- Larger fixes or enhancemens should be discussed with the TSC or + developers, e.g., on Slack or over Email. + +- PRs should be sent to the `main` branch by default. A committer or + the TSC may request that certain bug fixes also be submitted to a + minor release branch. + +- Follow existing code style precedent. For Go, you should mostly + conform to the style and form enforced by the "go fmt" and "golint" + tools for proper formatting. + +- For any new functionality, please write appropriate go tests. These + run as part of the continuous integration system. + +- Make sure that the project's default copyright and header have been + included in any new source files. + +- Make sure your code passes linting, by running `make lint` before + submitting the PR. + +- Make sure you have locally tested using `make test` and that all + tests succeed before submitting the PR. + +- PRs which introduce a new Go dependency to the project should + explain why the dependency is required. Any new dependency should be + added to `LICENSE_DEPENDENCIES.md` by running + `scripts/update-license-dependencies.sh`. + +## Documentation + +- The [README](README.md) is a place to document critical information + for new users of Warewulf. It should typically not change, but in + the case where a change is necessary a PR may update it. + +- The [CHANGELOG](CHANGELOG.md) documents **functional** differences + between versions of Warewulf, and should **not** read like a commit + log. + + Once a release is tagged (*e.g. v4.0.0*), a new top level section + is made titled **Changes Since vX.Y.Z** (*e.g. Changes Since + v4.0.0*) where new changes are documented, leaving the previous + section immutable. + + The CHANGELOG must be updated for any of the following changes: + - Renamed commands or subcommands + - Deprecated / removed commands or subcommands + - Changed defaults / behaviors + - Backwards-incompatible changes + - New features / functionalities + +- The [user guide](https://warewulf.org/docs/) should document + anything pertinent to the use of Warewulf. Changes to Warewulf + functionality should simultaneously include pertinent updates to the + user guide, which is maintained alongside the code under + `userdocs/`. + +## Branches + +- Development occurs primarily on the `main` branch. This is the + branch that most PRs should be submitted against unless otherwise + directed. + +- A minor release is accompanied by a minor branch named `v4.MINOR.x` + from which patch releases may be generated. + +- No other branches are maintained in the primary Warewulf repository. + +## Merging + +- All new contributions to the project should first be merged through + a PR to the `main` branch. + +- Patches to a minor branch should be copied ("cherry-picked") from a + previously-merged PR. + +- Each PR must, prior to merge, be reviewed and approved by a + committer other than the author of the PR. + +- Before approving of a PR, an approver must confirm that + - all lint checks and tests pass with the given PR; + - new tests to cover the change have been added as appropriate; + - all commits in the PR have an appropriate DCO “Signed-Off-By”; + - documentation, including (but not necessarily limited to) the + CHANGELOG and user guide, have been updated appropriately. + +- Any committer may, at his discretion, merge a PR that has the + requisite approvals and for which all tests are passing. This + includes, but is not limited to, a reviewer of the PR or the author + of the PR. + +- Committers should consider the current roadmap when choosing to + approve or merge a given PR. For example, proper and successful + bugfixes are likely always appropriate to merge. However, new + features may not be appropriate to merge if they are not included in + the next milestone. New features which incompatibly alter existing + interfaces or behavior should not be approved or merged unless + included in the current milestone. + +- Committers which approve or merge PRs which are disruptive to the + current milestone may have their committer access revoked by the + TSC. + +## Roadmapping + +- The project roadmap is formally defined by GitHub milestones + associated with