You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "Frun1na (via GitHub)" <gi...@apache.org> on 2026/09/24 14:29:34 UTC
[I] [Bug] mvn package fails on every run: binary-license-gate demands license texts that 164 bundled JARs do not carry [rocketmq-dashboard]
Frun1na opened a new issue, #5085:
URL: https://github.com/apache/rocketmq-dashboard/issues/5085
### Before creating
- [x] I have searched the existing issues and found no duplicate.
- [x] I have checked the latest `rocketmq-studio` branch where this problem still exists.
### Bug report
**Which page or component**
Server build: `mvn package` → `binary-license-gate` (maven-antrun, `server/scripts/legal.py jar ...`), bound to the default `package` phase in `server/pom.xml`.
**What happened**
`mvn -DskipTests package` fails on every run at tip `a562601d`:
```
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-antrun-plugin:3.2.0:run (binary-license-gate)
on project rocketmq-studio: ... exec returned: 1
```
Reproducing the gate command directly shows why — the gate requires **every** dependency JAR inside `BOOT-INF/lib/` to carry its complete license text, but the vast majority of Maven-published JARs do not embed one:
```
$ python3 scripts/legal.py jar target/rocketmq-studio-3.0.0.jar --output target/legal
license gate: release license gate failed:
HikariCP-7.0.2.jar: missing complete upstream LICENSE/COPYING; ...
ST4-4.3.4.jar: missing complete upstream LICENSE/COPYING; ...
... (164 jars in total)
Spring Boot loader: missing the original META-INF/LICENSE.txt or NOTICE.txt
```
I verified one representative: `HikariCP-7.0.2.jar` (extracted from the fat JAR) contains 98 entries and none named LICENSE/NOTICE/COPYING. The gate's own synthetic tests only ever exercise a one-component fixture (`legal_test.py` reports "1 actual components"), so this was never run against the real dependency set. Consequences:
- `mvn package` fails for every developer;
- the CI / docker compose default image build (server/Dockerfile stage `build`) fails at the same step;
- the same batch also introduced the web license gate failure tracked in #5084 (fixed by #5083).
**Expected behaviour**
`mvn -DskipTests package` should complete. The gate's contract needs a decision before it can pass, e.g.:
- vendor the complete license texts for the dependencies that omit them, with pinned checksums like the web side does (`web/licenses/toggle-selection-1.0.6/LICENSE` pattern) — but that is ~164 texts to source and verify; or
- require license materials only for a defined release profile / redistribute the license obligations differently; or
- relax the per-jar requirement to a curated allowlist of components that actually ship license files.
I can help implement whichever direction is chosen, but sourcing and verifying 164 license texts is not something I can do unilaterally, hence issue-first.
**Environment**
- RocketMQ Studio: upstream `rocketmq-studio` tip `a562601d`
- `mvn -B -ntp package -DskipTests`, OpenJDK 21, Maven 3.9.9
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] mvn package fails on every run: binary-license-gate demands license texts that 164 bundled JARs do not carry [rocketmq-dashboard]
Posted by "zjncs (via GitHub)" <gi...@apache.org>.
zjncs commented on issue #5085:
URL: https://github.com/apache/rocketmq-dashboard/issues/5085#issuecomment-6040177375
Confirming this is still blocking every external PR as of 2026-10-07:
- Every open PR targeting `rocketmq-studio` fails `Backend Build (Java 21)` at the `binary-license-gate` (e.g. #5591, #5597, #5628) with the same "missing complete upstream LICENSE/COPYING" list, and the branch's own push runs have been failing since Oct 1 as well.
- On top of that, PRs targeting `master` currently cannot start CI at all (`startup_failure` before any job, including dependabot's #5598). Master's `ci.yml` still references the floating `docker/setup-buildx-action@v3` / `docker/build-push-action@v6` tags that the ASF Actions policy rejects (#2549), while the `rocketmq-studio` branch already pins them to immutable SHAs — carrying that pinning over to `master` should restore startup for master-targeted PRs.
Happy to help with the license bundle or the workflow pinning if that is useful.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] mvn package fails on every run: binary-license-gate demands license texts that 164 bundled JARs do not carry [rocketmq-dashboard]
Posted by "zmuxuny (via GitHub)" <gi...@apache.org>.
zmuxuny commented on issue #5085:
URL: https://github.com/apache/rocketmq-dashboard/issues/5085#issuecomment-5934608075
Rechecked against `rocketmq-studio@a460673f`: the [upstream backend build](https://github.com/apache/rocketmq-dashboard/actions/runs/36849906283/job/110328993085) still reports **164 missing complete dependency LICENSE/COPYING materials**, plus the Spring Boot loader's missing original `META-INF/LICENSE.txt` / `NOTICE.txt`. Compilation and Boot repackaging finish before this gate fails. The same diagnostics recur in the [current PR build](https://github.com/apache/rocketmq-dashboard/actions/runs/36882733561/job/110438316458).
The relevant contract is explicit: [`collect_jar`](https://github.com/apache/rocketmq-dashboard/blob/a460673fb5b1c61b06f06bac5e48428bb479fa07/server/scripts/legal.py#L108-L140) reads materials only from the embedded JARs, while `add_component` requires a sufficiently long LICENSE/COPYING file. There is currently no source-backed fallback for an artifact that omits those files.
One implementation direction for discussion, preserving the gate:
1. Generate an inventory from the actual fat JAR, recording each dependency's coordinates/version, artifact checksum, embedded materials, and missing requirements. The 164 diagnostics need not imply 164 unrelated license sources.
2. Add an explicitly reviewed fallback-material manifest for the missing entries, pinned to exact artifact identity/checksum and upstream source revision/URL, with checksums for the original license, copyright, and applicable notice files. Preserve already embedded materials rather than replacing them with generic license names.
3. Handle the Boot loader separately using the original materials for the exact Boot version.
4. Keep unknown artifacts, changed checksums, missing materials, and unresolved manual-review findings as failures. This would not equate collected texts with approval of redistribution rights.
Regression coverage should include a missing fallback, a valid fallback retained in the final JAR, checksum/version drift, preserved NOTICE content, and post-packaging tampering. Acceptance should include the real dependency set, not only the existing one-component fixture.
Would this conservative fallback approach fit the intended packaging contract? Agreement on that boundary would help before sourcing a large set of materials or changing the script's behavior. This is a proposal, not a claim that the licensing review or packaging fix is complete.
The frontend artifact-hash work in #5019 / #5083 is a separate gate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] mvn package fails on every run: binary-license-gate demands license texts that 164 bundled JARs do not carry [rocketmq-dashboard]
Posted by "Frun1na (via GitHub)" <gi...@apache.org>.
Frun1na closed issue #5085: [Bug] mvn package fails on every run: binary-license-gate demands license texts that 164 bundled JARs do not carry
URL: https://github.com/apache/rocketmq-dashboard/issues/5085
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org