Add license auditing tooling to the repository.

.buildkite/pipeline.yaml

@@ -323,6 +323,13 @@ steps:
     agents:
       arch: "amd64"
 
+  - <<: *common
+    <<: *source_test
+    label: ":scales: Dependency license check"
+    command: make license-check
+    agents:
+      arch: "amd64"
+
   # Basic unit tests.
   - <<: *common
     <<: *source_test

Makefile

@@ -77,6 +77,10 @@ query: ## Runs a bazel query. E.g. make query TARGETS=//test/...
 	@$(call query,$(OPTIONS) $(TARGETS))
 .PHONY: query
 
+mod: ## Runs a bazel mod command. E.g. make mod TARGETS="deps --output json"
+	@$(call mod,$(OPTIONS) $(TARGETS))
+.PHONY: mod
+
 sudo: ## Runs the given $(TARGETS) as per run, but using "sudo -E". E.g. make sudo TARGETS=test/root:root_test ARGS=-test.v
 	@$(call sudo,$(TARGETS),$(ARGS))
 .PHONY: sudo
@@ -206,6 +210,10 @@ governance-check: governance-regen ## Checks that the files derived from governa
 		(echo "Generated governance files are out of sync. Please run \`make governance-regen\`." >&2; exit 1)
 .PHONY: governance-check
 
+license-check: ## Checks that tools/licensecheck/dependencies.yaml has an entry for every dependency.
+	@$(call run,//tools/licensecheck/main:licensecheck,--mode=verify)
+.PHONY: license-check
+
 ##
 ## Canonical build and test targets.
 ##

governance/BUILD

@@ -2,3 +2,8 @@ package(
     default_applicable_licenses = ["//:license"],
     licenses = ["notice"],
 )
+
+exports_files(
+    ["licensing.yaml"],
+    visibility = ["//tools/licensecheck:__pkg__"],
+)

governance/licensing.yaml

@@ -0,0 +1,54 @@
+# Dependency licensing policy, enforced by tools/licensecheck's tests against
+# tools/licensecheck/dependencies.yaml.
+#
+# allowed_licenses lists the license identifiers that dependencies may use.
+# exceptions lists dependencies that are allowed to use other licenses; each
+# entry must match the dependency's current licenses exactly (string for one
+# license, sorted list for several, as in dependencies.yaml) so that license
+# changes resurface for review, and must explain why the exception is
+# acceptable.
+allowed_licenses:
+  - Apache-2.0
+  - 0BSD
+  - BSD-2-Clause
+  - BSD-2-Clause-FreeBSD
+  - BSD-3-Clause
+  - MIT
+  - MIT-0
+  - ISC
+  - OpenSSL
+  - OpenSSL-standalone
+  - PSF-2.0
+  - Python-2.0
+  - Python-2.0.1
+  - PostgreSQL
+  - SSLeay-standalone
+  - UPL-1.0
+  - X11
+  - Zlib
+  - Google patent license for Golang
+exceptions:
+  - dependency: google_root_pem
+    license: NOASSERTION
+    exception_rationale: >-
+      Not software: a bundle of CA root certificates from https://pki.goog,
+      installed as trust anchors in test images only and never part of
+      released gVisor binaries.
+  - dependency: grpc
+    license:
+      - Apache-2.0
+      - BSD-3-Clause
+      - MPL-2.0
+    exception_rationale: >-
+      gRPC is Apache-2.0; its LICENSE file additionally embeds notices for
+      bundled components, including the MPL-2.0 text covering Mozilla's CA
+      certificate data (etc/roots.pem). Used by Bazel build and test tooling
+      only; released gVisor binaries use the pure-Go google.golang.org/grpc.
+  - dependency: llvm-raw
+    license:
+      - Apache-2.0 WITH LLVM-exception
+      - MIT
+    exception_rationale: >-
+      LLVM is part of the benchmark toolchain only and is not distributed with
+      gVisor. The LLVM exception only relaxes Apache-2.0's requirements, and
+      the MIT match comes from third-party notices embedded in LICENSE.TXT.

tools/bazel.mk

@@ -360,6 +360,7 @@ run   = $(call header,RUN $(1) $(2)) && $(call build_paths,$(1),"$$0" $(2))
 sudo  = $(call header,SUDO $(1) $(2)) && $(call build_paths,$(1),sudo -E "$$0" $(2))
 test  = $(call header,TEST $(1)) && $(call wrapper,$(BAZEL) test --strip=never $(BAZEL_OPTIONS) $(TEST_OPTIONS) $(1))
 query = $(call wrapper,$(BAZEL) query $(BAZEL_OPTIONS) $(1))
+mod   = $(call wrapper,$(BAZEL) mod $(BASE_OPTIONS) $(BAZEL_OPTIONS) $(1))
 
 clean: ## Cleans the bazel cache.
 	@$(call clean)

tools/licensecheck/BUILD

@@ -0,0 +1,31 @@
+load("//tools:defs.bzl", "go_library", "go_test")
+
+package(
+    default_applicable_licenses = ["//:license"],
+    licenses = ["notice"],
+)
+
+go_library(
+    name = "licensecheck",
+    srcs = ["licensecheck.go"],
+    marshal = False,
+    stateify = False,
+    visibility = ["//tools/licensecheck:__subpackages__"],
+    deps = [
+        "@in_gopkg_yaml_v3//:go_default_library",
+        "@org_golang_x_mod//modfile:go_default_library",
+        "@org_golang_x_mod//module:go_default_library",
+        "@org_golang_x_mod//semver:go_default_library",
+    ],
+)
+
+go_test(
+    name = "licensecheck_test",
+    size = "small",
+    srcs = ["licensecheck_test.go"],
+    data = [
+        "dependencies.yaml",
+        "//governance:licensing.yaml",
+    ],
+    library = ":licensecheck",
+)