amaechler opened a new pull request, #20791:
URL: https://github.com/apache/druid/pull/20791
### Description
`refresh-license-versions.py` only reported libraries that appear in no
dependency report when the entry's version was moving, so an entry whose
version is already current but still lists a library that no module ships
passed silently. For example, #20771 switches every module from `fastutil-core`
to `fastutil` but leaves `it.unimi.dsi: fastutil-core` in the fastutil entry;
`check-licenses.py` only counts it among the unchecked licenses, and
`generate-binary-license.py` would keep listing it in LICENSE.BINARY. The
script now also flags an entry whose version did not move when at least one of
its libraries ships at the entry's version and others appear in no report.
- Entries where no library is reported at all, or where no library ships at
the entry's version, are not flagged. The whole entry is stale there, and
`check-licenses.py` already lists it as unchecked.
- On current master the script flags 9 entries, so it exits 1 until they are
fixed. Removing the 8 stale lines is left to a follow-up PR.
- Brotli4j is a known false positive. brotli4j picks its native jar through
OS-activated Maven profiles, so a dependency report only lists the native for
the build host, and the other 9 natives always look unreported. The script
already flagged this entry on every Brotli4j version bump; it now also flags it
when the version did not move. Declaring all natives in the ORC pom would fix
it, but adds about 6 MB to the ORC extension for a rarely used codec, so this
PR leaves it as is.
<details>
<summary>Measurements on master (ed5d8a7c2c)</summary>
Reports generated with `generate-license-dependency-reports.py` on macOS
arm64, and again with Maven's OS detection set to Linux amd64 to match the
GitHub Actions runner. Both give the same counts; only the Brotli4j native list
differs.
- Before: 0 entries need a manual edit. After: 9.
- `check-licenses.py`: 144 unchecked licenses, unchanged.
- Flagged:
- AWS SDK for Java (java-core): aws-java-sdk-ec2, -kms, -s3, -kinesis, -rds
- kubernetes official java client: client-java-proto
- org.bouncycastle bcprov-jdk18on: bcprov-ext-jdk18on
- RoaringBitmap: shims
- Kafka-schema-registry-client: io.confluent:common-config
- Apache Parquet: parquet-avro
- ASM: asm-analysis
- grpc-io: grpc-grpclib
- Brotli4j: the 9 native jars for platforms other than the build host
(false positive)
- Not flagged, left to `check-licenses.py`: 6 entries where nothing ships at
the entry's version (Kerby 1.0.1, Hadoop shaded 1.1.1, Jetbrains 1.8.21,
Kinesis Client Library 1.12.3, swagger-annotations 2.1.10 twice) and 26 entries
where every library is unreported.
</details>
<hr>
This PR has:
- [x] been self-reviewed.
- [x] added unit tests or modified existing tests to cover new code paths.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