the primary Warewulf repository. + +- The roadmap, and its milestones, are drafted and managed by the TSC + chair to reflect and codify the priorities of the TSC and the + community. Definition of the roadmap includes, but is not limited to + - the name, description, and due date for each milestone; + - the issues and PRs associated with a given milestone. + +- Only the TSC chair may assign issues to or remove issues from + milestones. The TSC chair has proactive discretion to assign or move + issues to reflect and codify the priorities of the TSC and the + community, but may not act in opposition to the direction of the + TSC. + +- Requests for changes to the roadmap that are made in the Warewulf + community meeting are recorded in the Warewulf community journal. + +## Releases + +- Warewulf releases follow a `MAJOR.MINOR.PATCH` format. + +- Releases are generated by an automated process encoded as a GitHub + actions workflow. + +- All releases must pass the full Warewulf test suite. + +- Releases are published by a member of the TSC at the direction of + the TSC. + +- Each release is accompanied by an updated changelog. + +### Major releases + +- All releases occur within major version “4.” + +### Minor releases + +- A minor release is denoted by a tag named `v4.MINOR.0`. + +- A minor release candidate is denoted by a tag named + `v4.MINOR.0rcNUMBER`, where `NUMBER` begins at “1” and increments + for each candidate for the given minor release. + +- Minor releases are defined by a previously-planned milestone named + for the projected release. + +- A minor release candidate may be published by the TSC when all + functional issues and pull requests in the associated milestone are + closed. (e.g., documentation issues and pull requests may remain.) + This may also be accomplished by the TSC re-scoping the associated + milestone (e.g., by moving issues or pull requests to a different + milestone). + +- A minor release may be published by the TSC two weeks after a + release candidate if no major defects have been found in the release + candidate and there are no open issues or pull requests. + +### Patch releases + +- A patch release is denoted by a tax named `v4.MINOR.PATCH` where + `PATCH` is greater than `0`, and tags a commit on a minor branch. + +- The TSC may identify changes in the “main” branch to be ported to a + minor branch. + +- A patch release may be published by the TSC whenever one or more + changes have been ported to a minor branch. diff --git a/LICENSE_DEPENDENCIES.md b/LICENSE_DEPENDENCIES.md new file mode 100644 index 00000000..7c6a920c --- /dev/null +++ b/LICENSE_DEPENDENCIES.md @@ -0,0 +1,577 @@ +# Dependency Licenses + +This project uses a number of dependencies, in accordance with their +own license terms. These dependencies are managed via the project +`go.mod` and `go.sum` files, and included in a `vendor/` directory in +our official source tarballs. + +A full build or package of Warewulf uses all dependencies listed +below. If you `import "github.com/hpcng/warewulf"` into your own +project then you may use a subset of them. + +The dependencies and their licenses are as follows: + +## github.com/containerd/containerd/errdefs + +**License:** Apache-2.0 + +**License URL:** + +## github.com/containers/image/v5 + +**License:** Apache-2.0 + +**License URL:** + +## github.com/containers/libtrust + +**License:** Apache-2.0 + +**License URL:** + +## github.com/containers/ocicrypt + +**License:** Apache-2.0 + +**License URL:** + +## github.com/containers/storage + +**License:** Apache-2.0 + +**License URL:** + +## github.com/coreos/go-semver/semver + +**License:** Apache-2.0 + +**License URL:** + +## github.com/coreos/go-systemd/daemon + +**License:** Apache-2.0 + +**License URL:** + +## github.com/coreos/go-systemd/v22/unit + +**License:** Apache-2.0 + +**License URL:** + +## github.com/coreos/ignition/v2/config + +**License:** Apache-2.0 + +**License URL:** + +## github.com/coreos/vcontext + +**License:** Apache-2.0 + +**License URL:** + +## github.com/digitalocean/go-smbios/smbios + +**License:** Apache-2.0 + +**License URL:** + +## github.com/docker/distribution + +**License:** Apache-2.0 + +**License