This is an automated email from the ASF dual-hosted git repository. sciabarracom pushed a commit to branch 0.9.0 in repository https://gitbox.apache.org/repos/asf/openserverless.git
commit 2ed63f5d6bf46df73d0ea4c5261e61fb902bf63a Author: Michele Sciabarra <[email protected]> AuthorDate: Sun Sep 13 14:32:50 2026 +0200 including upddates submodules --- .gitignore | 1 + LICENSE | 955 ++++++++++++++++++++++++------------------ NOTICE | 794 ++++++++++++++--------------------- Taskfile.yml | 48 ++- WARN | 58 ++- admin-api | 2 +- build | 2 +- cli | 2 +- devcontainer | 2 +- no-release.txt | 26 +- openserverless.code-workspace | 5 +- oplugins | 2 +- oplugins-op | 2 +- runtimes | 2 +- streamer | 2 +- testing | 2 +- 16 files changed, 998 insertions(+), 907 deletions(-) diff --git a/.gitignore b/.gitignore index da8a4ca..a173f35 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ ops RELEASE rebrander.log opsroot.orig +apache-rat*.jar diff --git a/LICENSE b/LICENSE index a57bcc4..6eb6a81 100644 --- a/LICENSE +++ b/LICENSE @@ -200,385 +200,184 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. - - -============================================================================== -LICENSES OF BUNDLED THIRD-PARTY SOFTWARE -Apache OpenServerless (Incubating) -- consolidated -============================================================================== - -Apache OpenServerless itself is licensed under the Apache License, -Version 2.0, reproduced above. - -The source distribution additionally contains a vendored copy of the Apache -OpenWhisk sources (build/openwhisk), which is Apache-2.0 licensed. The -convenience binaries and container images built from this source bundle the -third-party components listed below, each under its own license. - -Refer to https://www.apache.org/legal/resolved.html for the ASF -classification of these licenses. Components that are NOT compatible with -the Apache License 2.0, or that require special handling, are enumerated in -the WARN file. - -The per-component LICENSE files in each submodule remain authoritative for -that component. This file is the aggregate view. - - -============================================================================== -SECTION 1 -- Apache OpenServerless CLI (`ops` binary, cli/) -============================================================================== - -The `ops` binary is statically linked: all modules below are compiled into -the released executable. The MIT and BSD licenses require that the copyright -notice and permission notice be reproduced in binary redistributions; the -full license text of every module is available in the module's source -repository and in the Go module cache entry recorded in cli/go.sum. - ------------------------------------------------------------------------------- -Summary by license ------------------------------------------------------------------------------- - -Apache-2.0 - github.com/apache/openwhisk-client-go (v0.0.0-20210311185314-87edc2364717) - github.com/cloudfoundry/jibber_jabber (v0.0.0-20151120183258-bcc4c8345a21) - github.com/dominikbraun/graph (v0.23.0) - github.com/go-git/go-billy/v5 (v5.5.0) - github.com/go-git/go-git/v5 (v5.12.0) - github.com/golang/groupcache (v0.0.0-20210331224755-41bb18bfe9da) - github.com/Masterminds/goutils (v1.1.1) - github.com/pjbgf/sha1cd (v0.3.0) - github.com/sciabarracom/openwhisk-cli (v1.2.1) - github.com/sciabarracom/openwhisk-wskdeploy (v1.2.1) - github.com/skeema/knownhosts (v1.2.2) - github.com/spf13/cobra (v1.1.3) - github.com/xanzy/ssh-agent (v0.3.3) - gopkg.in/yaml.v2 (v2.4.0) - -BSD-2-Clause - github.com/emirpasic/gods (v1.18.1) - github.com/gomarkdown/markdown (v0.0.0-20240730141124-034f12af3bf6) - github.com/pkg/browser (v0.0.0-20240102092130-5ac0b6a4141c) - github.com/pkg/errors (v0.9.1) - github.com/zeebo/xxh3 (v1.0.2) - gopkg.in/warnings.v0 (v0.1.2) - -BSD-3-Clause - dario.cat/mergo (v1.0.0) - github.com/cloudflare/circl (v1.3.7) - github.com/cyphar/filepath-securejoin (v0.2.4) - github.com/go-git/gcfg (v1.5.1-0.20230307220236-3a3c6141e376) - github.com/go-task/template (v0.0.0-20240602015157-960e6f576656) - github.com/google/go-querystring (v1.1.0) - github.com/google/uuid (v1.6.0) - github.com/imdario/mergo (v0.3.13) - github.com/jessevdk/go-flags (v1.5.0) - github.com/Ladicle/tabwriter (v1.0.0) - github.com/ProtonMail/go-crypto (v1.0.0) - github.com/radovskyb/watcher (v1.0.7) - github.com/sciabarracom/sh/v3 (v3.8.3) - github.com/spf13/pflag (v1.0.5) - golang.org/x/crypto (v0.25.0) - golang.org/x/exp (v0.0.0-20240719175910-8a7402abbf56) - golang.org/x/net (v0.27.0) - golang.org/x/sync (v0.7.0) - golang.org/x/sys (v0.22.0) - golang.org/x/term (v0.22.0) - -ISC - github.com/davecgh/go-spew (v1.1.2-0.20180830191138-d8f796af33cc) - -MIT - github.com/a8m/envsubst (v1.4.2) - github.com/alecthomas/chroma/v2 (v2.14.0) - github.com/alessio/shellescape (v1.4.1) - github.com/cenkalti/backoff/v4 (v4.3.0) - github.com/dlclark/regexp2 (v1.11.0) - github.com/docopt/docopt-go (v0.0.0-20180111231733-ee0de3bc6815) - github.com/fatih/color (v1.17.0) - github.com/ghodss/yaml (v1.0.1-0.20190212211648-25d852aebe32) - github.com/go-task/slim-sprig/v3 (v3.0.0) - github.com/h2non/filetype (v1.1.3) - github.com/hokaccha/go-prettyjson (v0.0.0-20210113012101-fb4e108d2519) - github.com/huandu/xstrings (v1.3.2) - github.com/itchyny/gojq (v0.12.16) - github.com/itchyny/timefmt-go (v0.1.6) - github.com/jaytaylor/html2text (v0.0.0-20230321000545-74c2419ad056) - github.com/jbenet/go-context (v0.0.0-20150711004518-d14ea06fba99) - github.com/joho/godotenv (v1.5.1) - github.com/kevinburke/ssh_config (v1.2.0) - github.com/Masterminds/semver (v1.5.0) - github.com/Masterminds/semver/v3 (v3.2.1) - github.com/Masterminds/sprig (v2.22.0+incompatible) - github.com/mattn/go-colorable (v0.1.13) - github.com/mattn/go-isatty (v0.0.20) - github.com/mattn/go-runewidth (v0.0.15) - github.com/mattn/go-zglob (v0.0.4) - github.com/mitchellh/copystructure (v1.2.0) - github.com/mitchellh/go-homedir (v1.1.0) - github.com/mitchellh/hashstructure/v2 (v2.0.2) - github.com/mitchellh/reflectwalk (v1.0.2) - github.com/nicksnyder/go-i18n (v1.10.1) - github.com/nuvolaris/envsubst/cmd/envsubstmain (v0.0.0-20230603163828-10ca029cdb58) - github.com/nuvolaris/go-replace (v0.0.0-20230515190028-12766da1824c) - github.com/nuvolaris/goawk (v1.21.1) - github.com/nuvolaris/gron (v0.0.0-20231020134423-84e679ea6aad) - github.com/nuvolaris/jj (v0.0.0-20231020143327-10b90948a5d2) - github.com/nwidger/jsoncolor (v0.0.0-20170215171346-75a6de4340e5) - github.com/olekukonko/tablewriter (v0.0.5) - github.com/pelletier/go-toml (v1.8.1) - github.com/remeh/sizedwaitgroup (v1.0.0) - github.com/rivo/uniseg (v0.4.7) - github.com/sajari/fuzzy (v1.0.0) - github.com/sciabarracom/task/v3 (v3.38.12) - github.com/sergi/go-diff (v1.3.2-0.20230802210424-5b0b94c5c0d3) - github.com/ssor/bom (v0.0.0-20170718123548-6386211fdfcf) - github.com/tidwall/gjson (v1.14.0) - github.com/tidwall/match (v1.1.1) - github.com/tidwall/pretty (v1.2.0) - github.com/tidwall/sjson (v1.2.4) - github.com/zalando/go-keyring (v0.2.5) - gopkg.in/yaml.v3 (v3.0.1) - -Public Domain - github.com/xi2/xz (v0.0.0-20171230120015-48954b6210f8) - - -============================================================================== -SECTION 2 -- Apache OpenWhisk, vendored sources (build/openwhisk/) -============================================================================== - -The build/openwhisk directory contains a vendored copy of the Apache -OpenWhisk source tree, licensed under the Apache License, Version 2.0 -(reproduced at the top of this file). - ------------------------------------------------------------------------------- -2.1 Source incorporated from Spray ------------------------------------------------------------------------------- - -This distribution bundles the following component, which is available under -an Apache License 2.0 (https://opensource.org/licenses/Apache-2.0). - -Spray Caching 1.3.4 - (io.spray:spray-caching_2.11:1.3.4 - - http://spray.io/documentation/1.2.4/spray-caching/) - - The file - - build/openwhisk/common/scala/src/main/scala/org/apache/openwhisk/core/ - database/ConcurrentMapBackedCache.scala - - contains an implementation derived from Spray's [[spray.caching.Cache]] - and [[spray.caching.SimpleLruCache]] respectively. - - License included at build/openwhisk/licenses/LICENSE-spray.txt, or - https://github.com/spray/spray/blob/master/LICENSE - - Copyright (C) 2011-2015 the spray project <http://spray.io> - -The full text of the Spray license, as distributed in -build/openwhisk/licenses/LICENSE-spray.txt, is: - - This software is licensed under the Apache 2 license, quoted below. - - Copyright (C) 2011-2015 the spray project <http://spray.io> - - Licensed under the Apache License, Version 2.0 (the "License"); you may - not use this file except in compliance with the License. You may obtain - a copy of the License at - - [http://www.apache.org/licenses/LICENSE-2.0] - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - -The spray-json library (io.spray:spray-json, versions 1.3.4 and 1.3.5) is -resolved as a binary dependency by the Gradle build and is likewise -Apache-2.0, Copyright (C) 2011-2015 the spray project. - ------------------------------------------------------------------------------- -2.2 Gradle wrapper ------------------------------------------------------------------------------- - -This product bundles the files gradlew, gradlew.bat and -gradle/wrapper/gradle-wrapper.jar, which are distributed under the Apache -License, Version 2.0. The wrapper checked in under build/openwhisk resolves -Gradle 6.9.1 at build time. For details see build/openwhisk/gradlew and -build/openwhisk/gradlew.bat. - ------------------------------------------------------------------------------- -2.3 Scala / Java dependencies resolved at build time ------------------------------------------------------------------------------- - -The following are declared in build/openwhisk/**/build.gradle and -settings.gradle and resolved from Maven Central. They are not present in the -source distribution; they are linked into the published controller, invoker -and scheduler images. Grouped by license: - -Apache-2.0 - org.scala-lang:scala-library, scala-reflect (2.12.10) - com.typesafe.akka:akka-* (2.6.12) - com.typesafe.akka:akka-http-* (10.2.4) - com.typesafe.akka:akka-stream-kafka (2.0.2) - com.lightbend.akka.management / discovery (1.0.5) - com.lightbend.akka.grpc:akka-grpc-gradle-plugin (1.0.0) - com.lightbend.akka:akka-stream-alpakka-file, -s3 (1.1.2) - io.spray:spray-json (1.3.4, 1.3.5) - io.kamon:kamon-* (2.1.12) - org.apache.kafka:kafka-clients (2.4.0) - org.apache.curator:curator-* (4.0.0) - org.apache.commons:commons-lang3 (3.3.2, 3.8.1) - org.apache.commons:commons-io (1.3.2), commons-io:commons-io (2.6) - commons-codec:commons-codec (1.9) - commons-collections:commons-collections (3.2.2) - org.apache.httpcomponents:httpclient (4.5.5), httpmime (4.3.6) - io.fabric8:kubernetes-client (4.10.3) - com.amazonaws:aws-java-sdk-s3 (1.11.295), -cloudfront (1.11.517) - org.mongodb.scala:mongo-scala-driver (2.7.0) - com.ibm.etcd:etcd-java (0.0.13) - com.github.ben-manes.caffeine:caffeine (2.6.2) - com.google.code.gson:gson (2.3.1, 2.6.2) - org.codehaus.groovy:groovy-all (2.4.14) - com.fasterxml.uuid:java-uuid-generator (3.1.3) - com.atlassian.oai:swagger-request-validator-core (1.4.5) - io.opentracing:opentracing-api, -util, -mock (0.31.0) - io.prometheus:simpleclient, simpleclient_common (0.6.0) - io.zipkin.reporter2:zipkin-reporter, -sender-okhttp3 (2.6.1) - io.reactivex:rxjava (1.3.8), rxjava-reactive-streams (1.2.1) - org.scalatest:scalatest (3.0.8) -- test-only - io.rest-assured:rest-assured (4.0.0) -- test-only - -MIT - com.microsoft.azure:azure-cosmos (3.5.0), azure-cosmosdb (2.6.2) - org.slf4j:jcl-over-slf4j, log4j-over-slf4j (1.7.25) - org.mockito:mockito-core (2.27.0) -- test-only - org.testcontainers:elasticsearch, mongodb (1.17.1) -- test-only - -BSD-3-Clause - com.google.code.findbugs:jsr305 (3.0.2) - -LGPL-3.0 OR Apache-2.0 (Apache-2.0 elected) - com.github.java-json-tools:json-schema-validator (2.2.8) - *** SEE WARN *** - -EPL-1.0 OR LGPL-2.1 (Category B, binary only, unmodified) - ch.qos.logback:logback-classic (1.2.3) - *** SEE WARN *** - -EPL-1.0 (Category B, test-only) - junit:junit (4.11) - *** SEE WARN *** - -IMPORTANT -- Akka licensing ---------------------------- -Akka 2.6.12 and Akka HTTP 10.2.4 as pinned in -build/openwhisk/settings.gradle predate the September 2022 relicensing of -Akka under the Business Source License 1.1 and are Apache-2.0. Any upgrade -beyond Akka 2.6.20 would introduce a Category X (BSL) dependency and must -not be made without legal review. - -============================================================================== -SECTION 3 -- Apache OpenServerless Runtimes (runtimes/) -============================================================================== - -BSD-3-Clause - github.com/google/uuid (v1.6.0) - github.com/pmezard/go-difflib (v1.0.0) - golang.org/x/sys (v0.26.0) - -MIT - github.com/rs/zerolog (v1.33.0) - github.com/stretchr/testify (v1.9.0) -- test-only - github.com/mattn/go-colorable (v0.1.13) - github.com/mattn/go-isatty (v0.0.20) - -ISC - github.com/davecgh/go-spew (v1.1.1) - -Apache-2.0 AND MIT - gopkg.in/yaml.v3 (v3.0.1) - -Each language runtime image additionally bundles a language toolchain and -its standard libraries, supplied by the corresponding upstream base image -and not redistributed by the ASF in source form. - - -============================================================================== -SECTION 4 -- Components published as container images -============================================================================== - -The full license inventory for each published image is kept in that -component's own LICENSE file, which remains authoritative: - - admin-api/LICENSE apache/openserverless-admin-api - oplugins-op/LICENSE apache/openserverless-operator - streamer/LICENSE apache/openserverless-streamer - devcontainer/LICENSE apache/openserverless-devcontainer - -Components in those images requiring special handling under ASF policy: - -Category B (binary only, unmodified, as a separate file) - certifi / ca-certificates (MPL-2.0) - waitress (ZPL-2.1) - -Category X inherited from upstream base operating system images - Debian / Alpine userland, incl. GPL-2.0 and GPL-3.0 components - *** SEE WARN *** - These are supplied by the upstream base image at build time. The Apache - release artifact is the SOURCE distribution, which contains only the - Dockerfiles; the images are convenience binaries. - - -============================================================================== -SECTION 5 -- Full text of the non-Apache licenses used above -============================================================================== - ------------------------------------------------------------------------------- -5.1 The MIT License ------------------------------------------------------------------------------- - -Applies to the components listed as MIT above. Copyright is held by the -respective authors of each component, as recorded in the LICENSE file of -that component's source repository. - - Permission is hereby granted, free of charge, to any person obtaining a - copy of this software and associated documentation files (the +--------------- + +The Apache source release of Apache OpenServerless consists of +Apache-2.0 licensed files only, including the vendored Apache OpenWhisk +sources under build/openwhisk, and the license above applies to all of +it. The sections below apply to third-party software bundled in the +convenience binaries built from this source: the statically linked `ops` +command-line interface, and the container images assembled at build time +from upstream base images and from package, Go module and Maven +repositories. See the WARN file for the ASF category classification of +each license. + +The LICENSE file of each submodule remains authoritative for that +component. + +--------------- + +The `ops` binary contains the following components which were released +under an Apache 2.0 license, the text of which is reproduced above. + + * github.com/apache/openwhisk-client-go (v0.0.0-20210311185314-87edc2364717) + * github.com/cloudfoundry/jibber_jabber (v0.0.0-20151120183258-bcc4c8345a21) + * github.com/dominikbraun/graph (v0.23.0) + * github.com/go-git/go-billy/v5 (v5.5.0) + * github.com/go-git/go-git/v5 (v5.12.0) + * github.com/golang/groupcache (v0.0.0-20210331224755-41bb18bfe9da) + * github.com/Masterminds/goutils (v1.1.1) + * github.com/pjbgf/sha1cd (v0.3.0) + * github.com/sciabarracom/openwhisk-cli (v1.2.1) + * github.com/sciabarracom/openwhisk-wskdeploy (v1.2.1) + * github.com/skeema/knownhosts (v1.2.2) + * github.com/spf13/cobra (v1.1.3) + * github.com/xanzy/ssh-agent (v0.3.3) + * gopkg.in/yaml.v2 (v2.4.0) + +--------------- + +The `ops` binary contains the following components which were released +under an MIT license. + + * github.com/a8m/envsubst (v1.4.2) + * github.com/alecthomas/chroma/v2 (v2.14.0) + * github.com/alessio/shellescape (v1.4.1) + * github.com/cenkalti/backoff/v4 (v4.3.0) + * github.com/dlclark/regexp2 (v1.11.0) + * github.com/docopt/docopt-go (v0.0.0-20180111231733-ee0de3bc6815) + * github.com/fatih/color (v1.17.0) + * github.com/ghodss/yaml (v1.0.1-0.20190212211648-25d852aebe32) + * github.com/go-task/slim-sprig/v3 (v3.0.0) + * github.com/h2non/filetype (v1.1.3) + * github.com/hokaccha/go-prettyjson (v0.0.0-20210113012101-fb4e108d2519) + * github.com/huandu/xstrings (v1.3.2) + * github.com/itchyny/gojq (v0.12.16) + * github.com/itchyny/timefmt-go (v0.1.6) + * github.com/jaytaylor/html2text (v0.0.0-20230321000545-74c2419ad056) + * github.com/jbenet/go-context (v0.0.0-20150711004518-d14ea06fba99) + * github.com/joho/godotenv (v1.5.1) + * github.com/kevinburke/ssh_config (v1.2.0) + * github.com/Masterminds/semver (v1.5.0) + * github.com/Masterminds/semver/v3 (v3.2.1) + * github.com/Masterminds/sprig (v2.22.0+incompatible) + * github.com/mattn/go-colorable (v0.1.13) + * github.com/mattn/go-isatty (v0.0.20) + * github.com/mattn/go-runewidth (v0.0.15) + * github.com/mattn/go-zglob (v0.0.4) + * github.com/mitchellh/copystructure (v1.2.0) + * github.com/mitchellh/go-homedir (v1.1.0) + * github.com/mitchellh/hashstructure/v2 (v2.0.2) + * github.com/mitchellh/reflectwalk (v1.0.2) + * github.com/nicksnyder/go-i18n (v1.10.1) + * github.com/nuvolaris/envsubst/cmd/envsubstmain (v0.0.0-20230603163828-10ca029cdb58) + * github.com/nuvolaris/go-replace (v0.0.0-20230515190028-12766da1824c) + * github.com/nuvolaris/goawk (v1.21.1) + * github.com/nuvolaris/gron (v0.0.0-20231020134423-84e679ea6aad) + * github.com/nuvolaris/jj (v0.0.0-20231020143327-10b90948a5d2) + * github.com/nwidger/jsoncolor (v0.0.0-20170215171346-75a6de4340e5) + * github.com/olekukonko/tablewriter (v0.0.5) + * github.com/pelletier/go-toml (v1.8.1) + * github.com/remeh/sizedwaitgroup (v1.0.0) + * github.com/rivo/uniseg (v0.4.7) + * github.com/sajari/fuzzy (v1.0.0) + * github.com/sciabarracom/task/v3 (v3.38.12) + * github.com/sergi/go-diff (v1.3.2-0.20230802210424-5b0b94c5c0d3) + * github.com/ssor/bom (v0.0.0-20170718123548-6386211fdfcf) + * github.com/tidwall/gjson (v1.14.0) + * github.com/tidwall/match (v1.1.1) + * github.com/tidwall/pretty (v1.2.0) + * github.com/tidwall/sjson (v1.2.4) + * github.com/zalando/go-keyring (v0.2.5) + * gopkg.in/yaml.v3 (v3.0.1) + +The action proxy compiled into each runtime image contains the following +components which were released under an MIT license. + + * github.com/rs/zerolog (v1.33.0) + * github.com/mattn/go-colorable (v0.1.13) + * github.com/mattn/go-isatty (v0.0.20) + * github.com/stretchr/testify (v1.9.0), in test scope only + +Copyright is held by the respective authors of each component, as +recorded in the LICENSE file of that component's source repository. The +MIT license text is: + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: - The above copyright notice and this permission notice shall be included - in all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS - OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF - MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. - IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY - CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, - TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE - SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - ------------------------------------------------------------------------------- -5.2 The 3-Clause BSD License ------------------------------------------------------------------------------- - -Applies to the components listed as BSD-3-Clause above, including the -golang.org/x/* modules (Copyright (c) 2009 The Go Authors. All rights -reserved.) and github.com/ProtonMail/go-crypto. + The above copyright notice and this permission notice shall be + included in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS + BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN + ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + SOFTWARE. + +--------------- + +The `ops` binary contains the following components which were released +under a 3-clause BSD license. + + * dario.cat/mergo (v1.0.0) + * github.com/cloudflare/circl (v1.3.7) + * github.com/cyphar/filepath-securejoin (v0.2.4) + * github.com/go-git/gcfg (v1.5.1-0.20230307220236-3a3c6141e376) + * github.com/go-task/template (v0.0.0-20240602015157-960e6f576656) + * github.com/google/go-querystring (v1.1.0) + * github.com/google/uuid (v1.6.0) + * github.com/imdario/mergo (v0.3.13) + * github.com/jessevdk/go-flags (v1.5.0) + * github.com/Ladicle/tabwriter (v1.0.0) + * github.com/ProtonMail/go-crypto (v1.0.0) + * github.com/radovskyb/watcher (v1.0.7) + * github.com/sciabarracom/sh/v3 (v3.8.3) + * github.com/spf13/pflag (v1.0.5) + * golang.org/x/crypto (v0.25.0) + * golang.org/x/exp (v0.0.0-20240719175910-8a7402abbf56) + * golang.org/x/net (v0.27.0) + * golang.org/x/sync (v0.7.0) + * golang.org/x/sys (v0.22.0) + * golang.org/x/term (v0.22.0) + +The action proxy compiled into each runtime image contains the following +components which were released under a 3-clause BSD license. + + * github.com/google/uuid (v1.6.0) + * github.com/pmezard/go-difflib (v1.0.0) + * golang.org/x/sys (v0.26.0) + +The controller, invoker and scheduler container images contain +com.google.code.findbugs:jsr305 (3.0.2), which was released under a +3-clause BSD license. + +The golang.org/x/* modules carry: + +Copyright (c) 2009 The Go Authors. All rights reserved. + +Copyright in the remaining components is held by their respective +authors, as recorded in the LICENSE file of each component's source +repository. The 3-clause BSD license text is: Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are - met: + modification, are permitted provided that the following conditions + are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. + * Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following + disclaimer in the documentation and/or other materials provided with + the distribution. * Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. @@ -595,62 +394,394 @@ reserved.) and github.com/ProtonMail/go-crypto. (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ------------------------------------------------------------------------------- -5.3 The 2-Clause BSD License ------------------------------------------------------------------------------- +--------------- + +The `ops` binary contains the following components which were released +under a 2-clause BSD license. -Applies to the components listed as BSD-2-Clause above. + * github.com/emirpasic/gods (v1.18.1) + * github.com/gomarkdown/markdown (v0.0.0-20240730141124-034f12af3bf6) + * github.com/pkg/browser (v0.0.0-20240102092130-5ac0b6a4141c) + * github.com/pkg/errors (v0.9.1) + * github.com/zeebo/xxh3 (v1.0.2) + * gopkg.in/warnings.v0 (v0.1.2) + +Copyright is held by the respective authors of each component, as +recorded in the LICENSE file of that component's source repository. The +2-clause BSD license text is: Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are - met: + modification, are permitted provided that the following conditions + are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. + notice, this list of conditions and the following disclaimer in + the documentation and/or other materials provided with the + distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY + WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +--------------- + +The `ops` binary contains go-spew +(github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc), and +the action proxy compiled into each runtime image contains go-spew +(v1.1.1), which was released under an ISC license. ------------------------------------------------------------------------------- -5.4 The ISC License ------------------------------------------------------------------------------- - -Applies to github.com/davecgh/go-spew. Copyright (c) 2012-2016 Dave Collins <[email protected]> - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - - THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES - WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF - MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR - ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES - WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN - ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF - OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - ------------------------------------------------------------------------------- -5.5 Public domain ------------------------------------------------------------------------------- - -github.com/xi2/xz is a Go port of XZ Embedded (http://tukaani.org/xz/ -embedded.html). All files in that package were written by Michael Cross, -Lasse Collin and/or Igor Pavlov and have been placed in the public domain. -The software is provided "as is", without any warranty. - -============================================================================== -END LICENSES OF BUNDLED THIRD-PARTY SOFTWARE -============================================================================== + Permission to use, copy, modify, and/or distribute this software for + any purpose with or without fee is hereby granted, provided that the + above copyright notice and this permission notice appear in all + copies. + + THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL + WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED + WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL + DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR + PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER + TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + PERFORMANCE OF THIS SOFTWARE. + +--------------- + +The `ops` binary contains xz (github.com/xi2/xz +v0.0.0-20171230120015-48954b6210f8), a Go port of XZ Embedded +(http://tukaani.org/xz/embedded.html), which has been placed in the +public domain. + +All files in that package were written by Michael Cross, Lasse Collin +and/or Igor Pavlov. All have dedicated all copyright interest in the +software to the public domain. The software is provided "as is", without +any warranty. + +--------------- + +The action proxy compiled into each runtime image contains yaml.v3 +(gopkg.in/yaml.v3 v3.0.1), which was released under an Apache 2.0 +license, the text of which is reproduced above, and an MIT license, the +text of which is reproduced further above. + +Copyright (c) 2011-2019 Canonical Ltd. +Copyright (c) 2006-2010 Kirill Simonov + +--------------- + +The controller, invoker and scheduler container images contain Scala and +Java libraries which are declared in build/openwhisk/**/build.gradle and +build/openwhisk/settings.gradle and resolved from Maven Central at build +time. They are not present in the source distribution. The following were +released under an Apache 2.0 license, the text of which is reproduced +above. + + * org.scala-lang:scala-library, scala-reflect (2.12.10) + * com.typesafe.akka:akka-actor, -stream, -cluster, -cluster-tools, + -cluster-metrics, -distributed-data, -slf4j, -testkit (2.6.12) + * com.typesafe.akka:akka-http, -http-core, -http-spray-json, + -http2-support, -parsing (10.2.4) + * com.typesafe.akka:akka-stream-kafka (2.0.2) + * com.lightbend.akka.management:akka-management-cluster-bootstrap, + discovery-kubernetes-api, discovery-marathon-api (1.0.5) + * com.lightbend.akka.grpc:akka-grpc-gradle-plugin (1.0.0) + * com.lightbend.akka:akka-stream-alpakka-file, -s3 (1.1.2) + * io.spray:spray-json (1.3.4, 1.3.5) + * io.kamon:kamon-core, -statsd, -system-metrics, -prometheus, + -datadog (2.1.12) + * org.apache.kafka:kafka-clients (2.4.0) + * org.apache.curator:curator-* (4.0.0) + * org.apache.commons:commons-lang3 (3.3.2, 3.8.1) + * org.apache.commons:commons-io (1.3.2), commons-io:commons-io (2.6) + * commons-codec:commons-codec (1.9) + * commons-collections:commons-collections (3.2.2) + * org.apache.httpcomponents:httpclient (4.5.5), httpmime (4.3.6) + * io.fabric8:kubernetes-client (4.10.3) + * com.amazonaws:aws-java-sdk-s3 (1.11.295), -cloudfront (1.11.517) + * org.mongodb.scala:mongo-scala-driver (2.7.0) + * com.ibm.etcd:etcd-java (0.0.13) + * com.github.ben-manes.caffeine:caffeine (2.6.2) + * com.google.code.gson:gson (2.3.1, 2.6.2) + * org.codehaus.groovy:groovy-all (2.4.14) + * com.fasterxml.uuid:java-uuid-generator (3.1.3) + * com.atlassian.oai:swagger-request-validator-core (1.4.5) + * io.opentracing:opentracing-api, -util, -mock (0.31.0) + * io.prometheus:simpleclient, simpleclient_common (0.6.0) + * io.zipkin.reporter2:zipkin-reporter, -sender-okhttp3 (2.6.1) + * io.reactivex:rxjava (1.3.8), rxjava-reactive-streams (1.2.1) + * org.scalatest:scalatest (3.0.8), in test scope only + * io.rest-assured:rest-assured (4.0.0), in test scope only + +Akka 2.6.12 and Akka HTTP 10.2.4, as pinned in +build/openwhisk/settings.gradle, predate the September 2022 relicensing of +Akka under the Business Source License 1.1 and were released under an +Apache 2.0 license. Any upgrade beyond Akka 2.6.20 would introduce a +Category X dependency and must not be made without legal review. See the +WARN file beside this LICENSE. + +--------------- + +The controller, invoker and scheduler container images contain the +following components which were released under an MIT license, the text +of which is reproduced above. + + * com.microsoft.azure:azure-cosmos (3.5.0), azure-cosmosdb (2.6.2) + * org.slf4j:jcl-over-slf4j, log4j-over-slf4j (1.7.25) + * org.mockito:mockito-core (2.27.0), in test scope only + * org.testcontainers:elasticsearch, mongodb (1.17.1), in test scope