slachiewicz commented on code in PR #898: URL: https://github.com/apache/incubator-xtable/pull/898#discussion_r3950980259
########## release/license/bundled/supplemental-models.xml: ########## @@ -0,0 +1,329 @@ +<?xml version="1.0" encoding="UTF-8"?> Review Comment: No, it's hand-maintained, and deliberately so. It holds the facts Maven can't derive: the artifacts whose POM omits or misstates `<licenses>` or `<organization>`. Generating it would mean deriving those from the same POMs that are wrong. The split is that `generate_shaded_license_metadata.py`, already on `main`, generates the `LICENSE-bundled` and `NOTICE-bundled` texts by reading POMs and jars; `supplemental-models.xml` is the correction table it reads. HBase's `hbase-resource-bundle` supplemental file is curated the same way. Drift is the fair objection. I can add a check that fails the build when the shade whitelist gains an artifact that has neither license metadata in its POM nor an entry here, so a new dependency can't slip through silently. Want that in this PR or a follow-up? *This comment was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
