You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@baremaps.apache.org by "bchapuis (via GitHub)" <gi...@apache.org> on 2023/09/11 20:07:33 UTC
[GitHub] [incubator-baremaps] bchapuis opened a new pull request, #778: Override licenses
bchapuis opened a new pull request, #778:
URL: https://github.com/apache/incubator-baremaps/pull/778
@Perdjesk What do you think about this version. The idea is to introduce a template (override.ftl) that serves as a basis to create a file for overriding the licenses of the dependencies (override.ftl). In this file, we can then manually uniformize the license name and pick the least restrictive licenses. The maintenance of this file will require to perform a diff with a newly generated file and a few manual modifications before publishing a release.
I like that in this alternative, we have the same ordering and naming between the LICENSE file, the override.properties file, and the lib/ directory of the binary distribution. We loose the grouping by license, but I'm not sure that it is a requirement.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] bchapuis commented on pull request #778: Override licenses
Posted by "bchapuis (via GitHub)" <gi...@apache.org>.
bchapuis commented on PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778#issuecomment-1716155543
This is a pretty cool idea! From what I understand, the generation takes the actual override into account. We could actually override the override.properties file, but I prefer if we do this before releasing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] Perdjesk commented on a diff in pull request #778: Override licenses
Posted by "Perdjesk (via GitHub)" <gi...@apache.org>.
Perdjesk commented on code in PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778#discussion_r1322931004
##########
baremaps-cli/pom.xml:
##########
@@ -157,27 +190,12 @@
<version>2.2.0</version>
<configuration>
<force>true</force>
- <thirdPartyFilename>THIRD-PARTY</thirdPartyFilename>
- <!-- Template to group by license with handling of multi licensing -->
- <fileTemplate>${basedir}/licenseBundledDeps.ftl</fileTemplate>
- <!-- Only bundled bits matters https://infra.apache.org/licensing-howto.html#bundled-vs-non-bundled -->
+ <outputDirectory>${thirdparty.directory}</outputDirectory>
+ <thirdPartyFilename>${thirdparty.filename}</thirdPartyFilename>
<excludedScopes>test,provided</excludedScopes>
- <!-- If true enforces excluding transitive dependencies of the excluded artifacts in the reactor;
- otherwise only artifacts that match exclude filters are excluded.
- It excludes all transitives dependencies of excludedScopes dependencies. -->
<excludeTransitiveDependencies>true</excludeTransitiveDependencies>
Review Comment:
Removing this incorrect configuration allow then to properly handle the circular dependency to baremaps components in the LICENSE:
```
<excludedGroups>^org\.apache\.baremaps</excludedGroups>
```
To remove:
```
org.apache.baremaps--baremaps-core--0.7.2-SNAPSHOT=Apache License 2.0
org.apache.baremaps--baremaps-ogcapi--0.7.2-SNAPSHOT=Apache License 2.0
org.apache.baremaps--baremaps-server--0.7.2-SNAPSHOT=Apache License 2.0
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] bchapuis commented on a diff in pull request #778: Override licenses
Posted by "bchapuis (via GitHub)" <gi...@apache.org>.
bchapuis commented on code in PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778#discussion_r1322947588
##########
baremaps-cli/pom.xml:
##########
@@ -157,27 +190,12 @@
<version>2.2.0</version>
<configuration>
<force>true</force>
- <thirdPartyFilename>THIRD-PARTY</thirdPartyFilename>
- <!-- Template to group by license with handling of multi licensing -->
- <fileTemplate>${basedir}/licenseBundledDeps.ftl</fileTemplate>
- <!-- Only bundled bits matters https://infra.apache.org/licensing-howto.html#bundled-vs-non-bundled -->
+ <outputDirectory>${thirdparty.directory}</outputDirectory>
+ <thirdPartyFilename>${thirdparty.filename}</thirdPartyFilename>
<excludedScopes>test,provided</excludedScopes>
- <!-- If true enforces excluding transitive dependencies of the excluded artifacts in the reactor;
- otherwise only artifacts that match exclude filters are excluded.
- It excludes all transitives dependencies of excludedScopes dependencies. -->
<excludeTransitiveDependencies>true</excludeTransitiveDependencies>
Review Comment:
This makes me wonder if we could exclude all the Apache projects.
```java
<excludedGroups>^org\.apache</excludedGroups>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] Perdjesk commented on a diff in pull request #778: Override licenses
Posted by "Perdjesk (via GitHub)" <gi...@apache.org>.
Perdjesk commented on code in PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778#discussion_r1322901439
##########
baremaps-cli/pom.xml:
##########
@@ -157,27 +190,12 @@
<version>2.2.0</version>
<configuration>
<force>true</force>
- <thirdPartyFilename>THIRD-PARTY</thirdPartyFilename>
- <!-- Template to group by license with handling of multi licensing -->
- <fileTemplate>${basedir}/licenseBundledDeps.ftl</fileTemplate>
- <!-- Only bundled bits matters https://infra.apache.org/licensing-howto.html#bundled-vs-non-bundled -->
+ <outputDirectory>${thirdparty.directory}</outputDirectory>
+ <thirdPartyFilename>${thirdparty.filename}</thirdPartyFilename>
<excludedScopes>test,provided</excludedScopes>
- <!-- If true enforces excluding transitive dependencies of the excluded artifacts in the reactor;
- otherwise only artifacts that match exclude filters are excluded.