only + +--------------- + +The controller, invoker and scheduler container images contain +com.github.java-json-tools:json-schema-validator (2.2.8), which was +released under a GNU Lesser General Public License 3.0 and an Apache 2.0 +license, at the recipient's option. The Apache 2.0 license is elected; +its text is reproduced above. See the WARN file beside this LICENSE. + +--------------- + +The controller, invoker and scheduler container images contain +ch.qos.logback:logback-classic (1.2.3), which was released under an +Eclipse Public License 1.0 and a GNU Lesser General Public License 2.1, +at the recipient's option. It is used unmodified, as a separate file, and +is not redistributed by the ASF in source form. Its license texts are +distributed with the component. See the WARN file beside this LICENSE. + +Logback +Copyright (C) 1999-2015, QOS.ch + +--------------- + +The test sources contain junit:junit (4.11), which was released under an +Eclipse Public License 1.0. It is used in test scope only, unmodified and +as a separate file, and is not redistributed by the ASF in source form. +Its license text is distributed with the component. See the WARN file +beside this LICENSE. + +--------------- + +The `ops` CLI downloads a set of prerequisite build tools on first use, +and again whenever a pinned version changes, as declared in +oplugins/prereq.yml. They are fetched as prebuilt binaries from their +upstream release pages into a local bin directory under the user's home. + +None of them is bundled with, linked into, or redistributed by this +distribution. They are not present in the source release, and they are not +present in any published container image. In the +docker.io/apache/openserverless-devcontainer image the download is +performed at container START time by start.sh, not during the image build, +so the tools exist only in the writable layer of a running container and +never in a distributed image layer. Each is obtained by the end user +directly from its own upstream project, under that project's own license. + +The information below is provided for the convenience of users, to record +what `ops` will fetch and under which terms. See the WARN file beside this +LICENSE. + +The following prerequisites were released under an Apache 2.0 license. + + * kubectl (1.33.1) + * kind (0.30.0) + * helm (3.18.0) + +The following prerequisites were released under an MIT license. The MIT +license text is reproduced above. + + * uutils coreutils (0.0.27) + * k3sup (0.13.12), Community Edition + * yq (4.47.1) + * bun (1.3.14), own sources only; see the LGPL note below + +k3sup is dual-edition upstream: k3sup Pro is proprietary and k3sup CE is +MIT licensed. Only the CE binaries are downloaded. The MIT grant for +k3sup CE excludes assets, images and logos. + +--------------- + +ripgrep (14.1.0) was released under an Unlicense license and an MIT +license, at the recipient's option. The MIT license is elected for this +distribution, so that the public-domain dedication is not assumed by +downstream consumers. The MIT license text is reproduced above. The +Unlicense text is: + + This is free and unencumbered software released into the public + domain. + + Anyone is free to copy, modify, publish, use, compile, sell, or + distribute this software, either in source code form or as a compiled + binary, for any purpose, commercial or non-commercial, and by any + means. + + In jurisdictions that recognize copyright laws, the author or authors + of this software dedicate any and all copyright interest in the + software to the public domain. We make this dedication for the benefit + of the public at large and to the detriment of our heirs and + successors. We intend this dedication to be an overt act of + relinquishment in perpetuity of all present and future rights to this + software under copyright law. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY + CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, + TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE + SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + For more information, please refer to <http://unlicense.org/> + +--------------- + +uv (0.7.19) was released under an Apache 2.0 license and an MIT license, +at the recipient's option. The Apache 2.0 license is elected for this +distribution. Its text is the Apache License, Version 2.0 reproduced at +the head of this file. + +--------------- + +The zip prerequisite (3.0-1) is not downloaded on Linux and macOS: `ops` +writes a shell wrapper that executes the zip already provided by the +operating system, so no third-party code is obtained. On Windows a +prebuilt zip.exe is downloaded. It derives from Info-ZIP zip 3.0, which +was released under the Info-ZIP license. Its text, in the 2007-Mar-04 +revision matching zip 3.0, is: + + This software is provided "as is," without warranty of any kind, + express or implied. In no event shall Info-ZIP or its contributors + be held liable for any direct, indirect, incidental, special or + consequential damages arising out of the use of or inability to use + this software. + + Permission is granted to anyone to use this software for any purpose, + including commercial applications, and to alter it and redistribute + it freely, subject to the above disclaimer and the following + restrictions: + + 1. Redistributions of source code (in whole or in part) must + retain the above copyright notice, definition, disclaimer, and + this list of conditions. + + 2. Redistributions in binary form (compiled executables and + libraries) must reproduce the above copyright notice, + definition, disclaimer, and this list of conditions in + documentation and/or other materials provided with the + distribution. Additional documentation is not needed for + executables where a command line license option provides these + and a note regarding this option is in the executable's startup + banner. The sole exception to this condition is redistribution + of a standard UnZipSFX binary (including SFXWiz) as part of a + self-extracting archive; that is permitted without inclusion of + this license, as long as the normal SFX banner has not been + removed from the binary or disabled. + + 3. Altered versions--including, but not limited to, ports to new + operating systems, existing ports with new graphical + interfaces, versions with modified or added functionality, and + dynamic, shared, or static library versions not from Info-ZIP-- + must be plainly marked as such and must not be misrepresented + as being the original source or, if binaries, compiled from the + original source. Such altered versions also must not be + misrepresented as being Info-ZIP releases--including, but not + limited to, labeling of the altered versions with the names + "Info-ZIP" (or any variation thereof, including, but not limited + to, different capitalizations), "Pocket UnZip," "WiZ" or + "MacZip" without the explicit permission of Info-ZIP. Such + altered versions are further prohibited from misrepresentative + use of the Zip-Bugs or Info-ZIP e-mail addresses or the + Info-ZIP URL(s), such as to imply Info-ZIP will provide support + for the altered versions. + + 4. Info-ZIP retains the right to use the names "Info-ZIP," "Zip," + "UnZip," "UnZipSFX," "WiZ," "Pocket UnZip," "Pocket Zip," and + "MacZip" for its own source and binary releases. + +--------------- + +The 7-Zip standalone console binary 7zz (24.07) was released under a +GNU Lesser General Public License 2.1 or later. Some of its files are +under 3-clause BSD, 2-clause BSD or public-domain terms, and its unRAR +code carries an additional restriction forbidding use in reverse +engineering of the RAR compression algorithm. On Windows the 7zr.exe +build is downloaded instead, under the same terms. + +The bun (1.3.14) binary statically links JavaScriptCore and WebKit, and +tinycc, which were released under GNU Lesser General Public License 2.1 +licenses. The LGPL-2.1 relink obligation applies to that binary. bun also +contains zstd, which was released under a BSD license and a GNU General +Public License 2.0, at the recipient's option; the BSD license is +elected. + +These two prerequisites carry Category X licenses under the ASF +third-party licensing policy. They are NOT included in any Apache release +artifact: they are absent from the source release and from every published +container image, and they are neither bundled nor linked. They are fetched +as unmodified, separate executables by the end user at run time, directly +from their own upstream projects. The Category X terms therefore attach to +those upstream downloads and not to anything distributed by the ASF. + +The LGPL-2.1 text is not reproduced here; it is distributed with each +component and is available at +https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html and, for 7-Zip, in +DOC/License.txt inside its own distribution. See the WARN file beside this +LICENSE. + +--------------- + +The full license inventory for each published container image is kept in +that component's own LICENSE file, which remains authoritative. + + admin-api/LICENSE docker.io/apache/openserverless-admin-api + oplugins-op/LICENSE docker.io/apache/openserverless-operator + streamer/LICENSE docker.io/apache/openserverless-streamer + devcontainer/LICENSE docker.io/apache/openserverless-devcontainer + +Those images contain certifi and the ca-certificates bundle, which +distribute a modified version of the Mozilla CA root certificate bundle +under a Mozilla Public License 2.0, and waitress, which was released +under a Zope Public License 2.1. Both are used unmodified, as separate +files. + +This Source Code Form is subject to the terms of the Mozilla Public +License, v. 2.0. If a copy of the MPL was not distributed with this +file, You can obtain one at http://mozilla.org/MPL/2.0/. + +Copyright (c) Zope Foundation and Contributors. +All Rights Reserved. + +--------------- + +The container images inherit from their upstream Debian and Alpine base +images an operating-system userland containing components under +reciprocal licenses, including GPL-2.0-or-later and GPL-3.0-or-later. +These components are supplied by the upstream base images and are not +redistributed by the ASF in