You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@avro.apache.org by "kchenery (via GitHub)" <gi...@apache.org> on 2025/11/27 09:27:33 UTC
[PR] AVRO-4214: Ensure nuget packages expose license via SPDX expression [avro]
kchenery opened a new pull request, #3580:
URL: https://github.com/apache/avro/pull/3580
<!--
*Thank you very much for contributing to Apache Avro - we are happy that you want to help us improve Avro. To help the community review your contribution in the best possible way, please go through the checklist below, which will get the contribution into a shape in which it can be best reviewed.*
*Please understand that we do not do this to make contributions to Avro a hassle. In order to uphold a high standard of quality for code contributions, while at the same time managing a large number of contributions, we need contributors to prepare the contributions well, and give reviewers enough contextual information for the review. Please also understand that contributions that do not follow this guide will take longer to review and thus typically be picked up with lower priority by the community.*
## Contribution Checklist
- Make sure that the pull request corresponds to a [JIRA issue](https://issues.apache.org/jira/projects/AVRO/issues). Exceptions are made for typos in JavaDoc or documentation files, which need no JIRA issue.
- Name the pull request in the form "AVRO-XXXX: [component] Title of the pull request", where *AVRO-XXXX* should be replaced by the actual issue number.
The *component* is optional, but can help identify the correct reviewers faster: either the language ("java", "python") or subsystem such as "build" or "doc" are good candidates.
- Fill out the template below to describe the changes contributed by the pull request. That will give reviewers the context they need to do the review.
- Make sure that the change passes the automated tests. You can [build the entire project](https://github.com/apache/avro/blob/main/BUILD.md) or just the [language-specific SDK](https://avro.apache.org/project/how-to-contribute/#unit-tests).
- Each pull request should address only one issue, not mix up code from multiple issues.
- Each commit in the pull request has a meaningful commit message (including the JIRA id)
- Every commit message references Jira issues in their subject lines. In addition, commits follow the guidelines from [How to write a good git commit message](https://chris.beams.io/posts/git-commit/)
1. Subject is separated from body by a blank line
1. Subject is limited to 50 characters (not including Jira issue reference)
1. Subject does not end with a period
1. Subject uses the imperative mood ("add", not "adding")
1. Body wraps at 72 characters
1. Body explains "what" and "why", not "how"
-->
## What is the purpose of the change
Ensure that the C# nuget packages expose their license via SPDX expression
## Verifying this change
This change added tests and can be verified as follows:
- Added tests to teh Avro.test project that validate the nuget packages created
## Documentation
- Does this pull request introduce a new feature?
no
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AVRO-4214: [C#] Ensure nuget packages expose SPDX license expression [avro]
Posted by "martin-g (via GitHub)" <gi...@apache.org>.
martin-g merged PR #3580:
URL: https://github.com/apache/avro/pull/3580
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AVRO-4214: [C#] Ensure nuget packages expose SPDX license expression [avro]
Posted by "github-advanced-security[bot] (via GitHub)" <gi...@apache.org>.
github-advanced-security[bot] commented on code in PR #3580:
URL: https://github.com/apache/avro/pull/3580#discussion_r2568287985
##########
lang/csharp/src/apache/test/NuGetPackageTests.cs:
##########
@@ -0,0 +1,156 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+using System;
+using System.IO;
+using System.IO.Compression;
+using System.Linq;
+using System.Xml.Linq;
+using NUnit.Framework;
+
+namespace Avro.Test.Utils
+{
+ [TestFixture]
+ public class NuGetPackageTests
+ {
+ private static readonly string[] PackageIds = new[]
+ {
+ "Apache.Avro",
+ "Apache.Avro.Tools",
+ "Apache.Avro.File.Snappy",
