Code change:
# Refer: https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md curl -s 'https://spdx.org/licenses/licenses.json' -o "${KUBE_TEMP}"/licenses.json <del> number_of_licenses=$(jq '.licenses | length' "${KUBE_TEMP}"/licenses.json) loop_index_length=$(( number_of_licenses - 1 )) </del> echo '[INFO] Fetching current list of CNCF approved licenses...' <del> for index in $(seq 0 $loop_index_length); do licenseID=$(jq ".licenses[$index] .licenseId" "${KUBE_TEMP}"/licenses.json) if [[ $(jq ".licenses[$index] .isDeprecatedLicenseId" "${KUBE_TEMP}"/licenses.json) == false ]] then allowed_licenses+=("${licenseID}") fi done </del> <ins> while read -r L; do allowed_licenses+=("${L}") done < <(jq -r '.licenses[] | select(.isDeprecatedLicenseId==false) .licenseId' "${KUBE_TEMP}"/licenses.json) </ins> # Scanning go-packages under the project & verifying against the CNCF approved list of licenses echo '[INFO] Starting license scan on go-packages...' go-licenses report ./... >> "${KUBE_TEMP}"/licenses.csv echo -e 'PACKAGE_NAME  LICENSE_NAME  LICENSE_URLn' >> "${KUBE_TEMP}"/approved_licenses.dump <del> while IFS=, read -r GO_PACKAGE LICENSE_URL LICENSE_NAME do FORMATTED_LICENSE_URL= if [[ " ${allowed_licenses[*]} " == *"${LICENSE_NAME}"* ]]; then if [[ "${LICENSE_URL}" == 'Unknown' ]]; then if  [[ "${GO_PACKAGE}" != k8s.io/* ]]; then echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${KUBE_TEMP}"/approved_licenses_with_missing_urls.dump packages_url_missing+=("${GO_PACKAGE}") else LICENSE_URL='https://github.com/kubernetes/kubernetes/blob/master/LICENSE' echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${KUBE_TEMP}"/approved_licenses.dump fi elif curl -Is "${LICENSE_URL}" | head -1 | grep -q 404; then # Check whether the License URL is incorrectly formed # TODO: Remove this workaround check once PR https://github.com/google/go-licenses/pull/110 is merged IFS='/' read -r -a split_license_url <<< ${LICENSE_URL} for part_of_url in "${split_license_url[@]}" do if  [[ ${part_of_url} == '' ]] then continue elif	[[ ${part_of_url} == 'https:' ]] then FORMATTED_LICENSE_URL+='https://' else if [[ ${part_of_url} =~ ^v[0-9]+.[0-9]+.[0-9]+ ]] then FORMATTED_LICENSE_URL+="${part_of_url}/${split_license_url[-1]}" break else FORMATTED_LICENSE_URL+="${part_of_url}/" fi fi done if curl -Is "${FORMATTED_LICENSE_URL}" | head -1 | grep -q 404; then packages_url_missing+=("${GO_PACKAGE}") echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${KUBE_TEMP}"/approved_licenses_with_missing_urls.dump else echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${FORMATTED_LICENSE_URL}" >> "${KUBE_TEMP}"/approved_licenses.dump fi else echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${KUBE_TEMP}"/approved_licenses.dump fi else echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${KUBE_TEMP}"/notapproved_licenses.dump packages_flagged+=("${GO_PACKAGE}") fi </del> <ins> while IFS=, read -r GO_PACKAGE LICENSE_URL LICENSE_NAME; do if ! printf -- "%sn" "${allowed_licenses[@]}" | grep -q "^${LICENSE_NAME}$"; then echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${KUBE_TEMP}"/notapproved_licenses.dump packages_flagged+=("${GO_PACKAGE}") continue fi if [[ "${LICENSE_URL}" == 'Unknown' ]]; then if  [[ "${GO_PACKAGE}" != k8s.io/* ]]; then echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${KUBE_TEMP}"/approved_licenses_with_missing_urls.dump packages_url_missing+=("${GO_PACKAGE}") else LICENSE_URL='https://github.com/kubernetes/kubernetes/blob/master/LICENSE' echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${KUBE_TEMP}"/approved_licenses.dump fi continue fi if [[ "$(http_code "${LICENSE_URL}")" != 404 ]]; then echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${KUBE_TEMP}"/approved_licenses.dump continue fi # The URL 404'ed.  