source form. Their license texts are +distributed inside the container images at +/usr/share/doc/<package>/copyright. See the WARN file beside this +LICENSE. + +--------------- + +The complete license text of every bundled component is distributed with +that component. For Go modules it is available in the module's source +repository and in the module cache entry recorded in cli/go.sum and +runtimes/go.sum. For Python distributions it is distributed inside the +container image, in the package metadata directory of each distribution: + + <site-packages>/<distribution>-<version>.dist-info/ + +as LICENSE, LICENSE.txt, COPYING or licenses/, together with METADATA. +For Maven artifacts it is distributed inside the published jar, under +META-INF/. The license texts of Debian and Alpine components are +distributed at /usr/share/doc/<package>/copyright. diff --git a/NOTICE b/NOTICE index 536978b..f8f4a57 100644 --- a/NOTICE +++ b/NOTICE @@ -1,475 +1,333 @@ Apache OpenServerless (Incubating) -Copyright 2024 The Apache Software Foundation +Copyright 2024-2026 The Apache Software Foundation This product includes software developed at -The Apache Software Foundation (http://www.apache.org/). +The Apache Software Foundation (https://www.apache.org/). + +This product is an aggregate distribution. The notices below cover the +whole of it: the `ops` command-line interface, the vendored Apache +OpenWhisk sources under build/openwhisk, the runtimes, and every +component published as a container image. The NOTICE file of each +submodule remains authoritative for that component. + +The Apache source release contains only Apache-2.0 licensed files. The +notices that refer to container images and to statically linked binaries +apply to the convenience binaries assembled at build time, not to the +source release. See the WARN file beside this NOTICE. + +--------------- + +build/openwhisk contains a vendored copy of the Apache OpenWhisk source +tree, which was released under an Apache 2.0 license. + +Apache OpenWhisk +Copyright 2016-2021 The Apache Software Foundation +This product includes software developed at +The Apache Software Foundation (http://www.apache.org/). -============================================================================== -BEGIN BUNDLED THIRD-PARTY SOFTWARE INVENTORY (consolidated) -============================================================================== - -This file consolidates the third-party attribution for the whole Apache -OpenServerless distribution: the `ops` command-line interface, the vendored -Apache OpenWhisk sources under build/openwhisk, the runtimes, and every -component published as a container image. - -Per-component inventories remain in the NOTICE file of each submodule and -take precedence for that component. This file is the aggregate view and is -the one shipped beside the convenience binaries. - -The components below are redistributed under the licenses recorded in the -LICENSE file that accompanies this NOTICE. Components flagged -'*** SEE WARN ***' are listed in the WARN file as incompatible with, or -requiring special handling under, the Apache License 2.0. - - ------------------------------------------------------------------------------- -1. Apache OpenServerless CLI -- `ops` binary (cli/) ------------------------------------------------------------------------------- - -The `ops` binary is statically linked. Every Go module below is compiled -into the released executable, so its copyright notice is reproduced here as -required by the MIT and BSD licenses. - -Go module dependencies (cli/go.mod, cli/go.sum) ------------------------------------------------ - * dario.cat/mergo (v1.0.0) - License: BSD-3-Clause - * github.com/a8m/envsubst (v1.4.2) - License: MIT - * github.com/alecthomas/chroma/v2 (v2.14.0) - License: MIT - * github.com/alessio/shellescape (v1.4.1) - License: MIT - * github.com/apache/openwhisk-client-go (v0.0.0-20210311185314-87edc2364717) - License: Apache-2.0 - * github.com/cenkalti/backoff/v4 (v4.3.0) - License: MIT - * github.com/cloudflare/circl (v1.3.7) - License: BSD-3-Clause - * github.com/cloudfoundry/jibber_jabber (v0.0.0-20151120183258-bcc4c8345a21) - License: Apache-2.0 - * github.com/cyphar/filepath-securejoin (v0.2.4) - License: BSD-3-Clause - * github.com/davecgh/go-spew (v1.1.2-0.20180830191138-d8f796af33cc) - License: ISC - * github.com/dlclark/regexp2 (v1.11.0) - License: MIT - * github.com/docopt/docopt-go (v0.0.0-20180111231733-ee0de3bc6815) - License: MIT - * github.com/dominikbraun/graph (v0.23.0) - License: Apache-2.0 - * github.com/emirpasic/gods (v1.18.1) - License: BSD-2-Clause - * github.com/fatih/color (v1.17.0) - License: MIT - * github.com/ghodss/yaml (v1.0.1-0.20190212211648-25d852aebe32) - License: MIT - * github.com/go-git/gcfg (v1.5.1-0.20230307220236-3a3c6141e376) - License: BSD-3-Clause - * github.com/go-git/go-billy/v5 (v5.5.0) - License: Apache-2.0 - * github.com/go-git/go-git/v5 (v5.12.0) - License: Apache-2.0 - * github.com/go-task/slim-sprig/v3 (v3.0.0) - License: MIT - * github.com/go-task/template (v0.0.0-20240602015157-960e6f576656) - License: BSD-3-Clause - * github.com/golang/groupcache (v0.0.0-20210331224755-41bb18bfe9da) - License: Apache-2.0 - * github.com/gomarkdown/markdown (v0.0.0-20240730141124-034f12af3bf6) - License: BSD-2-Clause - * github.com/google/go-querystring (v1.1.0) - License: BSD-3-Clause - * github.com/google/uuid (v1.6.0) - License: BSD-3-Clause - * github.com/h2non/filetype (v1.1.3) - License: MIT - * github.com/hokaccha/go-prettyjson (v0.0.0-20210113012101-fb4e108d2519) - License: MIT - * github.com/huandu/xstrings (v1.3.2) - License: MIT - * github.com/imdario/mergo (v0.3.13) - License: BSD-3-Clause - * github.com/itchyny/gojq (v0.12.16) - License: MIT - * github.com/itchyny/timefmt-go (v0.1.6) - License: MIT - * github.com/jaytaylor/html2text (v0.0.0-20230321000545-74c2419ad056) - License: MIT - * github.com/jbenet/go-context (v0.0.0-20150711004518-d14ea06fba99) - License: MIT - * github.com/jessevdk/go-flags (v1.5.0) - License: BSD-3-Clause - * github.com/joho/godotenv (v1.5.1) - License: MIT - * github.com/kevinburke/ssh_config (v1.2.0) - License: MIT - * github.com/Ladicle/tabwriter (v1.0.0) - License: BSD-3-Clause - * github.com/Masterminds/goutils (v1.1.1) - License: Apache-2.0 - * github.com/Masterminds/semver (v1.5.0) - License: MIT - * github.com/Masterminds/semver/v3 (v3.2.1) - License: MIT - * github.com/Masterminds/sprig (v2.22.0+incompatible) - License: MIT - * github.com/mattn/go-colorable (v0.1.13) - License: MIT - * github.com/mattn/go-isatty (v0.0.20) - License: MIT - * github.com/mattn/go-runewidth (v0.0.15) - License: MIT - * github.com/mattn/go-zglob (v0.0.4) - License: MIT - * github.com/mitchellh/copystructure (v1.2.0) - License: MIT - * github.com/mitchellh/go-homedir (v1.1.0) - License: MIT - * github.com/mitchellh/hashstructure/v2 (v2.0.2) - License: MIT - * github.com/mitchellh/reflectwalk (v1.0.2) - License: MIT - * github.com/nicksnyder/go-i18n (v1.10.1) - License: MIT - * github.com/nuvolaris/envsubst/cmd/envsubstmain (v0.0.0-20230603163828-10ca029cdb58) - License: MIT - * github.com/nuvolaris/go-replace (v0.0.0-20230515190028-12766da1824c) - License: MIT - * github.com/nuvolaris/goawk (v1.21.1) - License: MIT - * github.com/nuvolaris/gron (v0.0.0-20231020134423-84e679ea6aad) - License: MIT - * github.com/nuvolaris/jj (v0.0.0-20231020143327-10b90948a5d2) - License: MIT - * github.com/nwidger/jsoncolor (v0.0.0-20170215171346-75a6de4340e5) - License: MIT - * github.com/olekukonko/tablewriter (v0.0.5) - License: MIT - * github.com/pelletier/go-toml (v1.8.1) - License: MIT - * github.com/pjbgf/sha1cd (v0.3.0) - License: Apache-2.0 - * github.com/pkg/browser (v0.0.0-20240102092130-5ac0b6a4141c) - License: BSD-2-Clause - * github.com/pkg/errors (v0.9.1) - License: BSD-2-Clause - * github.com/ProtonMail/go-crypto (v1.0.0) - License: BSD-3-Clause - * github.com/radovskyb/watcher (v1.0.7) - License: BSD-3-Clause - * github.com/remeh/sizedwaitgroup (v1.0.0) - License: MIT - * github.com/rivo/uniseg (v0.4.7) - License: MIT - * github.com/sajari/fuzzy (v1.0.0) - License: MIT - * github.com/sciabarracom/openwhisk-cli (v1.2.1) - License: Apache-2.0 - * github.com/sciabarracom/openwhisk-wskdeploy (v1.2.1) - License: Apache-2.0 - * github.com/sciabarracom/sh/v3 (v3.8.3) - License: BSD-3-Clause - * github.com/sciabarracom/task/v3 (v3.38.12) - License: MIT - * github.com/sergi/go-diff (v1.3.2-0.20230802210424-5b0b94c5c0d3) - License: MIT - * github.com/skeema/knownhosts (v1.2.2) - License: Apache-2.0 - * github.com/spf13/cobra (v1.1.3) - License: Apache-2.0 - * github.com/spf13/pflag (v1.0.5) - License: BSD-3-Clause - * github.com/ssor/bom (v0.0.0-20170718123548-6386211fdfcf) - License: MIT - * github.com/tidwall/gjson (v1.14.0) - License: MIT - * github.com/tidwall/match (v1.1.1) - License: MIT - * github.com/tidwall/pretty (v1.2.0) - License: MIT - * github.com/tidwall/sjson (v1.2.4) - License: MIT - * github.com/xanzy/ssh-agent (v0.3.3) - License: Apache-2.0 - * github.com/xi2/xz (v0.0.0-20171230120015-48954b6210f8) - License: Public Domain - * github.com/zalando/go-keyring (v0.2.5) - License: MIT - * github.com/zeebo/xxh3 (v1.0.2) - License: BSD-2-Clause - * golang.org/x/crypto (v0.25.0) - License: BSD-3-Clause - * golang.org/x/exp (v0.0.0-20240719175910-8a7402abbf56) - License: BSD-3-Clause - * golang.org/x/net (v0.27.0) - License: BSD-3-Clause - * golang.org/x/sync (v0.7.0) - License: BSD-3-Clause - * golang.org/x/sys (v0.22.0) - License: BSD-3-Clause - * golang.org/x/term (v0.22.0) - License: BSD-3-Clause - * gopkg.in/warnings.v0 (v0.1.2) - License: BSD-2-Clause - * gopkg.in/yaml.v2 (v2.4.0) - License: Apache-2.0 - * gopkg.in/yaml.v3 (v3.0.1) - License: MIT - -Attribution required by bundled Apache-2.0 components ------------------------------------------------------- -The following bundled components ship their own NOTICE file. Their required -attributions are reproduced here, as required by section 4(d) of the -Apache License, Version 2.0. - - Apache OpenWhisk Client Go - Copyright 2016-2021 The Apache Software Foundation - - Apache OpenWhisk Command-line Interface (CLI) - Copyright 2016-2021 The Apache Software Foundation - - Apache