THIRD_PARTY_NOTICES.md says the runtime base is nvcr.io/nvidia/distroless/go:v4.0.2 and links the v4.0.2 source index, but Dockerfile.distroless:63 builds on v4.1.1.
The version is hardcoded in tools/generate-notices.sh instead of being read from the Dockerfile the way the rest of that file derives its facts: BASE_SOURCE_URL at line 36, and the base-image sentence at line 579. So when the Dockerfile was bumped the notices kept the old version.
make notices-check can't catch it. It regenerates using the same constant and compares the result against the committed file, so that field is consistent with itself whatever the Dockerfile says.
It matters because it's the base-image source offer: the link points at sources for a version the image no longer ships.
Deriving the version from the Dockerfile would fix it and stop it drifting again on the next bump.
THIRD_PARTY_NOTICES.mdsays the runtime base isnvcr.io/nvidia/distroless/go:v4.0.2and links the v4.0.2 source index, butDockerfile.distroless:63builds onv4.1.1.The version is hardcoded in
tools/generate-notices.shinstead of being read from the Dockerfile the way the rest of that file derives its facts:BASE_SOURCE_URLat line 36, and the base-image sentence at line 579. So when the Dockerfile was bumped the notices kept the old version.make notices-checkcan't catch it. It regenerates using the same constant and compares the result against the committed file, so that field is consistent with itself whatever the Dockerfile says.It matters because it's the base-image source offer: the link points at sources for a version the image no longer ships.
Deriving the version from the Dockerfile would fix it and stop it drifting again on the next bump.