This is an automated email from the ASF dual-hosted git repository.
lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git
The following commit(s) were added to refs/heads/rocketmq-studio by this push:
new 6c9f74a79 chore(deploy): let a test-machine deploy opt out of the
release license gate (#6345)
6c9f74a79 is described below
commit 6c9f74a793641c15ef4ff0c2a4934408fdb79bd9
Author: lizhimins <[email protected]>
AuthorDate: Mon Oct 12 17:35:00 2026 +0800
chore(deploy): let a test-machine deploy opt out of the release license
gate (#6345)
`server/pom.xml`'s `binary-license-gate` runs `scripts/legal.py jar` over
the repackaged fat JAR and requires every bundled dependency to carry its
upstream LICENSE text. It currently fails on **164 artifacts** (`spring-ai-*`,
`swagger-ui`, `tencentcloud-sdk-java-*`, `zstd-jni`, `webjars-locator-lite`,
`HdrHistogram`, ...):
```
[exec] spring-ai-mcp-2.0.0.jar: missing complete upstream LICENSE/COPYING;
a POM name or link is not a substitute
```
`server/Dockerfile` then re-checks the same thing at image build time
(`legal.py check-jar`). The result is that neither `mvn package` nor `docker
build` can complete on trunk, which blocks deploying **unrelated** source
changes to a test machine — that is how this was found: a deploy of 32 merged
community PRs could not produce an image.
Fixing the gate itself is real release work (collecting 164 license texts,
or teaching `legal.py` which of them are already covered by our own Apache-2.0
text) and is tracked separately. This change only makes the gate *switchable*,
so a deploy is not held hostage by it:
- `ARG LEGAL_GATE=1` around both `check-jar` runs. **The default is
unchanged** — a release build still runs the gate. At `LEGAL_GATE=0` the step
prints `LEGAL_GATE=0: skipping the embedded-license check; this image is not a
release artifact` rather than failing, so a mis-published image is traceable
from its build log.
- `MAVEN_ARGS` / `LEGAL_GATE` in `deploy/deploy.sh`, both read from
`deploy/.env` (environment specific, not tracked). `mvn` arguments were
previously hardcoded, so there was no way to pass anything through.
`maven-antrun-plugin` has exactly one execution in `server/pom.xml`
(`binary-license-gate`), so `-Dmaven.antrun.skip=true` is precise and does not
silently disable another step.
The two switches have to be flipped together, which the deploy.sh comment
now states: the JAR's `META-INF/legal` materials are *produced* by the maven
step, so skipping only that one turns "164 jars non-compliant" into "JAR is
missing legal materials" at `check-jar`. That was a real dead end hit while
testing this.
Verified: `LEGAL_GATE` default expands to `if [ "1" = "1" ]` (gate runs)
and `--build-arg LEGAL_GATE=0` to the skip branch, in both the
`runtime-prebuilt` and `runtime` stages; a full `deploy.sh all` with both
switches off produced a healthy image (see #6344 for the startup fix that
deploy also needed).
---
deploy/deploy.sh | 13 +++++++++++--
server/Dockerfile | 28 ++++++++++++++++++++++++----
2 files changed, 35 insertions(+), 6 deletions(-)
diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 0020d7157..9f7d10038 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -29,6 +29,15 @@ REMOTE="${REMOTE_USER:-root}@$REMOTE_HOST"
REMOTE_PATH="${REMOTE_PATH:-/opt/rocketmq-studio}"
PUBLIC_PORT="${PUBLIC_PORT:-6789}"
MAVEN_IMAGE="${MAVEN_IMAGE:-maven:3.9.16-eclipse-temurin-21}"
+# 额外的 mvn 参数，环境专属，配在 deploy/.env 里（未入库）。
+# 例：MAVEN_ARGS=-Dmaven.antrun.skip=true 跳过 server/pom.xml 的
binary-license-gate。antrun 在 pom 里
+# 只有这一个 execution，所以跳过是精确的。该门禁要求 fat jar 里每个三方依赖都自带上游 LICENSE 全文，
+# 主干目前有 164 个 jar 过不了；它检查的是发布产物的合法性，与「把当前源码部署到测试机看效果」无关。
+MAVEN_ARGS="${MAVEN_ARGS:-}"
+# 传给 server/Dockerfile 的 LEGAL_GATE（默认 1 = 跑镜像里的 check-jar）。
+# 跳过上面那道 maven 门禁时必须同时关掉这道：jar 里的 META-INF/legal 素材正是被跳过的那一步生成的，
+# 只跳一边会从「164 个 jar 不合规」变成「jar 缺 legal 素材」。
+LEGAL_GATE="${LEGAL_GATE:-1}"
SRC_TAR="/tmp/rocketmq-studio-src.tar.gz"
TARGET="${1:-all}" # all | server | web
@@ -93,11 +102,11 @@ build_server() {
--user \$(id -u):\$(id -g) \
-v \$PWD/server:/app -v \$HOME/.m2:/maven-cache -w /app \
$MAVEN_IMAGE \
- mvn -B -ntp $settings_flag -Dmaven.repo.local=/maven-cache/repository
package -DskipTests"
+ mvn -B -ntp $settings_flag $MAVEN_ARGS
-Dmaven.repo.local=/maven-cache/repository package -DskipTests"
info "🏗️ 构建 rocketmq-server 镜像（runtime-prebuilt）..."
