You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@eventmesh.apache.org by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2024/04/17 08:08:22 UTC
Re: [PR] [ISSUE #4830] Generate LICENSE and NOTICE with Gradle tasks (eventmesh)
ppkarwasz commented on code in PR #4831:
URL: https://github.com/apache/eventmesh/pull/4831#discussion_r1568369409
##########
build.gradle:
##########
@@ -212,6 +212,107 @@ task printProjects() {
})
}
+cyclonedxBom {
+ includeConfigs = ["runtimeClasspath"]
+}
+
+// TODO depend 'dist' on 'generateDistLicense'
+tasks.register('generateDistLicense') {
+ dependsOn('cyclonedxBom') // Task from 'org.cyclonedx.bom' plugin
+ doLast {
+ // Inputs
+ def bomFile = file('build/reports/bom.json')
+ def bom = new JsonSlurper().parseText(bomFile.text)
+ def projectLicenseText = file('LICENSE').text
+
+ // Outputs
+ def distLicenseFile = file('tools/dist-license/LICENSE')
+ def licensesDir = file('tools/dist-license/licenses/java/')
Review Comment:
Shouldn't these files be stored directly in `dist` and `dist/licenses`?
##########
build.gradle:
##########
@@ -35,11 +32,15 @@ buildscript {
dependencies {
classpath "com.github.spotbugs.snom:spotbugs-gradle-plugin:5.0.14"
classpath "io.spring.gradle:dependency-management-plugin:1.0.11.RELEASE"
- classpath "com.github.jk1:gradle-license-report:1.17"
classpath "com.diffplug.spotless:spotless-plugin-gradle:6.13.0"
}
}
+plugins {
+ id 'org.cyclonedx.bom' version '1.8.2'
+ id 'com.github.jk1.dependency-license-report' version '2.6'
+}
Review Comment:
The remaining Gradle plugins are applied using `apply plugin: X`, e.g.:
https://github.com/apache/eventmesh/blob/67b93e2064d09c48db8a956632f0d10996c2836c/build.gradle#L54-L57
Can't these two use the same syntax?
##########
build.gradle:
##########
@@ -212,6 +212,107 @@ task printProjects() {
})
}
+cyclonedxBom {
+ includeConfigs = ["runtimeClasspath"]
+}
+
+// TODO depend 'dist' on 'generateDistLicense'
+tasks.register('generateDistLicense') {
+ dependsOn('cyclonedxBom') // Task from 'org.cyclonedx.bom' plugin
+ doLast {
+ // Inputs
+ def bomFile = file('build/reports/bom.json')
+ def bom = new JsonSlurper().parseText(bomFile.text)
+ def projectLicenseText = file('LICENSE').text
+
+ // Outputs
+ def distLicenseFile = file('tools/dist-license/LICENSE')
+ def licensesDir = file('tools/dist-license/licenses/java/')
+ if (licensesDir.exists()) {
+ licensesDir.eachFile { it.delete() }
+ } else {
+ licensesDir.mkdirs()
+ }
+
+ List<Map<String, String>> thirdPartyArtifacts = new ArrayList<Map<String, String>>()
+ // Parse BOM
+ bom.components.each { component ->
+ // Exclude project modules
+ if (!component.group.startsWith('org.apache.eventmesh')) {
+ component.licenses.each { artifactLicense ->
+ if (artifactLicense.license != null) {
+ Map<String, String> artifact = new HashMap<String, String>()
+ artifact.put("name", component.name)
+ artifact.put("version", component.version)
+ if (artifactLicense.license.id != null) {
+ artifact.put("license", artifactLicense.license.id)
+ if (artifactLicense.license.text != null) {
+ artifact.put("licenseContent", new String(artifactLicense.license.text.content.decodeBase64()))
+ }
+ } else {
+ artifact.put("license", artifactLicense.license.name)
+ artifact.put("licenseContent", artifactLicense.license.url)
+ }
+ thirdPartyArtifacts.add(artifact)
+ }
+ }
+ }
+ }
+ thirdPartyArtifacts.sort { a, b ->
+ def nameComparison = a.name <=> b.name
+ if (nameComparison == 0) {
+ return a.version <=> b.version
+ } else {
+ return nameComparison
+ }
+ }
+
+ def distLicenseText = projectLicenseText + "\n=======================================================================\n" +
+ "This distribution contains the following third-party:\n\n"
+ thirdPartyArtifacts.each { artifact ->
+ // Write licenses
+ def artifactLicenseFilename = artifact.license.replaceAll("/", "-") + ".txt"
+ def artifactLicenseFile = new File(licensesDir, artifactLicenseFilename)
+ if (artifact.licenseContent != null) {
+ artifactLicenseFile.text = artifact.licenseContent
+ } else {
+ artifactLicenseFile.text = "No license content provided by the artifact."
Review Comment:
```suggestion
throw new GradleException("${artifact.name} has an unknown license.")
```
This should be an error condition: unless you discover the license of that library by other means, you can not distribute it.
##########
build.gradle:
##########
@@ -212,6 +212,107 @@ task printProjects() {
})
}
+cyclonedxBom {
+ includeConfigs = ["runtimeClasspath"]
+}
+
+// TODO depend 'dist' on 'generateDistLicense'
+tasks.register('generateDistLicense') {
+ dependsOn('cyclonedxBom') // Task from 'org.cyclonedx.bom' plugin
+ doLast {
+ // Inputs
+ def bomFile = file('build/reports/bom.json')
+ def bom = new JsonSlurper().parseText(bomFile.text)
+ def projectLicenseText = file('LICENSE').text
+
+ // Outputs
+ def distLicenseFile = file('tools/dist-license/LICENSE')
+ def licensesDir = file('tools/dist-license/licenses/java/')
+ if (licensesDir.exists()) {
+ licensesDir.eachFile { it.delete() }
+ } else {
+ licensesDir.mkdirs()
+ }
+
+ List<Map<String, String>> thirdPartyArtifacts = new ArrayList<Map<String, String>>()
+ // Parse BOM
+ bom.components.each { component ->
+ // Exclude project modules
+ if (!component.group.startsWith('org.apache.eventmesh')) {
+ component.licenses.each { artifactLicense ->
+ if (artifactLicense.license != null) {
+ Map<String, String> artifact = new HashMap<String, String>()
+ artifact.put("name", component.name)
+ artifact.put("version", component.version)
+ if (artifactLicense.license.id != null) {
+ artifact.put("license", artifactLicense.license.id)
+ if (artifactLicense.license.text != null) {
+ artifact.put("licenseContent", new String(artifactLicense.license.text.content.decodeBase64()))
+ }
+ } else {
+ artifact.put("license", artifactLicense.license.name)
+ artifact.put("licenseContent", artifactLicense.license.url)
+ }
+ thirdPartyArtifacts.add(artifact)
+ }
+ }
+ }
+ }
+ thirdPartyArtifacts.sort { a, b ->
+ def nameComparison = a.name <=> b.name
+ if (nameComparison == 0) {
+ return a.version <=> b.version
+ } else {
+ return nameComparison
+ }
+ }
+
+ def distLicenseText = projectLicenseText + "\n=======================================================================\n" +
+ "This distribution contains the following third-party:\n\n"
Review Comment:
I would add "third-party artifacts" or "third-party libraries".
Disclaimer: I am neither a lawyer or a native speaker.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@eventmesh.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@eventmesh.apache.org
For additional commands, e-mail: issues-help@eventmesh.apache.org