This is an automated email from the ASF dual-hosted git repository.
He-Pin pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/pekko.git
The following commit(s) were added to refs/heads/main by this push:
new 2c5fb62d8a fix: validate legal files in packaged jars (#3328)
2c5fb62d8a is described below
commit 2c5fb62d8a6b397ae30fee6424b7f61c7a2d2587
Author: He-Pin(kerr) <[email protected]>
AuthorDate: Tue Jul 14 00:58:36 2026 +0800
fix: validate legal files in packaged jars (#3328)
Motivation:
Published jars can silently omit required META-INF legal files, and the
protobuf-v3 assembly needs explicit merge handling.
Modification:
Merge legal resources in the protobuf-v3 assembly and add a validation task
for every published project.
Result:
Published package and assembly jars are checked for META-INF/LICENSE and
META-INF/NOTICE.
Tests:
- sbt "actor / Compile / checkPackageBinMetaInfLegalFiles" "protobuf-v3 /
Compile / checkPackageBinMetaInfLegalFiles" (pass)
- sbt headerCreateAll "+headerCheckAll" scalafmtCheckAll scalafmtSbtCheck
(pass)
- scalafmt --list --mode diff-ref=origin/main (pass)
- git diff --check (pass)
- validatePullRequest not run per user request
References:
Fixes #1470
---
build.sbt | 5 +++++
project/AddMetaInfLicenseFiles.scala | 37 +++++++++++++++++++++++++++++++++++-
project/ValidatePullRequest.scala | 9 +++++++++
3 files changed, 50 insertions(+), 1 deletion(-)
diff --git a/build.sbt b/build.sbt
index 4af38b5c57..b283f1f66e 100644
--- a/build.sbt
+++ b/build.sbt
@@ -381,6 +381,11 @@ lazy val protobufV3 = pekkoModule("protobuf-v3")
// https://github.com/sbt/sbt-assembly/issues/400
.inLibrary(Dependencies.Compile.Provided.protobufRuntime)
.inProject),
+ assembly / assemblyMergeStrategy := {
+ case "META-INF/LICENSE" | "META-INF/NOTICE" =>
sbtassembly.MergeStrategy.concat
+ case "META-INF/COPYING.protobuf" =>
sbtassembly.MergeStrategy.first
+ case path => (assembly /
assemblyMergeStrategy).value(path)
+ },
assembly / assemblyOption := (assembly /
assemblyOption).value.withIncludeScala(false).withIncludeBin(true),
autoScalaLibrary := false, // do not include scala dependency in pom
exportJars := true, // in dependent projects, use assembled and shaded jar
diff --git a/project/AddMetaInfLicenseFiles.scala
b/project/AddMetaInfLicenseFiles.scala
index 77458d9afd..287f457f6e 100644
--- a/project/AddMetaInfLicenseFiles.scala
+++ b/project/AddMetaInfLicenseFiles.scala
@@ -25,11 +25,40 @@ import
org.mdedetrich.apache.sonatype.ApacheSonatypePlugin.autoImport._
*/
object AddMetaInfLicenseFiles extends AutoPlugin {
+ object autoImport {
+ lazy val checkPackageBinMetaInfLegalFiles =
+ taskKey[Unit]("Checks that packaged jars contain META-INF/LICENSE and
META-INF/NOTICE files.")
+ }
+
+ import autoImport._
+
private lazy val baseDir = LocalRootProject / baseDirectory
+ private val requiredPackageBinEntries = Seq("META-INF/LICENSE",
"META-INF/NOTICE")
+
override lazy val projectSettings = Seq(
apacheSonatypeLicenseFile := baseDir.value / "legal" /
"StandardLicense.txt",
- apacheSonatypeNoticeFile := baseDir.value / "legal" / "PekkoNotice.txt")
+ apacheSonatypeNoticeFile := baseDir.value / "legal" / "PekkoNotice.txt",
+ Compile / checkPackageBinMetaInfLegalFiles := Def.taskDyn {
+ if ((publish / skip).value) {
+ Def.task {
+ streams.value.log.debug("Skipping META-INF legal files check for
non-published project.")
+ }
+ } else {
+ Def.task {
+ val packageBinJar = (Compile / packageBin).value
+ val publishedJar = (Compile / packageBin / packagedArtifact).value._2
+ val missingEntries = Seq(packageBinJar,
publishedJar).distinct.flatMap { jar =>
+ missingPackageBinEntries(jar).map(entry =>
s"${jar.getAbsolutePath}: $entry")
+ }
+
+ if (missingEntries.nonEmpty) {
+ throw new MessageOnlyException(
+ "Packaged jars are missing required META-INF legal files:\n" +
missingEntries.mkString("\n"))
+ }
+ }
+ }
+ }.value)
/**
* Settings specific for Pekko actor subproject which requires a different
license file.
@@ -80,4 +109,10 @@ object AddMetaInfLicenseFiles extends AutoPlugin {
override lazy val trigger = allRequirements
override lazy val requires = ApacheSonatypePlugin
+
+ private def missingPackageBinEntries(jar: File): Seq[String] = {
+ val zip = new java.util.zip.ZipFile(jar)
+ try requiredPackageBinEntries.filter(entry => zip.getEntry(entry) == null)
+ finally zip.close()
+ }
}
diff --git a/project/ValidatePullRequest.scala
b/project/ValidatePullRequest.scala
index 246e98b6f3..2f13a5029c 100644
--- a/project/ValidatePullRequest.scala
+++ b/project/ValidatePullRequest.scala
@@ -124,3 +124,12 @@ object UnidocWithPrValidation extends AutoPlugin {
override lazy val trigger = noTrigger
override lazy val projectSettings = Seq(additionalTasks += Compile / unidoc)
}
+
+object MetaInfLicenseFilesWithPrValidation extends AutoPlugin {
+ import AddMetaInfLicenseFiles.autoImport._
+ import PekkoValidatePullRequest._
+
+ override lazy val trigger = allRequirements
+ override lazy val requires = PekkoValidatePullRequest &&
AddMetaInfLicenseFiles
+ override lazy val projectSettings = Seq(additionalTasks += Compile /
checkPackageBinMetaInfLegalFiles)
+}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
