all: add license headers and CONTRIBUTING.md

Change-Id: Icb46b1d9d8f3f1db6066b729e511cbd0ff94f113
Reviewed-on: https://team-review.git.corp.google.com/c/golang/vulndb/+/1054184
Reviewed-by: Filippo Valsorda <valsorda@google.com>

CONTRIBUTING.md

@@ -0,0 +1,28 @@
+# Contributing to the Go Vulnerability Database
+
+Go is an open source project.
+
+It is the work of hundreds of contributors. We appreciate your help!
+
+## Reporting a vulnerability
+
+To report a new *public* vulnerability,
+[open an issue](https://github.com/golang/vulndb/issues/new),
+send a GitHub PR, or mail a Gerrit CL.
+
+Please read the
+[Contribution Guidelines](https://golang.org/doc/contribute.html)
+before sending patches.
+
+## Contributor License Agreement
+
+Contributions to this project must be accompanied by a Contributor License
+Agreement (CLA). You (or your employer) retain the copyright to your
+contribution; this simply gives us permission to use and redistribute your
+contributions as part of the project. Head over to
+<https://cla.developers.google.com/> to see your current agreements on file or
+to sign a new one.
+
+You generally only need to submit a CLA once, so if you've already submitted one
+(even if it was for a different project), you probably don't need to do it
+again.

README.md

@@ -25,12 +25,7 @@ on in a more segmented fashion.
 * `cmd/linter` provides a tool for linting individual reports
 * `cmd/report2cve` provides a tool for converting TOML reports into JSON CVEs
 
-## Contributing
-
-To report a new *public* vulnerability, [open an
-issue](https://github.com/golang/vulndb/issues/new) or send a PR. Please read
-the [Contribution Guidelines](https://golang.org/doc/contribute.html) before
-sending patches.
+## License
 
 Unless otherwise noted, the Go source files are distributed under
 the BSD-style license found in the LICENSE file.

client/cache.go

@@ -1,3 +1,7 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package client
 
 import (

client/cache_test.go

@@ -1,3 +1,7 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package client
 
 import (

client/client.go

@@ -1,3 +1,7 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package client
 
 import (

client/client_test.go

@@ -1,3 +1,7 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package client
 
 import (

cmd/gendb/main.go

@@ -1,3 +1,7 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package main
 
 import (
@@ -21,7 +25,7 @@ func fail(why string) {
 }
 
 // TODO: obviously not for the real world
-const dbURL = "https://team.git.corp.google.com/golang/vulndb/+/refs/heads/main/reports/"
+const dbURL = "https://go.googlesource.com/vulndb/+/refs/heads/main/reports/"
 
 func matchesCurrent(path string, new []osv.Entry) bool {
 	var current []osv.Entry

cmd/gendb/main_test.go

@@ -1 +0,0 @@
-package main

cmd/genhtml/main.go

@@ -1,3 +1,7 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package main
 
 import (

cmd/linter/main.go

@@ -1,3 +1,7 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package main
 
 import (

cmd/report2cve/main.go

@@ -1,3 +1,7 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package main
 
 import (

new-vuln.sh

@@ -1,4 +1,8 @@
-#!/bin/bash
+#!/usr/bin/env bash
+# Copyright 2021 The Go Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file.
+
 prev=$(find reports/GO-* | tail -n 1 | sed -n 's/reports\/GO-[0-9]*-\([0-9]*\).toml/\1/p')
 new=$(printf "%04d" $(expr $prev + 1))
 year=$(date +"%Y")

osv/json.go

@@ -1,3 +1,7 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package osv
 
 import (

osv/json_test.go

@@ -1,3 +1,7 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package osv
 
 import (

report/lint.go

@@ -1,3 +1,7 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package report
 
 import (

report/report.go

@@ -1,3 +1,7 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package report
 
 import "time"