OpenWhisk Wskdeploy - Copyright 2016-2021 The Apache Software Foundation - - Copyright 2011-2016 Canonical Ltd. (gopkg.in/yaml.v2) - - Copyright 2024 Skeema LLC and the Skeema Knownhosts authors - (github.com/skeema/knownhosts) - -The `ops` CLI embeds patched forks of Apache OpenWhisk components -(openwhisk-cli, openwhisk-wskdeploy) and of several third-party tools. The -patches applied are recorded in cli/_patches/. All forks retain the license -of their upstream project. - - ------------------------------------------------------------------------------- -2. Apache OpenWhisk -- vendored sources (build/openwhisk/) ------------------------------------------------------------------------------- - -The build/openwhisk directory contains a vendored copy of the Apache -OpenWhisk source tree, licensed under the Apache License, Version 2.0. - - Apache OpenWhisk - Copyright 2016-2021 The Apache Software Foundation - - This product includes software developed at - The Apache Software Foundation (http://www.apache.org/). - -The OpenWhisk code was originally created, designed and developed under an -IBM copyright dated 2015-2016 and donated by the IBM Corporation +The OpenWhisk code was originally created, designed and developed under +an IBM copyright dated 2015-2016 and donated by the IBM Corporation (http://www.ibm.com/) to the Apache Software Foundation. The API Gateway component was jointly developed by IBM Corporation and Adobe Systems -Incorporated (http://www.adobe.com/) and donated by both companies. The full -donation record is preserved in build/openwhisk/CREDITS.txt. - -Source code incorporated from Spray ------------------------------------- - * Spray Caching (io.spray:spray-caching_2.11:1.3.4) - License: Apache-2.0 - Copyright (C) 2011-2015 the spray project <http://spray.io> - The file - build/openwhisk/common/scala/src/main/scala/org/apache/openwhisk/ - core/database/ConcurrentMapBackedCache.scala - contains an implementation derived from Spray's [[spray.caching.Cache]] - and [[spray.caching.SimpleLruCache]]. - License text: build/openwhisk/licenses/LICENSE-spray.txt - See also https://github.com/spray/spray/blob/master/LICENSE - -Bundled build tooling ----------------------- - * Gradle wrapper -- gradlew, gradlew.bat, gradle-wrapper.jar (6.9.1) - License: Apache-2.0 - Distributed with the vendored OpenWhisk sources; the wrapper downloads - Gradle 6.9.1 at build time. See build/openwhisk/gradlew and - build/openwhisk/gradlew.bat. - -Scala / Java dependencies resolved by the OpenWhisk Gradle build ------------------------------------------------------------------ -These are declared in build/openwhisk/**/build.gradle and settings.gradle -and are resolved from Maven Central at build time. They are not present in -the source distribution; they are linked into the published controller, -invoker and scheduler container images. - - * Scala standard library / reflect (2.12.10) - License: Apache-2.0 - * Akka -- actor, stream, cluster, cluster-tools, cluster-metrics, - distributed-data, slf4j, testkit (2.6.12) - License: Apache-2.0 - Note: Akka 2.6.12 predates the September 2022 BSL 1.1 relicensing of - Akka and is Apache-2.0. Do not upgrade Akka past 2.6.20 without legal - review -- later versions are Category X for an Apache release. - * Akka HTTP -- http, http-core, http-spray-json, http2-support, parsing (10.2.4) - License: Apache-2.0 - Note: same BSL caveat as Akka above. - * Akka Stream Kafka (2.0.2) - License: Apache-2.0 - * Akka Management / Discovery -- cluster-bootstrap, kubernetes-api, - marathon-api (1.0.5) - License: Apache-2.0 - * Akka gRPC Gradle plugin (1.0.0) - License: Apache-2.0 - * Alpakka -- file, s3 (1.1.2) - License: Apache-2.0 - * spray-json (1.3.4, 1.3.5) - License: Apache-2.0 - Copyright (C) 2011-2015 the spray project <http://spray.io> - * Kamon -- core, statsd, system-metrics, prometheus, datadog (2.1.12) - License: Apache-2.0 - * Apache Kafka clients (2.4.0) - License: Apache-2.0 - * Apache Curator (4.0.0) - License: Apache-2.0 - * Apache Commons -- lang3 (3.3.2, 3.8.1), io (1.3.2, 2.6), - codec (1.9), collections (3.2.2) - License: Apache-2.0 - * Apache HttpComponents -- httpclient (4.5.5), httpmime (4.3.6) - License: Apache-2.0 - * Fabric8 Kubernetes client (4.10.3) - License: Apache-2.0 - * AWS SDK for Java -- s3 (1.11.295), cloudfront (1.11.517) - License: Apache-2.0 - * Azure Cosmos DB SDK -- azure-cosmos (3.5.0), azure-cosmosdb (2.6.2) - License: MIT - * MongoDB Scala driver (2.7.0) - License: Apache-2.0 - * etcd-java (0.0.13) - License: Apache-2.0 - * Caffeine (2.6.2) - License: Apache-2.0 - * Gson (2.3.1, 2.6.2) - License: Apache-2.0 - * Groovy (2.4.14) - License: Apache-2.0 - * java-uuid-generator (3.1.3) - License: Apache-2.0 - * json-schema-validator (2.2.8) - License: LGPL-3.0 OR Apache-2.0 - Apache-2.0 is elected. *** SEE WARN *** - * swagger-request-validator-core (1.4.5) - License: Apache-2.0 - * OpenTracing -- api, util, mock (0.31.0) - License: Apache-2.0 - * Prometheus simpleclient -- simpleclient, simpleclient_common (0.6.0) - License: Apache-2.0 - * Zipkin reporter2 -- reporter, sender-okhttp3 (2.6.1) - License: Apache-2.0 - * RxJava (1.3.8) / rxjava-reactive-streams (1.2.1) - License: Apache-2.0 - * SLF4J bridges -- jcl-over-slf4j, log4j-over-slf4j (1.7.25) - License: MIT - * Logback classic (1.2.3) - License: EPL-1.0 OR LGPL-2.1 - Category B: used unmodified as a separate file. *** SEE WARN *** - * JSR-305 annotations (3.0.2) - License: BSD-3-Clause - * JUnit (4.11) - License: EPL-1.0 - Test-only. Category B. *** SEE WARN *** - * ScalaTest (3.0.8) - License: Apache-2.0 - Test-only. - * Mockito core (2.27.0) - License: MIT - Test-only. - * REST Assured (4.0.0) - License: Apache-2.0 - Test-only. - * Testcontainers -- elasticsearch, mongodb (1.17.1) - License: MIT - Test-only. - ------------------------------------------------------------------------------- -3. Apache OpenServerless Runtimes (runtimes/) ------------------------------------------------------------------------------- - -The action proxy is written in Go and is compiled into each runtime image. - -Go module dependencies (runtimes/go.mod, runtimes/go.sum) ---------------------------------------------------------- - * github.com/google/uuid (v1.6.0) - License: BSD-3-Clause - * github.com/rs/zerolog (v1.33.0) - License: MIT - * github.com/stretchr/testify (v1.9.0) - License: MIT - Test-only dependency. - * github.com/davecgh/go-spew (v1.1.1) - License: ISC - Transitive. - * github.com/mattn/go-colorable (v0.1.13) - License: MIT - Transitive. - * github.com/mattn/go-isatty (v0.0.20) - License: MIT - Transitive. - * github.com/pmezard/go-difflib (v1.0.0) - License: BSD-3-Clause - Transitive. - * golang.org/x/sys (v0.26.0) - License: BSD-3-Clause - Transitive. - * gopkg.in/yaml.v3 (v3.0.1) - License: Apache-2.0 AND MIT - Transitive. - -The runtimes/openwhisk directory contains action-proxy sources derived from -Apache OpenWhisk, licensed under the Apache License, Version 2.0. - -Each language runtime image additionally bundles its own language toolchain -and libraries (Node.js, Python, Go, Java, PHP, Ruby and others) supplied by -the corresponding upstream base image. Those components are provided by the -upstream image and are not redistributed by the ASF in source form. - - ------------------------------------------------------------------------------- -4. Components published as container images ------------------------------------------------------------------------------- - -The following components are Apache-2.0 licensed in source form and bundle -third-party software only in their published convenience images. The full -per-image inventory for each is kept in that component's own NOTICE, LICENSE -and WARN files, which remain authoritative: - - * apache/openserverless-admin-api -- admin-api/NOTICE - Python runtime; bundles certifi (MPL-2.0, Category B) and - waitress (ZPL-2.1, Category B). - * apache/openserverless-operator -- oplugins-op/NOTICE - Python runtime; bundles certifi (MPL-2.0, Category B), kubectl, - kustomize, the OpenWhisk CLI and Task. - * apache/openserverless-streamer -- streamer/NOTICE - Go binary on a scratch image; bundles a CA certificate bundle - (MPL-2.0, Category B). - * apache/openserverless-devcontainer -- devcontainer/NOTICE - Debian-based developer image; bundles GPL-licensed operating-system - userland. *** SEE WARN *** - -The Taskfile plugins (oplugins/) and the test suite (testing/) contain no -bundled third-party source; they invoke tools that the `ops` CLI or the -operating system provides. - - ------------------------------------------------------------------------------- -Attribution required by bundled components ------------------------------------------------------------------------------- - -This product includes software developed by the Apache Software -Foundation (http://www.apache.org/), including Apache OpenWhisk -components and Apache-2.0 licensed libraries listed above. - -This product includes software developed by third parties under the -MIT, BSD, ISC, PSF, MPL-2.0, EPL, ZPL and other licenses, as recorded in -LICENSE. - -This product includes software developed by the spray project -(http://spray.io), Copyright (C) 2011-2015 the spray project. - -This product includes software originally developed by IBM Corporation -(http://www.ibm.com/) and Adobe Systems Incorporated -(http://www.adobe.com/), donated to the Apache Software Foundation. - -============================================================================== -END BUNDLED THIRD-PARTY SOFTWARE INVENTORY -============================================================================== +Incorporated (http://www.adobe.com/) and donated by both companies. The +full donation record is preserved in build/openwhisk/CREDITS.txt. + +--------------- + +build/openwhisk contains ConcurrentMapBackedCache.scala, in +common/scala/src/main/scala/org/apache/openwhisk/core/database/, which +contains an implementation derived from Spray's [[spray.caching.Cache]] +and [[spray.caching.SimpleLruCache]], released under an Apache 2.0 +license. + +spray +Copyright (C) 2011-2015 the spray project <http://spray.io> + +The spray-json library, resolved as a binary dependency by