[PR] Ship a complete LICENSE and NOTICE in the assembly jars (1.3.x) [pekko-grpc]

["pjfanning (via GitHub)" <gi...@apache.org>]

pjfanning opened a new pull request, #866:
URL: https://github.com/apache/pekko-grpc/pull/866

   1.3.x port of #865.
   
   ### Motivation
   
   `pekko-grpc-codegen` and `pekko-grpc-scalapb-protoc-plugin` publish assembly jars and bat archives that bundle classes from 3rd party projects, so their `META-INF/LICENSE` and `META-INF/NOTICE` have to account for those projects. `legal/AssemblyLicense.txt` and `legal/AssemblyNotice.txt` exist for that, but:
   
   - The codegen assembly merged `META-INF/LICENSE` with `MergeStrategy.concat`, so the jar and bat shipped `legal/AssemblyLicense.txt` with a dependency's plain Apache 2.0 text appended to it rather than the curated file. (On `main` the same line was `discard`, which dropped the LICENSE entirely.)
   - `legal/AssemblyLicense.txt` had drifted from what is actually bundled. It listed `org.checkerframework:checker-qual`, which guava dropped in favour of `org.jspecify:jspecify`, and jspecify was not listed anywhere.
   - scalapb-protoc-plugin let `compilerplugin` resolve protobuf-java transitively, rather than pinning it the way codegen and runtime do.
   
   Nothing failed the build when the legal files fell behind a dependency change.
   
   ### Modification
   
   - Merge `META-INF/LICENSE` and `META-INF/NOTICE` with `MergeStrategy.preferProject` in both assemblies, so our own files win over the ones the dependencies bring in.
   - Swap `checker-qual` for `jspecify` in `legal/AssemblyLicense.txt` and drop the MIT text that was only there for checker-qual.
   - Pin protobuf-java in scalapb-protoc-plugin via a new `Dependencies` group, the same way codegen and runtime already do. **No dependency version was changed** - this branch stays on protobuf-java 3.25.9.
   - Add `project/AssemblyLicenseCheck.scala` with two tasks, wired into both assembly projects and run in CI as the `checkAssemblyLicenses` alias:
     - `assemblyLicenseCheck` fails when a module on the assembly classpath is not named in the assembly LICENSE file, and warns about listed modules that are not bundled for the Scala version being built (the assemblies are cross built, so e.g. `scala3-library` is legitimately absent from a 2.12 run).
     - `assemblyMetaInfCheck` opens the published assembly jar and bat archive and fails unless each carries `META-INF/LICENSE` and `META-INF/NOTICE` matching the files in `legal/`.
   
   The LICENSE and NOTICE stay hand curated, which is what the ASF wants: almost none of the bundled jars ship a `META-INF/NOTICE` of their own, so the text has to come from the upstream projects. The new tasks guard the curation rather than replace it.
   
   ### Result
   
   Both assembly jars and both bat archives ship the curated LICENSE and NOTICE covering the 3rd party classes they bundle, and CI fails if a dependency change leaves the legal files behind.
   
   ### Tests
   
   - `sbt checkAssemblyLicenses` - passed on Scala 2.12. `assemblyLicenseCheck` failed before the `AssemblyLicense.txt` fix, reporting that `org.jspecify:jspecify` was not accounted for.
   - `sbt scalafmtSbtCheck` - passed.
   
   ### References
   
   Refs #865
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org