[jira] [Commented] (BEAM-13538) :release:go-license doesn't get the correct version of container boot for licenses

["Beam JIRA Bot (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/BEAM-13538?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17505869#comment-17505869 ] 

Beam JIRA Bot commented on BEAM-13538:
--------------------------------------

This issue is P2 but has been unassigned without any comment for 60 days so it has been labeled "stale-P2". If this issue is still affecting you, we care! Please comment and remove the label. Otherwise, in 14 days the issue will be moved to P3.

Please see https://beam.apache.org/contribute/jira-priorities/ for a detailed explanation of what these priorities mean.


> :release:go-license doesn't get the correct version of container boot for licenses
> ----------------------------------------------------------------------------------
>
>                 Key: BEAM-13538
>                 URL: https://issues.apache.org/jira/browse/BEAM-13538
>             Project: Beam
>          Issue Type: Bug
>          Components: release
>            Reporter: Robert Burke
>            Priority: P2
>              Labels: bash, go, gradle, stale-P2
>          Time Spent: 1.5h
>  Remaining Estimate: 0h
>
> Likely has been an issue throughout the lifetime of the code.
> At present the code is pulling the old pre-modules version of the code (2.32.0), so 2.33.0 through to present, haven't reflected licences to the go boot code. We need to check to see if those releases are missing licenses, but I think the risk there is small as the Go code used isn't large.
> The current fix would be to move things to be module aware and pull the v2 (post module) paths with go-get. 
> Our mitigation options in the short term are Be Eager (@master), or Be Stale (using @latest), which have the following implications. Being Stale means getting the code at the previous release, meaning the licences included *do not* include what's new since the last release. This is marginally better than present (locked at 2.32.0). Being Eager would mean getting what's at Beam Repo Head, which will include the release being built, but be at risk of diffs since the cut.
> The first PR is to stopgap into getting us to Be Eager which given the rate of change to the boot loaders, to be more accurate.
> The ideal would be to plumb the current release tag being built (or at least the short commit ID) so we can get the precise version of the code being built for licenses. This Jira is to track that fix.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)