the Gradle +build, was likewise released under an Apache 2.0 license and carries the +same copyright notice. + +--------------- + +build/openwhisk contains the Gradle wrapper -- gradlew, gradlew.bat and +gradle/wrapper/gradle-wrapper.jar -- which was released under an +Apache 2.0 license. The wrapper resolves Gradle 6.9.1 at build time. + +Gradle +Copyright Gradle Inc. + +--------------- + +The `ops` binary is statically linked. It contains the Apache OpenWhisk +Client Go, the Apache OpenWhisk Command-line Interface and the Apache +OpenWhisk Wskdeploy, which were released under an Apache 2.0 license. + +Apache OpenWhisk Client Go +Copyright 2016-2021 The Apache Software Foundation + +Apache OpenWhisk Command-line Interface (CLI) +Copyright 2016-2021 The Apache Software Foundation + +Apache OpenWhisk Wskdeploy +Copyright 2016-2021 The Apache Software Foundation + +The `ops` CLI embeds patched forks of those OpenWhisk components and of +several third-party tools. The patches applied are recorded in +cli/_patches/. All forks retain the license of their upstream project. + +--------------- + +The `ops` binary contains go-yaml, which was released under an Apache 2.0 +license. + +Copyright 2011-2016 Canonical Ltd. (gopkg.in/yaml.v2) + +--------------- + +The `ops` binary contains knownhosts, which was released under an +Apache 2.0 license. + +Copyright 2024 Skeema LLC and the Skeema Knownhosts authors +(github.com/skeema/knownhosts) + +--------------- + +The `ops` binary contains further components which were released under +Apache 2.0 licenses, including go-git, go-billy, groupcache, goutils, +sha1cd, cobra, ssh-agent, jibber_jabber and graph. Their copyright +notices are held by their respective authors, as recorded in the LICENSE +file of each component's source repository. + +--------------- + +The `ops` binary contains components which were released under MIT, BSD +2-clause, BSD 3-clause and ISC licenses, and one component placed in the +public domain. These are enumerated, with their versions and licenses, in +the LICENSE file beside this NOTICE. Copyright is held by the respective +authors of each component, as recorded in the LICENSE file of that +component's source repository. The golang.org/x/* modules carry: + +Copyright (c) 2009 The Go Authors. All rights reserved. + +--------------- + +The `ops` CLI downloads a set of prerequisite build tools on first use, +and again whenever a pinned version changes, as declared in +oplugins/prereq.yml. They are fetched from their upstream release pages +into a local bin directory under the user's home. They are NOT bundled, +linked or redistributed by the ASF in any form: they are not in the source +distribution, and they are not in any published container image. In the +docker.io/apache/openserverless-devcontainer image the download happens at +container START time, from start.sh, so the tools exist only in the +writable layer of a running container. The notices below are given for +information only. See the WARN file beside this NOTICE. + +The following prerequisites were released under an Apache 2.0 license. + +kubectl 1.33.1 +Copyright 2025 The Kubernetes Authors. + +kind 0.30.0 +Copyright 2018 The Kubernetes Authors. + +Helm 3.18.0 +Copyright 2016 The Kubernetes Authors All Rights Reserved + +--------------- + +The following prerequisites were released under MIT licenses. + +uutils coreutils 0.0.27 +Copyright (c) uutils developers + +k3sup 0.13.12 (Community Edition) +Copyright (c) 2025 Alex Ellis + +yq 4.47.1 +Copyright (c) 2017 Mike Farah + +bun 1.3.14 is MIT licensed in its own sources. The distributed binary +statically links further components; see below and see the WARN file +beside this NOTICE. + +--------------- + +ripgrep 14.1.0 was released under an Unlicense license and an MIT license, +at the recipient's option. The MIT license is elected. + +Copyright (c) 2015 Andrew Gallant + +--------------- + +uv 0.7.19 was released under an Apache 2.0 license and an MIT license, at +the recipient's option. The Apache 2.0 license is elected. + +Copyright (c) 2025 Astral Software Inc. + +--------------- + +The zip prerequisite is not downloaded on Linux and macOS: `ops` writes a +shell wrapper that executes the zip already provided by the operating +system. On Windows a prebuilt zip.exe is downloaded. It derives from +Info-ZIP zip 3.0. + +Info-ZIP +Copyright (c) 1990-2007 Info-ZIP. All rights reserved. + +--------------- + +The 7-Zip standalone console binary 7zz 24.07 was released under a +GNU Lesser General Public License 2.1 or later, with an additional +restriction applying to its unRAR code. It is used unmodified, as a +separate file, and is downloaded by the end user at run time. It is not +bundled or redistributed by the ASF in any form. See the WARN file beside +this NOTICE. + +7-Zip +Copyright (C) 1999-2024 Igor Pavlov. + +--------------- + +The bun 1.3.14 binary statically links JavaScriptCore and WebKit, and +tinycc, which were released under GNU Lesser General Public License 2.1 +licenses. It also contains zstd, which was released under a BSD license +and a GNU General Public License 2.0, at the recipient's option; the BSD +license is elected. The binary is downloaded by the end user at run time +and is not bundled or redistributed by the ASF in any form. See the WARN +file beside this NOTICE. + +Copyright (c) 2018-2024 Apple Inc. and the WebKit project authors +Copyright (c) 2001-2004 Fabrice Bellard (tinycc) +Copyright (c) Meta Platforms, Inc. and affiliates. (zstd) + +--------------- + +The controller, invoker and scheduler container images contain Scala and +Java libraries resolved from Maven Central by the OpenWhisk Gradle build. +They are not present in the source distribution. The majority were +released under an Apache 2.0 license, including the Scala standard +library, Akka, Akka HTTP, Kamon, Apache Kafka clients, Apache Curator, +Apache Commons, Apache HttpComponents, the Fabric8 Kubernetes client, the +AWS SDK for Java, the MongoDB Scala driver, etcd-java, Caffeine, Gson, +Groovy, java-uuid-generator, OpenTracing, Prometheus simpleclient, Zipkin +reporter2 and RxJava. + +Scala +Copyright (c) 2002-2023 EPFL +Copyright (c) 2011-2023 Lightbend, Inc. + +Akka +Copyright (C) 2009-2022 Lightbend Inc. <https://www.lightbend.com> + +Akka 2.6.12 and Akka HTTP 10.2.4, as pinned in +build/openwhisk/settings.gradle, predate the September 2022 relicensing of +Akka under the Business Source License 1.1 and were released under an +Apache 2.0 license. Any upgrade beyond Akka 2.6.20 would introduce a +Category X dependency and must not be made without legal review. + +--------------- + +The controller, invoker and scheduler container images contain the Azure +Cosmos DB SDK, the SLF4J bridges jcl-over-slf4j and log4j-over-slf4j, and, +in test scope only, Mockito and Testcontainers, which were released under +MIT licenses. + +Copyright (c) Microsoft Corporation (azure-cosmos, azure-cosmosdb) +Copyright (c) 2004-2017 QOS.ch (slf4j) +Copyright (c) 2007 Mockito contributors +Copyright (c) 2015-2021 Richard North (testcontainers) + +--------------- + +The controller, invoker and scheduler container images contain +json-schema-validator, which was released under an LGPL 3.0 license and +an Apache 2.0 license, at the recipient's option. The Apache 2.0 license +is elected. See the WARN file beside this NOTICE. + +Copyright (c) Francis Galiegue and individual contributors + +--------------- + +The controller, invoker and scheduler container images contain Logback, +which was released under an Eclipse Public License 1.0 and a +GNU Lesser General Public License 2.1, at the recipient's option. It is +used unmodified, as a separate file. See the WARN file beside this NOTICE. + +Logback +Copyright (C) 1999-2015, QOS.ch + +--------------- + +The test sources contain JUnit, which was released under an Eclipse +Public License 1.0. It is used in test scope only. See the WARN file +beside this NOTICE. + +Copyright (c) 2000-2011 INCS, Inc. and the JUnit contributors + +--------------- + +runtimes/openwhisk contains action-proxy sources derived from Apache +OpenWhisk, which were released under an Apache 2.0 license. + +Apache OpenWhisk +Copyright 2016-2021 The Apache Software Foundation + +--------------- + +The action proxy is written in Go and is compiled into each runtime +image. It contains uuid, go-difflib and golang.org/x/sys, released under +BSD 3-clause licenses; zerolog, go-colorable, go-isatty and, in test scope +only, testify, released under MIT licenses; go-spew, released under an ISC +license; and yaml.v3, released under an Apache 2.0 license and an MIT +license. + +Copyright (c) 2009 The Go Authors. All rights reserved. (golang.org/x/sys) +Copyright (c) 2009 Google Inc. (github.com/google/uuid) +Copyright (c) 2017 Olivier Poitrey (github.com/rs/zerolog) +Copyright (c) 2012-2016 Dave Collins <[email protected]> (go-spew) +Copyright (c) 2011-2019 Canonical Ltd. (gopkg.in/yaml.v3) + +--------------- + +Each language runtime image additionally bundles its own language +toolchain and libraries -- Node.js, Python, Go, Java, PHP, Ruby and +others -- supplied by the corresponding upstream base image. Those +components are provided by the upstream image and are not redistributed +by the ASF in source form. + +--------------- + +The following components are Apache-2.0 licensed in source form and +bundle third-party software only in their published container images. The +per-image inventory is kept in that component's own NOTICE, LICENSE and +WARN files, which remain authoritative. + + docker.io/apache/openserverless-admin-api admin-api/NOTICE + Python runtime; contains certifi, released under a Mozilla Public + License 2.0, and waitress, released under a Zope Public License 2.1. + + docker.io/apache/openserverless-operator oplugins-op/NOTICE + Python runtime; contains certifi, released under a Mozilla Public + License 2.0, together with kubectl, kustomize, the OpenWhisk CLI and + Task. + + docker.io/apache/openserverless-streamer streamer/NOTICE + Go binary on a scratch image; contains a CA certificate bundle + released under a Mozilla Public License 2.0. + + docker.io/apache/openserverless-devcontainer devcontainer/NOTICE + Debian-based