EmryZhang opened a new pull request, #532: URL: https://github.com/apache/casbin-jcasbin/pull/532
The current 1.100.0 preparation still leaves incomplete incubation display, generated-documentation licensing, and a source-provenance concern in `Glob.java`. This consolidates the corrections into one follow-up to the already merged #531. Please resolve the review items below before merging; this PR does not establish release approval. ### Changes - Put the complete incubation disclaimer in README, Maven metadata, generated RC/final notes and API documentation; correct project/SCM metadata. - Propose ASF contribution headers for 114 Java files while preserving all eight original copyright sentences in `NOTICE`. Their code bodies are unchanged. Handle `Glob.java` separately as described below. - Generate Javadoc with JDK 25 while retaining Java 8 compilation/tests. Package complete applicable Apache-2.0, UPL and jQuery/jQuery UI MIT texts, preserve resource headers, and verify actual resources and visible disclaimers in CI and before Maven publication. - Replace the glob translator with a differently structured implementation of the same public interface and add 51 test cases. Matching behavior is covered; exact generated regex strings and exception wording/positions can change. - Update legacy CI Actions, use the Java 8 TestNG security-fix release 7.5.1, and override the inherited Enforcer 1.0 with 3.6.3. Preserve final-release verification of promoted ASF originals and refusal to overwrite an existing GitHub release. ### Review before merge 1. **Glob provenance and replacement.** The implementation introduced in #126 substantially matches [OpenJDK Globs at a fixed revision](https://github.com/openjdk/jdk8u/blob/fe008ae27a7fe6b5ceb3ab903c2b3302767ce1b7/jdk/src/share/classes/sun/nio/fs/Globs.java), whose header states GPL-2.0 with the Classpath exception, while the existing JCasbin file has an Apache-2.0 header. The public introduction discussion does not establish a separate license grant. Please review the origin and appropriate disposition, including whether this replacement is acceptable. A rewrite and passing tests alone do not prove independent legal clearance. The published `org.casbin:jcasbin:1.99.0` sources contain the same old implementation; the external dependency in [JDBC #97](https://github.com/apache/casbin-jcasbin-jdbc-adapter/pull/97) also needs an agreed disposition before that PR merges. 2. **Copyright relocation.** Please have the rights holder or authorized agent confirm moving the existing notices into `NOTICE`, or identify existing authorization, under the [ASF source-header policy](https://www.apache.org/legal/src-headers.html). The proposal preserves the original wording; a RAT result is not that authorization. 3. **Maven compatibility.** This proposes retaining `org.casbin:jcasbin`. Please record the compatibility disposition against the [Incubator Maven guidance](https://incubator.apache.org/guides/distribution.html#maven-distribution), including any additional decision required. No prior IPMC exception is claimed. ### Validation - Fresh extracted-source Java 8u504 / Maven 3.9.16 build: 317 tests passed, then another 317 executions during coverage, with no failures/errors/skips. The final notice-only correction was repackaged; all 96 production class files remained byte-identical to the tested build. - Both source archive formats match all 220 Git files. RAT 0.18 accounts for 215 standard files, four notice/license files and one binary project logo, with no custom exclusions. The logo was reviewed separately; RAT does not establish provenance clearance. - Inspected main, sources and Javadoc JAR contents, Java 8 bytecode, source correspondence, packaged legal texts and all substantive documentation pages. Six deliberately invalid Javadoc packages were rejected. - Eleven source-release verifier tests passed with mocked GPG/network. Three workflows passed actionlint; Bash fixtures exercised actual metadata, archive generation, RC/final notes and no-overwrite behavior. A local finite corpus of 55,161 old/new glob comparisons found no matching/invalid-pattern differences. - The resolved 21 runtime/test dependencies and 43 actual Javadoc tool artifacts had no OSV matches at the check time. Other external build tools retain recorded advisories; they are not bundled in the library, and this is not a claim of a vulnerability-free toolchain. Legacy Cobertura complexity-parser warnings remain; test and coverage-report generation succeeded. Local documentation used Oracle JDK 25; hosted CI uses Temurin 25 and must run on this PR. No real signing, staging, registry publication or release vote was performed. Subsequent corrections should stay in this PR before merge; RC preparation follows only after the outstanding source decisions are resolved and the merged candidate is verified. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