- It excludes all transitives dependencies of excludedScopes dependencies. -->
<excludeTransitiveDependencies>true</excludeTransitiveDependencies>
Review Comment:
Doing some testing in more depth regards of this configuration, I figured it is wrong to have it to true.
The case that triggered enabling this is in fact correct. It can happens that a direct dependency with scope test has a dependency that is included in the jar/binary release.
`org.apiguardian:apiguardian-api` is a dependency of `org.junit.jupiter:junit-jupiter-api` and `org.apache.calcite:calcite-core`.
Given that calcite is included with scope compile, it is the expected to see:
```
+- org.junit.jupiter:junit-jupiter-api:jar:5.7.1:test
+- org.apiguardian:apiguardian-api:jar:1.1.0:compile
+- org.opentest4j:opentest4j:jar:1.2.0:test
\- org.junit.platform:junit-platform-commons:jar:1.7.1:test
```
And `org.apiguardian:apiguardian-api` must be in the LICENSE file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] Perdjesk commented on a diff in pull request #778: Override licenses
Posted by "Perdjesk (via GitHub)" <gi...@apache.org>.
Perdjesk commented on code in PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778#discussion_r1322906995
##########
baremaps-cli/pom.xml:
##########
@@ -157,27 +190,12 @@
<version>2.2.0</version>
<configuration>
<force>true</force>
- <thirdPartyFilename>THIRD-PARTY</thirdPartyFilename>
- <!-- Template to group by license with handling of multi licensing -->
- <fileTemplate>${basedir}/licenseBundledDeps.ftl</fileTemplate>
- <!-- Only bundled bits matters https://infra.apache.org/licensing-howto.html#bundled-vs-non-bundled -->
+ <outputDirectory>${thirdparty.directory}</outputDirectory>
+ <thirdPartyFilename>${thirdparty.filename}</thirdPartyFilename>
<excludedScopes>test,provided</excludedScopes>
- <!-- If true enforces excluding transitive dependencies of the excluded artifacts in the reactor;
- otherwise only artifacts that match exclude filters are excluded.
- It excludes all transitives dependencies of excludedScopes dependencies. -->
<excludeTransitiveDependencies>true</excludeTransitiveDependencies>
Review Comment:
Yes it has to be removed to be compliant with the policy that any bundled bit in release binary must be listed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] sonarcloud[bot] commented on pull request #778: Override licenses
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778#issuecomment-1715065946
Kudos, SonarCloud Quality Gate passed! [](https://sonarcloud.io/dashboard?id=apache_baremaps&pullRequest=778)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY)
[](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT) [](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL)
[](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778) No Coverage information
[](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778&metric=new_duplicated_lines_density&view=list)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] sonarcloud[bot] commented on pull request #778: Override licenses
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778#issuecomment-1716158923
Kudos, SonarCloud Quality Gate passed! [](https://sonarcloud.io/dashboard?id=apache_baremaps&pullRequest=778)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY)
[](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT) [](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL)
[](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778) No Coverage information
[](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778&metric=new_duplicated_lines_density&view=list)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] sonarcloud[bot] commented on pull request #778: Override licenses
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778#issuecomment-1714531948
Kudos, SonarCloud Quality Gate passed! [](https://sonarcloud.io/dashboard?id=apache_baremaps&pullRequest=778)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY)
[](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT) [](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL)
[](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778) No Coverage information
[](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778&metric=new_duplicated_lines_density&view=list)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] sonarcloud[bot] commented on pull request #778: Override licenses
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778#issuecomment-1714506953
Kudos, SonarCloud Quality Gate passed! [](https://sonarcloud.io/dashboard?id=apache_baremaps&pullRequest=778)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY)
[](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT) [](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL)
[](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778) No Coverage information
[](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778&metric=new_duplicated_lines_density&view=list)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] sonarcloud[bot] commented on pull request #778: Override licenses
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778#issuecomment-1715068299
Kudos, SonarCloud Quality Gate passed! [](https://sonarcloud.io/dashboard?id=apache_baremaps&pullRequest=778)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY)
[](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT) [](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL)
[](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778) No Coverage information
[](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778&metric=new_duplicated_lines_density&view=list)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] bchapuis commented on a diff in pull request #778: Override licenses
Posted by "bchapuis (via GitHub)" <gi...@apache.org>.
bchapuis commented on code in PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778#discussion_r1322904785
##########
baremaps-cli/pom.xml:
##########
@@ -157,27 +190,12 @@
<version>2.2.0</version>
<configuration>
<force>true</force>
- <thirdPartyFilename>THIRD-PARTY</thirdPartyFilename>
- <!-- Template to group by license with handling of multi licensing -->
- <fileTemplate>${basedir}/licenseBundledDeps.ftl</fileTemplate>
- <!-- Only bundled bits matters https://infra.apache.org/licensing-howto.html#bundled-vs-non-bundled -->
+ <outputDirectory>${thirdparty.directory}</outputDirectory>
+ <thirdPartyFilename>${thirdparty.filename}</thirdPartyFilename>
<excludedScopes>test,provided</excludedScopes>
- <!-- If true enforces excluding transitive dependencies of the excluded artifacts in the reactor;
- otherwise only artifacts that match exclude filters are excluded.