+ "Apache.Avro.File.BZip2",
+ "Apache.Avro.File.XZ",
+ "Apache.Avro.File.Zstandard"
+ };
+
+ [TestCaseSource(nameof(PackageIds))]
+ public void PackageContainsSpdxLicenseExpression(string packageId)
+ {
+ var nupkgPath = FindPackageInBuildOutput(packageId);
+ if (nupkgPath == null)
+ {
+ Assert.Inconclusive($"Package {packageId} not found. Run 'dotnet pack --configuration Release' first.");
+ return;
+ }
+
+ var nuspecXml = ExtractNuspecFromPackage(nupkgPath);
+
+ // Get the namespace from the root element
+ var ns = nuspecXml.Root?.Name.Namespace ?? XNamespace.None;
+ var licenseElement = nuspecXml.Root?.Element(ns + "metadata")?.Element(ns + "license");
+
+ Assert.That(licenseElement, Is.Not.Null,
+ $"Package {packageId} does not contain a license element");
+
+ var licenseType = licenseElement?.Attribute("type")?.Value;
+ Assert.That(licenseType, Is.EqualTo("expression"),
+ $"Package {packageId} license type should be 'expression', but was '{licenseType}'");
+
+ var licenseValue = licenseElement?.Value;
+ Assert.That(licenseValue, Is.EqualTo("Apache-2.0"),
+ $"Package {packageId} should have SPDX license expression 'Apache-2.0', but was '{licenseValue}'");
+ }
+
+ [TestCaseSource(nameof(PackageIds))]
+ public void PackageContainsLicenseFile(string packageId)
+ {
+ var nupkgPath = FindPackageInBuildOutput(packageId);
+ if (nupkgPath == null)
+ {
+ Assert.Inconclusive($"Package {packageId} not found. Run 'dotnet pack --configuration Release' first.");
+ return;
+ }
+
+ using (var archive = ZipFile.OpenRead(nupkgPath))
+ {
+ var licenseEntry = archive.Entries.FirstOrDefault(e =>
+ e.FullName.Equals("LICENSE", StringComparison.OrdinalIgnoreCase));
+
+ Assert.That(licenseEntry, Is.Not.Null,
+ $"Package {packageId} does not contain LICENSE file");
+
+ Assert.That(licenseEntry.Length, Is.GreaterThan(0),
+ $"Package {packageId} LICENSE file is empty");
+ }
+ }
+
+ [TestCaseSource(nameof(PackageIds))]
+ public void PackageLicenseFileContainsApacheLicense(string packageId)
+ {
+ var nupkgPath = FindPackageInBuildOutput(packageId);
+ if (nupkgPath == null)
+ {
+ Assert.Inconclusive($"Package {packageId} not found. Run 'dotnet pack --configuration Release' first.");
+ return;
+ }
+
+ using (var archive = ZipFile.OpenRead(nupkgPath))
+ {
+ var licenseEntry = archive.Entries.FirstOrDefault(e =>
+ e.FullName.Equals("LICENSE", StringComparison.OrdinalIgnoreCase));
+
+ Assert.That(licenseEntry, Is.Not.Null);
+
+ using (var stream = licenseEntry.Open())
+ using (var reader = new StreamReader(stream))
+ {
+ var content = reader.ReadToEnd();
+ Assert.That(content, Does.Contain("Apache License"),
+ $"Package {packageId} LICENSE file does not contain Apache License text");
+ Assert.That(content, Does.Contain("Version 2.0"),
+ $"Package {packageId} LICENSE file does not specify Version 2.0");
+ }
+ }
+ }
+
+ private string FindPackageInBuildOutput(string packageId)
+ {
+ // Find the lang/csharp root (4 levels up from test binary directory: bin/Release/net8.0 -> test -> apache -> src -> csharp)
+ var testDir = TestContext.CurrentContext.TestDirectory;
+ var csharpRoot = Path.GetFullPath(Path.Combine(testDir, "..", "..", "..", "..", ".."));
Review Comment:
## Call to System.IO.Path.Combine
Call to 'System.IO.Path.Combine'.
[Show more details](https://github.com/apache/avro/security/code-scanning/3356)
##########
lang/csharp/src/apache/test/NuGetPackageTests.cs:
##########
@@ -0,0 +1,156 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+using System;
+using System.IO;
+using System.IO.Compression;
+using System.Linq;
+using System.Xml.Linq;
+using NUnit.Framework;
+
+namespace Avro.Test.Utils
+{
+ [TestFixture]
+ public class NuGetPackageTests
+ {
+ private static readonly string[] PackageIds = new[]
+ {
+ "Apache.Avro",
+ "Apache.Avro.Tools",
+ "Apache.Avro.File.Snappy",
+ "Apache.Avro.File.BZip2",
+ "Apache.Avro.File.XZ",
+ "Apache.Avro.File.Zstandard"
+ };
+
+ [TestCaseSource(nameof(PackageIds))]
+ public void PackageContainsSpdxLicenseExpression(string packageId)
+ {
+ var nupkgPath = FindPackageInBuildOutput(packageId);
+ if (nupkgPath == null)
+ {
+ Assert.Inconclusive($"Package {packageId} not found. Run 'dotnet pack --configuration Release' first.");