developer image; contains GPL-licensed + operating-system userland. See the WARN file beside this NOTICE. + +The Taskfile plugins under oplugins/ and the test suite under testing/ +contain no bundled third-party source; they invoke tools that the `ops` +CLI or the operating system provides. + +--------------- + +The container images inherit GPL-2.0-or-later, GPL-3.0-or-later and other +reciprocally licensed operating-system components from their upstream +Debian and Alpine base images. These components are supplied by the +upstream base images and are not redistributed by the ASF in source form. +See the WARN file beside this NOTICE. diff --git a/Taskfile.yml b/Taskfile.yml index c30df31..f8dcd5e 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -52,6 +52,9 @@ vars: CMD: "check" TEST_TYPE: "kind" + RAT_VERSION: 0.18 + RAT: "apache-rat-{{.RAT_VERSION}}.jar" + tasks: default: @@ -269,7 +272,6 @@ tasks: ls *-*.sh | awk '{ print "- " $1 }' fi - license: silent: true desc: check license headers @@ -285,6 +287,50 @@ tasks: cd {{.TASKFILE_DIR}} done + + rat-install: + cmds: + - | + if ! java --version + then echo install java 17 at least ; exit 1 + fi + - wget https://dlcdn.apache.org//creadur/apache-rat-{{.RAT_VERSION}}/apache-rat-{{.RAT_VERSION}}-bin.zip + - unzip -j apache-rat-{{.RAT_VERSION}}-bin.zip apache-rat-{{.RAT_VERSION}}/apache-rat-{{.RAT_VERSION}}.jar + - rm apache-rat-{{.RAT_VERSION}}-bin.zip + - java -jar {{.RAT}} -help + status: + - test -e {{.RAT}} + + + rat: + desc: check ASF license compliance with Apache RAT + cmds: + - task: rat-install + - java -jar {{.RAT}} --input-exclude-parsed-scm GIT --input-exclude-file .rat-excludes -- . + + rat-list: + desc: list files RAT does not approve, one per line (T=all to list every file) + vars: + XML: .task/rat.xml + cmds: + - mkdir -p .task + - defer: rm -f {{.XML}} + - rat --input-exclude-parsed-scm GIT --input-exclude-file .rat-excludes --output-file {{.XML}} --output-style xml -- . >/dev/null 2>&1 || true + - | + python3 - {{.XML}} {{.T}} <<'EOF' + import sys, xml.etree.ElementTree as ET + xml = sys.argv[1] + show_all = len(sys.argv) > 2 and sys.argv[2] == 'all' + for res in ET.parse(xml).getroot().iter('resource'): + approved = any(l.get('approval') == 'true' for l in res.findall('license')) + if approved and not show_all: + continue + lic = ','.join(l.get('id') or '?' for l in res.findall('license')) or '-' + print(f"{res.get('type'):9} {res.get('mediaType'):26} {lic:12} {res.get('name')}") + EOF + + + find-binaries: silent: true desc: find binary files diff --git a/WARN b/WARN index 50272b3..2b4b90d 100644 --- a/WARN +++ b/WARN @@ -34,7 +34,45 @@ source form. CATEGORY X ============================================================================== - None added on purpose by any component of this distribution. + No Category X component is linked into or included in any release + artifact. Two Category X components are DOWNLOADED AT RUN TIME by the end + user as `ops` prerequisites. They are not in the source release and not + in any published image layer. + + Component : 7-Zip standalone binary, 7zz (24.07) / 7zr.exe on Windows + License : LGPL-2.1-or-later, plus an unRAR field-of-use restriction + Affects : oplugins/prereq.yml (run-time download only) + Action : + Downloaded on first use of `ops`, unmodified, as a separate + executable, directly from upstream by the end user. Not present in + the Apache source release and not in any published image layer, so no + release artifact is affected. The unRAR clause is a field-of-use + restriction and is non-free by both FSF and ASF standards. Disclosed + here for the benefit of users; nothing to remove from the release. + Preferred long-term fix: replace 7zz with a Category A extractor. + + Component : bun (1.3.14) + License : MIT (own sources) statically linked with JavaScriptCore and + WebKit (LGPL-2.1) and tinycc (LGPL-2.1); bundles zstd + (BSD OR GPL-2.0, BSD elected) + Affects : oplugins/prereq.yml (run-time download only) + Action : + bun's own code is Category A, but the upstream binary is + LGPL-2.1-encumbered through static linking and carries the LGPL-2.1 + relink obligation. Downloaded on first use, unmodified, as a separate + executable, directly from upstream by the end user. Not present in + the Apache source release or in any published image layer. Disclosed + here; no action required. + + NOTE ON SCOPE + The prerequisite download is performed by `ops -t` in + devcontainer/start.sh, which runs as the container ENTRYPOINT. It + executes when a container starts, not while the image is built, so + the published docker.io/apache/openserverless-devcontainer image + contains NEITHER of the binaries above -- they are fetched into the + writable layer of a running container. Do NOT reintroduce a + `RUN ops -t` step into any Dockerfile: that would bake Category X + binaries into a published image layer. The `ops` CLI links 92 third-party Go modules. Every one of them resolves to a Category A license (Apache-2.0, MIT, BSD-2-Clause, BSD-3-Clause, ISC @@ -142,6 +180,18 @@ WATCH LIST -- do not upgrade without legal review SUMMARY OF REQUIRED REMOVALS (Category X added by this distribution) ============================================================================== - None. No component of this distribution adds a Category X dependency of - its own. All Category X exposure is inherited from upstream base operating - system images and is limited to convenience binaries. + No Category X component is present in the Apache SOURCE release, which is + the release artifact. Nothing must be removed from it. + + The following are fetched by the end user at run time, directly from + their upstream projects. They are present in no release artifact and in + no published image layer: + + [ ] 7zz (24.07) -- LGPL-2.1-or-later + unRAR restriction + [ ] bun (1.3.14) -- statically links JavaScriptCore/WebKit, tinycc + (LGPL-2.1) + + Both are unmodified, separate executables fetched from upstream release + pages at run time, declared in oplugins/prereq.yml and disclosed in + LICENSE and NOTICE for the information of users. All remaining Category X + exposure is inherited from upstream base operating system images. diff --git a/admin-api b/admin-api index b8ea229..58ccd6e 160000 --- a/admin-api +++ b/admin-api @@ -1 +1 @@ -Subproject commit b8ea229765cc57d832ad542d0160f0882834ad09 +Subproject commit 58ccd6e90e036e8b7360b94648ebbf60a5180052 diff --git a/build b/build index a39bbe4..033abd0 160000 --- a/build +++ b/build @@ -1 +1 @@ -Subproject commit a39bbe4ca9c390b0444b8eb2c85b598ca506e25c +Subproject commit 033abd0f5b411b5a6e4525c51885030380cd165f diff --git a/cli b/cli index d3f767a..1f7abc6 160000 --- a/cli +++ b/cli @@ -1 +1 @@ -Subproject commit d3f767a66ebd35b570382ef1a32c2866ab2dddd7 +Subproject commit 1f7abc6a90487f77a0c1f024646135eee2f65d82 diff --git a/devcontainer b/devcontainer index bfa4215..00337e1 160000 --- a/devcontainer +++ b/devcontainer @@ -1 +1 @@ -Subproject commit bfa42159ac3ba47164ce9610e55b4f3cb85d160b +Subproject commit 00337e1c0f9d203b87d86d42b0f7c5fb1310752b diff --git a/no-release.txt b/no-release.txt index d181a9a..9e6298f 100644 --- a/no-release.txt +++ b/no-release.txt @@ -10,18 +10,20 @@ openserverless/*/.github openserverless/*/.github/* openserverless/*/.vscode/* openserverless/*/.vscode -openserverless/cli/_patches/wskdeploy/tests/* -openserverless/cli/_patches/wskdeploy/specification/* -openserverless/cli/_patches/task/testdata/* -openserverless/cli/_patches/awk/testdata/* -openserverless/cli/_patches/jq/cli/testdata/8.jq -openserverless/cli/_patches/wsk/gradle/wrapper/gradle-wrapper.jar -openserverless/cli/_patches/wskdeploy/gradle/wrapper/gradle-wrapper.jar -openserverless/cli/_patches/wskdeploy/gradle/wrapper/gradle-wrapper.jar -openserverless/build/openwhisk/tool/* + +openserverless/build/openwhisk/tests +openserverless/build/openwhisk/tests/** +openserverless/build/openwhisk/tools +openserverless/build/openwhisk/tools/** +openserverless/build/openwhisk/ansible +openserverless/build/openwhisk/ansible/** +openserverless/build/openwhisk/.github +openserverless/build/openwhisk/.github/** +openserverless/build/openwhisk/docs +openserverless/build/openwhisk/docs/** openserverless/build/openwhisk/gradle/wrapper/gradle-wrapper.jar + openserverless/oplugins-op/enterprise-util/kafka/jmx/jmx_prometheus_javaagent-0.18.0.jar openserverless/runtimes/tests/java/hello.jar -openserverless/oplugins/util/config/configurator/tests/fixtures/bad.json -openserverless/build/openwhisk/tools/owperf/owperf_data.odg -openserverless/build/openwhisk/docs/images/whisk_icon_full_color_with_tm.psd +openserverless/oplugins/util/config/configurator +openserverless/oplugins/util/config/configurator/* diff --git a/openserverless.code-workspace b/openserverless.code-workspace index 3f769d6..89edade 100644 --- a/openserverless.code-workspace +++ b/openserverless.code-workspace @@ -6,6 +6,9 @@ { "path": "cli" }, + { + "path": "oplugins" + }, { "path": "oplugins-op" }, @@ -40,4 +43,4 @@ "statusBar.noFolderForeground": "#FEFBFF" } } -} \ No newline at end of file +} diff --git a/oplugins b/oplugins index 87d8e27..b33d808 160000 --- a/oplugins +++ b/oplugins @@ -1 +1 @@ -Subproject commit 87d8e27966c502782589ba4deade0d4655f7d954 +Subproject commit b33d8089a1987eede3fdc6042f313e2aacb9ec9e diff --git a/oplugins-op b/oplugins-op index 5df76fe..022af91 160000 --- a/oplugins-op +++ b/oplugins-op @@ -1 +1 @@ -Subproject commit 5df76feda569b374276f4e2c72a46d3a980a4b77 +Subproject commit 022af91fa3d7d09330bb1662a706d17beb12a38f diff --git a/runtimes b/runtimes index 6be989a..ca5c44e 160000 --- a/runtimes +++ b/runtimes @@ -1 +1 @@ -Subproject commit 6be989aca0b5c2e6841bfadd7710315c27c03ab3 +Subproject commit ca5c44e8bc4f3dcf879d16eec8fd88549236d1b2 diff --git a/streamer b/streamer index efac38f..7cedb53 160000 --- a/streamer +++ b/streamer @@ -1 +1 @@ -Subproject commit efac38f5297c8a30b9019b6ed316cff3a4c038c9 +Subproject commit 7cedb5388dd415beb745a7a480877cdc3ae1930b diff --git a/testing b/testing index 5cdf6f1..77de285 160000 --- a/testing +++ b/testing @@ -1 +1 @@ -Subproject commit 5cdf6f181a3940b030ba70000ab6987428be5630 +Subproject commit 77de285370c8d48d594ab1d01c235233dbc9da75
