packages: add sources for kubernetes-1.31 and ecr-credential-provider-1.31 #117
Conversation
| @@ -1,5 +1,8 @@ | |||
| [clarify."sigs.k8s.io/yaml"] | |||
| expression = "MIT AND BSD-3-Clause" | |||
| license-files = [ | |||
| { path = "LICENSE", hash = 0xcdf3ae00 }, | |||
| { path = "LICENSE", hash = 0x617d80bc }, | |||
There was a problem hiding this comment.
The license expression looks wrong, since this license indicates Apache-2.0.
I'd expect this clarify.toml entry to match the one under k8s-1.31. Are they using different versions of the module?
There was a problem hiding this comment.
Both kubernetes-1.31 and cloud-provider-aws upgrade https://github.com/kubernetes-sigs/yaml from 1.3 to 1.4:
- https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.31.md#changed
- kubernetes/cloud-provider-aws@v1.31.0-rc.0...v1.31.0
kubernetes-sigs/yaml v1.4 adds goyaml.v2 and goyaml.v3 subdirectories, which is the cause for this license change.
The license expression looks wrong, since this license indicates Apache-2.0.
Good catch, looks like they switched to MIT and Apache-2.0 from just MIT between the 1.3 and 1.4 releases
- https://github.com/kubernetes-sigs/yaml/blob/v1.3.0/LICENSE
- https://github.com/kubernetes-sigs/yaml/blob/v1.4.0/LICENSE
I'd expect this clarify.toml entry to match the one under k8s-1.31.
I made these changes mostly to appease build failures, and making that change caused failures, which I concluded were due to different usages of the underlying library. Would the correct approach here to be include all these licenses in %files ?
There was a problem hiding this comment.
As far as
Are they using different versions of the module?
I see in go.mod for both projects, they're using both goyaml.v2 and goyaml.v3
- https://github.com/kubernetes/cloud-provider-aws/blob/8af8a5b7b47af667fd2ee1df080ab39cbdc09f50/go.mod#L107-L108
- https://github.com/kubernetes/kubernetes/blob/bd04935008d2ad91461e2977f3b42f48968da550/go.mod#L87-L88
(the sigs yaml package forks gopkg.in/goyaml v2 and v3 to the goyaml.v2 and goyaml.v3 subdirectories, respectively)
There was a problem hiding this comment.
Kubernetes has sigs.k8s.io/yaml vendored, which IIUC is how bottlerocket-license-tool picks up its forks of gopkg.in/goyaml
For cloud-provider-aws, go mod vendor results in no goyaml.v3 vendored:
$ ls vendor/sigs.k8s.io/yaml
code-of-conduct.md CONTRIBUTING.md fields.go goyaml.v2 LICENSE OWNERS README.md RELEASE.md SECURITY_CONTACTS yaml.go yaml_go110.go
So it must not be using it
ginglis13
force-pushed
the
k8s-1.31-sources
branch
from
cabeed7
to
cad89c1
Compare
|
^ correct license expression for |
Signed-off-by: Gavin Inglis <giinglis@amazon.com>
Signed-off-by: Gavin Inglis <giinglis@amazon.com>
ginglis13
force-pushed
the
k8s-1.31-sources
branch
from
cad89c1
to
ead0822
Compare
|
^ correct license expression for sigs.k8s.io/yaml to retain |
Issue number:
Description of changes:
This updates boilerplate for kubernetes-1.31 and ecr-credential-provider-1.31 packages to use upstream releases of 1.31 sources.
Testing done:
Following the instruction Add kubernetes-1.28 package and variants bottlerocket#3329 (comment) with modification to apply settings in sequence rather than in one batch
apiclient apply:followed by
Terms of contribution:
By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.