+ return;
+ }
+
+ var nuspecXml = ExtractNuspecFromPackage(nupkgPath);
+
+ // Get the namespace from the root element
+ var ns = nuspecXml.Root?.Name.Namespace ?? XNamespace.None;
+ var licenseElement = nuspecXml.Root?.Element(ns + "metadata")?.Element(ns + "license");
+
+ Assert.That(licenseElement, Is.Not.Null,
+ $"Package {packageId} does not contain a license element");
+
+ var licenseType = licenseElement?.Attribute("type")?.Value;
+ Assert.That(licenseType, Is.EqualTo("expression"),
+ $"Package {packageId} license type should be 'expression', but was '{licenseType}'");
+
+ var licenseValue = licenseElement?.Value;
+ Assert.That(licenseValue, Is.EqualTo("Apache-2.0"),
+ $"Package {packageId} should have SPDX license expression 'Apache-2.0', but was '{licenseValue}'");
+ }
+
+ [TestCaseSource(nameof(PackageIds))]
+ public void PackageContainsLicenseFile(string packageId)
+ {
+ var nupkgPath = FindPackageInBuildOutput(packageId);
+ if (nupkgPath == null)
+ {
+ Assert.Inconclusive($"Package {packageId} not found. Run 'dotnet pack --configuration Release' first.");
+ return;
+ }
+
+ using (var archive = ZipFile.OpenRead(nupkgPath))
+ {
+ var licenseEntry = archive.Entries.FirstOrDefault(e =>
+ e.FullName.Equals("LICENSE", StringComparison.OrdinalIgnoreCase));
+
+ Assert.That(licenseEntry, Is.Not.Null,
+ $"Package {packageId} does not contain LICENSE file");
+
+ Assert.That(licenseEntry.Length, Is.GreaterThan(0),
+ $"Package {packageId} LICENSE file is empty");
+ }
+ }
+
+ [TestCaseSource(nameof(PackageIds))]
+ public void PackageLicenseFileContainsApacheLicense(string packageId)
+ {
+ var nupkgPath = FindPackageInBuildOutput(packageId);
+ if (nupkgPath == null)
+ {
+ Assert.Inconclusive($"Package {packageId} not found. Run 'dotnet pack --configuration Release' first.");
+ return;
+ }
+
+ using (var archive = ZipFile.OpenRead(nupkgPath))
+ {
+ var licenseEntry = archive.Entries.FirstOrDefault(e =>
+ e.FullName.Equals("LICENSE", StringComparison.OrdinalIgnoreCase));
+
+ Assert.That(licenseEntry, Is.Not.Null);
+
+ using (var stream = licenseEntry.Open())
+ using (var reader = new StreamReader(stream))
+ {
+ var content = reader.ReadToEnd();
+ Assert.That(content, Does.Contain("Apache License"),
+ $"Package {packageId} LICENSE file does not contain Apache License text");
+ Assert.That(content, Does.Contain("Version 2.0"),
+ $"Package {packageId} LICENSE file does not specify Version 2.0");
+ }
+ }
+ }
+
+ private string FindPackageInBuildOutput(string packageId)
+ {
+ // Find the lang/csharp root (4 levels up from test binary directory: bin/Release/net8.0 -> test -> apache -> src -> csharp)
+ var testDir = TestContext.CurrentContext.TestDirectory;
+ var csharpRoot = Path.GetFullPath(Path.Combine(testDir, "..", "..", "..", "..", ".."));
+
+ // Search for the package in Release output directories
+ var pattern = $"{packageId}.*.nupkg";
+ var files = Directory.GetFiles(csharpRoot, pattern, SearchOption.AllDirectories)
+ .Where(f => f.Contains($"{Path.DirectorySeparatorChar}Release{Path.DirectorySeparatorChar}"))
+ .OrderByDescending(f => System.IO.File.GetLastWriteTime(f))
+ .ToArray();
+
+ return files.Length > 0 ? files[0] : null;
+ }
+
+ private XDocument ExtractNuspecFromPackage(string nupkgPath)
+ {
+ using (var archive = ZipFile.OpenRead(nupkgPath))
+ {
+ var nuspecEntry = archive.Entries.FirstOrDefault(e =>
+ e.FullName.EndsWith(".nuspec", StringComparison.OrdinalIgnoreCase));
+
+ if (nuspecEntry == null)
+ {
+ Assert.Fail($"No .nuspec file found in package: {nupkgPath}");
+ }
+
+ using (var stream = nuspecEntry.Open())
Review Comment:
## Dereferenced variable may be null
Variable [nuspecEntry](1) may be null at this access as suggested by [this](2) null check.
[Show more details](https://github.com/apache/avro/security/code-scanning/3357)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AVRO-4214: [C#] Ensure nuget packages expose SPDX license expression [avro]
Posted by "martin-g (via GitHub)" <gi...@apache.org>.
martin-g commented on PR #3580:
URL: https://github.com/apache/avro/pull/3580#issuecomment-3596899458
Thank you, @kchenery !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org