- It excludes all transitives dependencies of excludedScopes dependencies. -->
<excludeTransitiveDependencies>true</excludeTransitiveDependencies>
Review Comment:
Should I remove this line?
I will try to merge this tonight and to publish a second release candidate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] bchapuis merged pull request #778: Override licenses
Posted by "bchapuis (via GitHub)" <gi...@apache.org>.
bchapuis merged PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] Perdjesk commented on pull request #778: Override licenses
Posted by "Perdjesk (via GitHub)" <gi...@apache.org>.
Perdjesk commented on PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778#issuecomment-1715580345
I pulled the branch and did some more in-depth analysis.
I think this approach is better and embrace the fact that we have to deal with a manual step/verification of the content added in LICENSE for: license merging, choose one license per bundled dependency. Having a file within source repository allow for proper review of changes.
However in order to make this maintainable and usable, we should have a way to identify drift between dependencies in `pom.xml`s and the content of `override.properties` so that they are aligned.
Here is the trial I did locally to address this point:
```
--- a/baremaps-cli/pom.xml
+++ b/baremaps-cli/pom.xml
@@ -190,19 +190,35 @@
<version>2.2.0</version>
<configuration>
<force>true</force>
- <outputDirectory>${thirdparty.directory}</outputDirectory>
- <thirdPartyFilename>${thirdparty.filename}</thirdPartyFilename>
<excludedScopes>test,provided</excludedScopes>
- <excludeTransitiveDependencies>true</excludeTransitiveDependencies>
- <fileTemplate>${basedir}/src/license/bundle.ftl</fileTemplate>
- <overrideFile>${basedir}/src/license/override.properties</overrideFile>
+ <excludedGroups>^org\.apache\.baremaps</excludedGroups>
+ <overrideUrl>file://${basedir}/src/license/override.properties</overrideUrl>
+ <failOnMissing>true</failOnMissing>
</configuration>
<executions>
<execution>
+ <id>1</id>
<goals>
<goal>add-third-party</goal>
</goals>
<phase>prepare-package</phase>
+ <configuration>
+ <outputDirectory>${thirdparty.directory}</outputDirectory>
+ <thirdPartyFilename>${thirdparty.filename}</thirdPartyFilename>
+ <fileTemplate>${basedir}/src/license/bundle.ftl</fileTemplate>
+ </configuration>
+ </execution>
+ <execution>
+ <id>2</id>
+ <goals>
+ <goal>add-third-party</goal>
+ </goals>
+ <phase>generate-sources</phase>
+ <configuration>
+ <fileTemplate>${basedir}/src/license/override.ftl</fileTemplate>
+ <outputDirectory>${thirdparty.directory}</outputDirectory>
+ <thirdPartyFilename>override.properties</thirdPartyFilename>
+ </configuration>
</execution>
</executions>
</plugin>
```
Changing a dependency version:
```
% ./mvnw generate-sources
% diff baremaps-cli/src/license/override.properties baremaps-cli/target/generated-sources/license/override.properties
44c44
< info.picocli--picocli--4.6.3=Apache License 2.0
---
> info.picocli--picocli--4.7.5=The Apache Software License, version 2.0
```
Adding a dependency:
```
% ./mvnw generate-sources
% diff baremaps-cli/src/license/override.properties baremaps-cli/target/generated-sources/license/override.properties
18a19
> com.google.code.gson--gson--2.10.1=Apache-2.0
```
Removing a dependency:
```
% ./mvnw generate-sources
% diff baremaps-cli/src/license/override.properties baremaps-cli/target/generated-sources/license/override.properties
200,201d200
< org.roaringbitmap--RoaringBitmap--0.9.38=Apache License 2.0
< org.roaringbitmap--shims--0.9.38=Apache License 2.0
```
The CI could enforce that there is no difference between the generated `override.properties` and the one present in code repository, thus ensuring the in-sync.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-baremaps] sonarcloud[bot] commented on pull request #778: Override licenses
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #778:
URL: https://github.com/apache/incubator-baremaps/pull/778#issuecomment-1716164046
Kudos, SonarCloud Quality Gate passed! [](https://sonarcloud.io/dashboard?id=apache_baremaps&pullRequest=778)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=BUG)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=VULNERABILITY)
[](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT) [](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_baremaps&pullRequest=778&resolved=false&types=SECURITY_HOTSPOT)
[](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL) [](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=apache_baremaps&pullRequest=778&resolved=false&types=CODE_SMELL)
[](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778) No Coverage information
[](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_baremaps&pullRequest=778&metric=new_duplicated_lines_density&view=list)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@baremaps.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org