# 构建上下文由 server/ 扩到仓库根目录：Dockerfile 的 rmqctl Go 阶段需要 COPY rmqctl/，
# 让镜像自带 /usr/local/bin/rmqctl（AI 后端以 `rmqctl mcp stdio` 拉起 MCP server）。
- run_remote "cd $REMOTE_PATH && docker build --target runtime-prebuilt -f
server/Dockerfile -t rocketmq-server:latest ."
+ run_remote "cd $REMOTE_PATH && docker build --build-arg
LEGAL_GATE=$LEGAL_GATE --target runtime-prebuilt -f server/Dockerfile -t
rocketmq-server:latest ."
log "rocketmq-server 镜像构建完成"
}
diff --git a/server/Dockerfile b/server/Dockerfile
index 208f95c31..e42ef3ab8 100644
--- a/server/Dockerfile
+++ b/server/Dockerfile
@@ -106,8 +106,18 @@ ENTRYPOINT ["java", "-cp", "app.jar",
"-Dloader.path=/app/lib", \
# Expects server/target/*.jar to exist before docker build.
FROM runtime-base AS runtime-prebuilt
COPY server/target/*.jar app.jar
-RUN python3 /opt/studio-legal/scripts/legal.py check-jar /app/app.jar \
- --output /usr/share/licenses/rocketmq-studio
+ARG LEGAL_GATE=1
+# LEGAL_GATE=0 turns the embedded-license check into a notice. It defaults to
on, so a release build
+# always runs it. The gate currently fails on trunk — 164 bundled dependency
jars carry no upstream
+# LICENSE text inside the artifact and legal.py has no allowlist — which is
release paperwork, not a
+# reason to block deploying the same source to a test machine. An image built
with LEGAL_GATE=0 is
+# not a release artifact and must not be published as one.
+RUN if [ "$LEGAL_GATE" = "1" ]; then \
+ python3 /opt/studio-legal/scripts/legal.py check-jar /app/app.jar \
+ --output /usr/share/licenses/rocketmq-studio; \
+ else \
+ echo "LEGAL_GATE=0: skipping the embedded-license check; this image is
not a release artifact"; \
+ fi
#
------------------------------------------------------------------------------
# Stage 3b: build — Maven compile inside Docker (CI / docker compose default)
@@ -146,5 +156,15 @@ RUN mvn package -DskipTests
#
------------------------------------------------------------------------------
FROM runtime-base AS runtime
COPY --from=build /app/target/*.jar app.jar
-RUN python3 /opt/studio-legal/scripts/legal.py check-jar /app/app.jar \
- --output /usr/share/licenses/rocketmq-studio
+ARG LEGAL_GATE=1
+# LEGAL_GATE=0 turns the embedded-license check into a notice. It defaults to
on, so a release build
+# always runs it. The gate currently fails on trunk — 164 bundled dependency
jars carry no upstream
+# LICENSE text inside the artifact and legal.py has no allowlist — which is
release paperwork, not a
+# reason to block deploying the same source to a test machine. An image built
with LEGAL_GATE=0 is
+# not a release artifact and must not be published as one.
+RUN if [ "$LEGAL_GATE" = "1" ]; then \
+ python3 /opt/studio-legal/scripts/legal.py check-jar /app/app.jar \
+ --output /usr/share/licenses/rocketmq-studio; \
+ else \
+ echo "LEGAL_GATE=0: skipping the embedded-license check; this image is
not a release artifact"; \
+ fi