URL:** + +## github.com/docker/docker + +**License:** Apache-2.0 + +**License URL:** + +## github.com/docker/go-connections + +**License:** Apache-2.0 + +**License URL:** + +## github.com/docker/go-metrics + +**License:** Apache-2.0 + +**License URL:** + +## github.com/docker/go-units + +**License:** Apache-2.0 + +**License URL:** + +## github.com/golang/glog + +**License:** Apache-2.0 + +**License URL:** + +## github.com/matttproud/golang_protobuf_extensions/pbutil + +**License:** Apache-2.0 + +**License URL:** + +## github.com/moby/sys/mountinfo + +**License:** Apache-2.0 + +**License URL:** + +## github.com/opencontainers/go-digest + +**License:** Apache-2.0 + +**License URL:** + +## github.com/opencontainers/image-spec/specs-go + +**License:** Apache-2.0 + +**License URL:** + +## github.com/opencontainers/runc/libcontainer + +**License:** Apache-2.0 + +**License URL:** + +## github.com/opencontainers/runtime-spec/specs-go + +**License:** Apache-2.0 + +**License URL:** + +## github.com/opencontainers/umoci + +**License:** Apache-2.0 + +**License URL:** + +## github.com/opencontainers/umoci/third_party/shared + +**License:** Apache-2.0 + +**License URL:** + +## github.com/opencontainers/umoci/third_party/user + +**License:** Apache-2.0 + +**License URL:** + +## github.com/pquerna/ffjson/fflib/v1 + +**License:** Apache-2.0 + +**License URL:** + +## github.com/prometheus/client_golang/prometheus + +**License:** Apache-2.0 + +**License URL:** + +## github.com/prometheus/client_model/go + +**License:** Apache-2.0 + +**License URL:** + +## github.com/prometheus/common + +**License:** Apache-2.0 + +**License URL:** + +## github.com/prometheus/procfs + +**License:** Apache-2.0 + +**License URL:** + +## github.com/rootless-containers/proto/go-proto + +**License:** Apache-2.0 + +**License URL:** + +## github.com/spf13/cobra + +**License:** Apache-2.0 + +**License URL:** + +## github.com/stefanberger/go-pkcs11uri + +**License:** Apache-2.0 + +**License URL:** + +## github.com/vbatts/go-mtree/pkg/govis + +**License:** Apache-2.0 + +**License URL:** + +## google.golang.org/genproto + +**License:** Apache-2.0 + +**Project URL:** + +## google.golang.org/grpc + +**License:** Apache-2.0 + +**Project URL:** + +## gopkg.in/square/go-jose.v2 + +**License:** Apache-2.0 + +**Project URL:** + +## gopkg.in/yaml.v2 + +**License:** Apache-2.0 + +**Project URL:** + +## github.com/pkg/errors + +**License:** BSD-2-Clause + +**License URL:** + +## github.com/russross/blackfriday/v2 + +**License:** BSD-2-Clause + +**License URL:** + +## github.com/syndtr/gocapability/capability + +**License:** BSD-2-Clause + +**License URL:** + +## github.com/cyphar/filepath-securejoin + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/gogo/protobuf/proto + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/golang/protobuf + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/golang/snappy + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/google/uuid + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/gorilla/mux + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/grpc-ecosystem/grpc-gateway/v2 + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/klauspost/compress + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/manifoldco/promptui + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/miekg/pkcs11 + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/mtrmac/gpgme + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/spf13/pflag + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/ulikunitz/xz + +**License:** BSD-3-Clause + +**License URL:** + +## github.com/vbatts/go-mtree + +**License:** BSD-3-Clause + +**License URL:** + +## golang.org/x/crypto + +**License:** BSD-3-Clause + +**Project URL:** + +## golang.org/x/net + +**License:** BSD-3-Clause + +**Project URL:** + +## golang.org/x/sync/semaphore + +**License:** BSD-3-Clause + +**Project URL:** + +## golang.org/x/sys/unix + +**License:** BSD-3-Clause + +**Project URL:** + +## golang.org/x/term + +**License:** BSD-3-Clause + +**Project URL:** + +## golang.org/x/text + +**License:** BSD-3-Clause + +**Project URL:** + +## google.golang.org/protobuf + +**License:** BSD-3-Clause + +**Project URL:** + +## gopkg.in/square/go-jose.v2/json + +**License:** BSD-3-Clause + +**Project URL:** + +## github.com/BurntSushi/toml + +**License:** MIT + +**License URL:** + +## github.com/VividCortex/ewma + +**License:** MIT + +**License URL:** + +## github.com/acarl005/stripansi + +**License:** MIT + +**License URL:** + +## github.com/apex/log + +**License:** MIT + +**License URL:** + +## github.com/beorn7/perks/quantile + +**License:** MIT + +**License URL:** + +## github.com/cespare/xxhash/v2 + +**License:** MIT + +**License URL:** + +## github.com/chzyer/readline + +**License:** MIT + +**License URL:** + +## github.com/cpuguy83/go-md2man/v2/md2man + +**License:** MIT + +**License URL:** + +## github.com/creasty/defaults + +**License:** MIT + +**License URL:** + +## github.com/docker/docker-credential-helpers + +**License:** MIT + +**License URL:** + +## github.com/fatih/color + +**License:** MIT + +**License URL:** + +## github.com/ghodss/yaml + +**License:** MIT + +**License URL:** + +## github.com/klauspost/compress/zstd/internal/xxhash + +**License:** MIT + +**License URL:** + +## github.com/klauspost/pgzip + +**License:** MIT + +**License URL:** + +## github.com/mattn/go-colorable + +**License:** MIT + +**License URL:** + +## github.com/mattn/go-isatty + +**License:** MIT + +**License URL:** + +## github.com/mattn/go-runewidth + +**License:** MIT + +**License URL:** + +## github.com/olekukonko/tablewriter + +**License:** MIT + +**License URL:** + +## github.com/sirupsen/logrus + +**License:** MIT + +**License URL:** + +## github.com/urfave/cli + +**License:** MIT + +**License URL:** + +## github.com/vincent-petithory/dataurl + +**License:** MIT + +**License URL:** + +## go.etcd.io/bbolt + +**License:** MIT + +**Project URL:** + +## go.mozilla.org/pkcs7 + +**License:** MIT + +**Project URL:** + +## gopkg.in/yaml.v3 + +**License:** MIT + +**Project URL:** + +## github.com/talos-systems/go-smbios/smbios + +**License:** MPL-2.0 + +**License URL:** + +## github.com/vbauerster/mpb/v5 + +**License:** Unknown + +**Project URL:** + +## github.com/vbauerster/mpb/v5/cwriter + +**License:** Unknown + +**Project URL:** + +## github.com/vbauerster/mpb/v5/decor + +**License:** Unknown + +**Project URL:** + +## github.com/vbauerster/mpb/v5/internal + +**License:** Unknown + +**Project URL:** + diff --git a/scripts/update-license-dependencies.sh b/scripts/update-license-dependencies.sh new file mode 100644 index 00000000..4254c484 --- /dev/null +++ b/scripts/update-license-dependencies.sh @@ -0,0 +1,63 @@ +#!/bin/sh + +set -e +set -u + +go install github.com/google/go-licenses@v1.0.0 + +if [ -d "vendor" ]; then + echo "Please remove vendor directory before running this script" + exit 255 +fi + +if [ ! -f "go.mod" ]; then + echo "This script must be called from the project root directory," + echo "i.e. as scripts/update-license-dependencise.sh" + exit 255 +fi + +# Exclude ourselves +exclude="github.com/hpcng/warewulf" + +# Ensure a constant sort order +export LC_ALL=C + +go-licenses csv ./... | grep -v -E "${exclude}" | sort -k3,3 -k1,1 -t, > LICENSE_DEPENDENCIES.csv + +# Header for the markdown file +cat <<-'EOF' >LICENSE_DEPENDENCIES.md +# Dependency Licenses + +This project uses a number of dependencies, in accordance with their +own license terms. These dependencies are managed via the project +`go.mod` and `go.sum` files, and included in a `vendor/` directory in +our official source tarballs. + +A full build or package of Warewulf uses all dependencies listed +below. If you `import "github.com/hpcng/warewulf"` into your own +project then you may use a subset of them. + +The dependencies and their licenses are as follows: + +EOF + +while IFS="," read -r dep url license; do + { + echo "## ${dep}" + echo "" + echo "**License:** ${license}" + echo "" + } >>LICENSE_DEPENDENCIES.md + + # go-licenses can't work out the web url for non-github projects. + # Fall back to using the dependency URL as a project URL + if [ "${url}" = "Unknown" ]; then + echo "**Project URL:** " >>LICENSE_DEPENDENCIES.md + else + echo "**License URL:** <${url}>" >>LICENSE_DEPENDENCIES.md + fi + echo "" >>LICENSE_DEPENDENCIES.md +done