Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[APR-248] chore: bundle licenses of dependencies into ADP container image #313

Merged
merged 2 commits into from
Nov 8, 2024

Conversation

tobz
Copy link
Member

@tobz tobz commented Nov 8, 2024

Context

As part of our obligations when building public artifacts, we must document the license of not only our own software, but the licenses of any dependencies we utilize. While we currently document the licenses used through LICENSE-3rdparty.csv, we don't include a copy of those licenses alongside the relevant binary artifacts which means that it's both more difficult to look up the contents of those licenses, as well it not knowing which version of the license a given release refers to.

Solution

This PR introduces some small changes to our Dockerfiles in order to, based on LICENSE-3rdparty.csv, determine which licenses are in use and then copy the relevant licenses into the resulting container image. We do this by parsing LICENSE-3rdparty.csv and then utilize SPDX's helpful "License List Data" repository which holds multiple file formats of all of the licenses that it has registered identifiers for. This repository is, by virtue of being under source control, versioned and auditable.

Closes #308.

@tobz tobz requested review from a team as code owners November 8, 2024 18:43
@pr-commenter
Copy link

pr-commenter bot commented Nov 8, 2024

Regression Detector (DogStatsD)

Regression Detector Results

Run ID: 7f45744c-4af6-4638-99b4-eab55620bc71

Baseline: 7.58.0
Comparison: 7.58.0

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
dsd_uds_100mb_3k_contexts_distributions_only memory utilization +2.20 [+2.03, +2.37] 1
dsd_uds_100mb_250k_contexts ingress throughput -0.00 [-0.00, +0.00] 1
dsd_uds_1mb_3k_contexts ingress throughput -0.00 [-0.00, +0.00] 1
dsd_uds_512kb_3k_contexts ingress throughput -0.00 [-0.01, +0.01] 1
dsd_uds_1mb_50k_contexts_memlimit ingress throughput -0.00 [-0.00, +0.00] 1
dsd_uds_10mb_3k_contexts ingress throughput -0.00 [-0.02, +0.02] 1
dsd_uds_100mb_3k_contexts ingress throughput -0.00 [-0.04, +0.04] 1
dsd_uds_500mb_3k_contexts ingress throughput -0.00 [-0.01, +0.01] 1
dsd_uds_1mb_50k_contexts ingress throughput -0.00 [-0.01, +0.00] 1

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

@pr-commenter
Copy link

pr-commenter bot commented Nov 8, 2024

Regression Detector (Saluki)

Regression Detector Results

Run ID: 48a812a8-d2d4-4dfe-a36a-29f77d897db2

Baseline: ecd7a30
Comparison: 45cf48f
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
dsd_uds_100mb_3k_contexts_distributions_only memory utilization +2.84 [+2.69, +2.98] 1
dsd_uds_10mb_3k_contexts ingress throughput +0.02 [-0.01, +0.05] 1
dsd_uds_512kb_3k_contexts ingress throughput +0.01 [-0.03, +0.04] 1
dsd_uds_100mb_3k_contexts ingress throughput +0.01 [-0.01, +0.02] 1
dsd_uds_1mb_3k_contexts ingress throughput +0.01 [-0.01, +0.02] 1
dsd_uds_50mb_10k_contexts_no_inlining ingress throughput +0.00 [-0.00, +0.00] 1
dsd_uds_1mb_50k_contexts ingress throughput -0.00 [-0.00, +0.00] 1
dsd_uds_50mb_10k_contexts_no_inlining_no_allocs ingress throughput -0.00 [-0.02, +0.01] 1
dsd_uds_100mb_250k_contexts ingress throughput -0.01 [-0.03, +0.01] 1
dsd_uds_500mb_3k_contexts ingress throughput -0.04 [-0.13, +0.05] 1
dsd_uds_1mb_50k_contexts_memlimit ingress throughput -0.28 [-4.18, +3.61] 1

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

@pr-commenter
Copy link

pr-commenter bot commented Nov 8, 2024

Regression Detector Links

Experiment Result Links

experiment link(s)
dsd_uds_100mb_250k_contexts [Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_100mb_3k_contexts [Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_100mb_3k_contexts_distributions_only [Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_10mb_3k_contexts [Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_1mb_3k_contexts [Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_1mb_50k_contexts [Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_1mb_50k_contexts_memlimit [Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_500mb_3k_contexts [Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_512kb_3k_contexts [Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_50mb_10k_contexts_no_inlining (ADP only) [Profiling (ADP)] [SMP Dashboard]
dsd_uds_50mb_10k_contexts_no_inlining_no_allocs (ADP only) [Profiling (ADP)] [SMP Dashboard]

@tobz tobz merged commit 9b38463 into main Nov 8, 2024
16 checks passed
@tobz tobz deleted the tobz/adp-image-3rd-party-license-include branch November 8, 2024 19:18
@tobz tobz changed the title chore: bundle licenses of dependencies into ADP container image [APR-248] chore: bundle licenses of dependencies into ADP container image Nov 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Ensure we bundle a copy of every license used by 3rd-party dependencies into our container image.
1 participant