rangareddy commented on PR #857: URL: https://github.com/apache/incubator-xtable/pull/857#issuecomment-5212554414
Thanks — I reproduced all of your numbers exactly (51/25/9050/2681/6369, the CDDL 759×8, and 653 lines of code), and both description defects were real. Fixed in `71436f4`: - Description rewritten, 92 → 48 lines. The `javolution` open item is gone (the `ARTIFACT_OVERRIDES` entry does resolve it) and the count now reads 20, not 21 — 21 predated removing the `xml-apis` override, which moved it into the Apache family. - Shared boilerplate is committed once under `license_overrides/shared/`: the CDDL text was there four times, now one file, **−2,277 lines**. Source layout only — each artifact still ships its own `LICENSE-<artifactId>` byte for byte, verified before/after. - Left the `LICENSE-CDDL-1.1` naming alone, since you're right that it changes the published layout and should be agreed first. Gates: rat pass, validator exit 0 (6 OK, no FAIL), generator idempotent. I also built and ran #885 rather than just reading it. Four things worth knowing before choosing between them: 1. **It cannot see a dependency that is bundled but absent from the listing.** I removed `javolution:javolution:5.5.1` from a jar's `META-INF/LICENSE` while leaving its 305 classes in place — the check reports nothing. It validates texts *for listed coordinates*, so something still has to guarantee the listing is complete. 2. **`groovy-all:2.4.11` ships its own `META-INF/licenses/*.txt`** (antlr2, asm, jline2, jsr223, normalize-stylesheet) into the same directory. Those are permanent false orphans — not fixable by curation. It's #701 territory. 3. **`M2` is hardcoded to `~/.m2`.** The same `xtable-aws` jar reports OK (5 deps) normally and FAILs with 5 false orphans under a different local repo, so `-Dmaven.repo.local` — what a release manager uses for clean-room RC verification — breaks it. An unresolvable dependency is skipped for *missing* but counted as *orphaned*. 4. No skip list, so it validated the unpublished `xtable-utilities` bundle; and its CI step runs `package` without `clean`, which I hit locally — it validated a two-day-old jar. None of that is fatal, and the approach genuinely finds things mine misses: on #857 alone it flags 7 stale texts (`activation`, `asm*`, `commons-el`, `mail`, `oro`) that the tree-based check cannot see. With #880 applied it comes down to just the five groovy files. **And it caught a real bug in #880, which I'd rather you knew now**: reconciling `<includes>` to the runtime tree takes hive-metastore from 165 to 260 bundled artifacts (~131 MB → 193 MB) and *drops* `io.airlift:aircompressor`, because shade bundles the compile classpath while `dependency:tree -Dscope=runtime` does not list it. The jar still bundles 401 ORC classes that reference `io/airlift/compress/lzo/LzoDecompressor`, so #880 as written would ship ORC with a missing codec. That makes the includes-equals-runtime-tree rule in AGENTS.md unsound, and is a point in favour of reading the artifact. I'll fix #880 before it goes up. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