Try parent-paths. #echo -e "DBG: err 404 ${LICENSE_URL}" dir="$(dirname "${LICENSE_URL}")" file="$(basename "${LICENSE_URL}")" while [[ "${dir}" != "." ]]; do dir="$(dirname "${dir}")" #echo "DBG:     try ${dir}/${file}" if [[ "$(http_code "${dir}/${file}")" != 404 ]]; then #echo "DBG:         it worked" echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${dir}/${file}" >> "${KUBE_TEMP}"/approved_licenses.dump break fi #echo "DBG:         still 404" done if [[ "${dir}" == "." ]];then #echo "DBG:     failed to find a license" packages_url_missing+=("${GO_PACKAGE}") echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${KUBE_TEMP}"/approved_licenses_with_missing_urls.dump fi </ins> done < "${KUBE_TEMP}"/licenses.csv awk '{ printf "%-100s : %-20s : %sn", $1, $2, $3 }' "${KUBE_TEMP}"/approved_licenses.dump if [[ ${#packages_url_missing[@]} -gt 0 ]]; then <del> echo -e 'n[ERROR] The following go-packages in the project have unknown or unreachable license URL:' awk '{ printf "%-100s :  %-20s : %sn", $1, $2, $3 }' "${KUBE_TEMP}"/approved_licenses_with_missing_urls.dump exit_code=1 </del> <ins> echo -e 'n[ERROR] The following go-packages in the project have unknown or unreachable license URL:' awk '{ printf "%-100s :  %-20s : %sn", $1, $2, $3 }' "${KUBE_TEMP}"/approved_licenses_with_missing_urls.dump exit_code=1 </ins> fi if [[ ${#packages_flagged[@]} -gt 0 ]]; then <del> kube::log::error "[ERROR] The following go-packages in the project are using non-CNCF approved licenses. Please refer to the CNCF's approved licence list for further information: https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md" awk '{ printf "%-100s :  %-20s : %sn", $1, $2, $3 }' "${KUBE_TEMP}"/notapproved_licenses.dump exit_code=1 </del> <ins> kube::log::error "[ERROR] The following go-packages in the project are using non-CNCF approved licenses. Please refer to the CNCF's approved licence list for further information: https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md" awk '{ printf "%-100s :  %-20s : %sn", $1, $2, $3 }' "${KUBE_TEMP}"/notapproved_licenses.dump exit_code=1 </ins> elif [[ "${exit_code}" -eq 1 ]]; then <del> kube::log::status "[ERROR] Project is using go-packages with unknown or unreachable license URLs. Please refer to the CNCF's approved licence list for further information: https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md" </del> <ins> kube::log::status "[ERROR] Project is using go-packages with unknown or unreachable license URLs. Please refer to the CNCF's approved licence list for further information: https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md" </ins> else <del> kube::log::status "[SUCCESS] Scan complete! All go-packages under the project are using current CNCF approved licenses!" </del> <ins> kube::log::status "[SUCCESS] Scan complete! All go-packages under the project are using current CNCF approved licenses!" </ins> fi exit "${exit_code}"

Related discussion:
text: When I run it manually, I get: Clearly that is wrong, it's just looking in the wrong place. I also see a reference to which is still open 2 years later. Does this script run? Is it useful?
/sig testing
This job runs the script and fails as well:
If it ran fast, would we run it on every PR?
Another note: It runs around 5-6 minutes right now:
It has a very poorly placed n^2 loop. That can be fixed. Unfortunately the go-licenses tool itself is really slow, too.
It looks like that go-licenses cannot handle multi module repos if the license is only available in the repo root: The question is: do we want to contribute such a feature or don't we need the license test at all?
We should vet licenses in presubmit. Though I think dep approvers are pretty good at checking this, one less thing to manually vet would be ideal. If we can't speed it up, we can add a job that only runs on vendor/ changes.
/triage accepted