Scan kitless Docker dependency licenses

[kellyguo11]

Summary

• reuse one Docker dependency-license policy for the Isaac Sim-based and kitless images
• scan the kitless runtime image and its ubuntu:24.04 base with Trivy
• separate inherited Ubuntu packages from dependencies distributed by Isaac Lab
• reject unreviewed non-permissive licenses, in-process GPL, and unsupported static LGPL linkage
• fail closed when Trivy inventories a package but reports no license metadata
• retain the standalone FFmpeg guard and upload the complete kitless scan reports

Motivation

The kitless image is a separately distributed runtime artifact, but only the Isaac Sim-based Docker image currently receives the strict dependency-license check. This is especially important as #6953 proposes adding OVPhysX, Viser, Rerun, and another runtime system library to the kitless image.

The scan runs in the existing kitless build job, so it reuses the already-built image instead of adding another large Docker build.

#6953 audit evidence

A temporary branch combining #6953 with this scanner completed the image build, runtime validation, Ubuntu scan, final-image scan, and standalone FFmpeg guard in run 31210321067.

That audit used #6953 head e78eead0. The current head f0995a92 leaves docker/Dockerfile.kitless and #6953's added viewer extras unchanged. Its dependency-lock delta only updates Newton, Newton USD schemas, and Warp versions from the subsequently merged develop, so it does not add another #6953-specific package to the audited set.

The final-image delta contained eight new Python license findings: ImageIO (BSD-2-Clause), msgspec (BSD-3-Clause), OVPhysX (NVIDIA Omniverse), PyArrow (Apache-2.0), Rerun (MIT OR Apache-2.0), Viser (MIT), websockets (BSD-3-Clause), and zstandard (BSD-3-Clause). It contained no new GPL/LGPL finding.

The audit also found two new inventory records with no Trivy license finding: libxrender1 and Viser's embedded private Node package. Viser 1.0.30 also has inconsistent top-level metadata: PyPI declares MIT while the release-tag LICENSE is Apache-2.0. Both are permissive, but the provenance and third-party notices for the bundled web client need to be reconciled. The shared policy now reports any package without scanner license metadata as UNKNOWN and requires explicit review instead of silently omitting it.

Validation

• uv run --frozen isaaclab -f
• bash -n tools/license/check_docker_licenses.sh
• parsed both modified workflows with PyYAML
• replayed the policy against the Fix kit-less container bugs and ship OVPhysX plus all Newton viewers #6953 Trivy artifact; the expected fail-closed report contained 1,481 findings and explicitly flagged both missing-license records

The PR's self-hosted kitless job provides the authoritative image scan.

Type of change

• New feature (CI license enforcement)

Checklist

• I have read and understood the contribution guidelines
• I have run the pre-commit checks
• My changes generate no new local warnings
• Documentation changes are not required for this CI-only change
• A changelog fragment is not required because no package source changed
• My name already exists in CONTRIBUTORS.md