Add a license-checking job

This uses https://github.com/uw-labs/lichen, which is closer to our
requirements for CNCF validation than
https://github.com/mitchellh/golicense and performs validation using
local information.

The references for the Allowlist and the approved exceptions are
described in the lichen configuration file.

Fixes: submariner-io#801
Signed-off-by: Stephen Kitt <skitt@redhat.com>

.github/workflows/linting.yml

@@ -46,6 +46,16 @@ jobs:
       - name: Check License Headers
         uses: nilp0inter/search-legal-headers@v0.1.0
 
+  licenses:
+    name: Dependency licenses
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v2
+
+      - name: Check the licenses
+        run: make licensecheck
+
   markdown-link-check:
     name: Markdown Links (modified files)
     runs-on: ubuntu-latest

.lichen.yaml

@@ -0,0 +1,26 @@
+# Licenses other than Apache-2.0 are governed by
+# https://github.com/cncf/foundation/blob/master/allowed-third-party-license-policy.md#approved-licenses-for-allowlist
+# Note that Allowlist also requires that projects were created
+# on GitHub at least 12 months prior and have at least 10 stars
+# or 10 forks
+allow:
+  - "Apache-2.0"
+  - "BSD-2-Clause"
+  - "BSD-2-Clause-FreeBSD"
+  - "BSD-3-Clause"
+  - "MIT"
+  - "ISC"
+  - "Python-2.0"
+  - "PostgreSQL"
+  - "X11"
+  - "Zlib"
+
+override:
+  - path: "github.com/rdegges/go-ipify"
+    licenses: ["Unlicense"]
+
+# https://github.com/cncf/foundation/tree/master/license-exceptions
+exceptions:
+  licenseNotPermitted:
+    - path: "github.com/hashicorp/golang-lru"
+      licenses: ["MPL-2.0"]

Dockerfile.dapper

@@ -11,7 +11,8 @@ ENV PROTOC_VERSION=3.15.5
 RUN curl -LO https://github.com/protocolbuffers/protobuf/releases/download/v3.15.5/protoc-${PROTOC_VERSION}-linux-x86_64.zip && \
     unzip protoc-${PROTOC_VERSION}-linux-x86_64.zip -d /usr/local && \
     rm -f protoc-${PROTOC_VERSION}-linux-x86_64.zip && \
-    GO111MODULE=off go get google.golang.org/protobuf/cmd/protoc-gen-go
+    GO111MODULE=off go get google.golang.org/protobuf/cmd/protoc-gen-go && \
+    GO111MODULE=off go get github.com/uw-labs/lichen
 
 WORKDIR ${DAPPER_SOURCE}
 

Makefile

@@ -85,12 +85,16 @@ IMAGES_ARGS = --platform $(subst $(space),$(comma),$(foreach arch,$(subst $(comm
 
 build: $(foreach arch,$(subst $(comma),$(space),$(ARCHES)),$(foreach binary,$(BINARIES),bin/linux/$(call gotodockerarch,$(arch))/$(binary)))
 
+licensecheck: BUILD_ARGS=--debug
+licensecheck: build
+	lichen -c .lichen.yaml $(foreach arch,$(subst $(comma),$(space),$(ARCHES)),$(foreach binary,$(BINARIES),bin/linux/$(call gotodockerarch,$(arch))/$(binary)))
+
 ci: validate unit build images
 
 $(TARGETS): vendor/modules.txt
 	./scripts/$@
 
-.PHONY: $(TARGETS) build ci images unit validate
+.PHONY: $(TARGETS) build ci images unit validate list-binaries
 
 else