Aman-Mittal opened a new pull request, #352: URL: https://github.com/apache/fineract-backoffice-ui/pull/352
An ASF release-compliance audit of `main` (`bc342535`) turned up three licence problems, two of which would block a release candidate. This fixes them and closes the gap in the checks that let them through. ## 1. `NOTICE` was missing entirely — release blocker ASF release policy requires `LICENSE` **and** `NOTICE` in every distribution. There was no `NOTICE` anywhere in the repository, tracked or untracked. The project's copyright statement lived only in `README.md:184` and in the filled-in appendix of `LICENSE:189`, neither of which is a substitute. Added with the standard ASF content. **The PMC should confirm the copyright year at release time** — I used 2025 to match what the repository already asserts rather than invent a range. > <https://www.apache.org/legal/release-policy.html>, <https://infra.apache.org/licensing-howto.html> ## 2. Six e2e specs carried a spliced Apache header — release blocker `e2e/{client,e2e-journey,feature-coverage,functional-coverage,login,reporting}.spec.ts` contained: ``` * with the License. See the NOTICE file BASIS, WITHOUT * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ``` The grant sentence, the licence URL and the `"AS IS"` opener were all gone. As they stood those files were effectively unlicensed. The header is restored **verbatim from a known-good file** in the repo rather than retyped. ### Why two independent controls both missed it This is the part worth reading. RAT never saw these files — `.rat-excludes` excluded `e2e/`. And `scripts/check-license.sh`, which exists precisely to compensate (its own comment: *"e2e is included so new Playwright specs cannot ship without a header. Apache RAT excludes e2e/, so without this nothing enforces it there at all"*), tested only: ```sh grep -q "Licensed to the Apache Software Foundation" "$FILE" ``` The corrupted text still opens with that phrase, so all six passed. Two controls, one shared weakness. The check now also requires the licence URL and the `"AS IS"` clause. **Verified by re-introducing the exact corruption**, which now fails both gates: ``` Incomplete Apache License header (no licence URL) in e2e/login.spec.ts Found 1 files missing license headers/fields. → exit 1 RAT: Unapproved: 1 → exit 1 ``` It also asserts `LICENSE` and `NOTICE` both exist — nothing did before, which is why their absence went unnoticed. ## 3. RAT covered 610 of 2,336 tracked files `e2e/` (44 files), `DOCS/` and the three test-harness configs are no longer excluded, having been given headers where they lacked them. Coverage is now **665 files, 0 unapproved, exit 0**. Generated test output (`test-results/`, `playwright-report/`, `demo-recordings/`) is excluded instead — those are gitignored artifacts absent from a clean checkout, and their absence from the list made a *local* RAT run fail spuriously on files CI never sees. Every remaining exclusion now records why it is there. That includes `src/app/api/`, where the generator's own scaffolding (`configuration.ts`, `encoder.ts`, `variables.ts` and 9 others) is not covered by `templates/openapi-generator/licenseInfo.mustache`, because only that one template is overridden. Those 12 files are compiled into the distributed bundle without a header. **Left open deliberately** — the durable fix is vendoring the upstream templates or adding a post-generate step, which is a larger change than this PR should carry, and a hand-edit would be wiped by the next spec sync. ## 4. `.gitmodules` removed It declared a submodule pointing at `apache/fineract` with **no tracked gitlink** (`git ls-files -s | awk '$1=="160000"'` is empty) and no directory. It referenced nothing. ## Verification | Check | Result | |---|---| | Apache RAT 0.17 (`-E .rat-excludes`) | **665 approved, 0 unapproved, exit 0** (was 610 scanned) | | Files with the ASF phrase but no licence URL | **0** (was 6) | | `scripts/check-license.sh` | Clean; **proven to catch the original defect** | | Unit specs | 949/949 | | `lint` · `format:check` · `i18n:check` · `check:icons` · `build` | All clean | ## Still open (not in this PR) The audit raised items this PR does not address, two of which need a PMC decision rather than a patch: - **Third-party attribution in the built artifact.** `dist/3rdpartylicenses.txt` names 5 packages; the bundle demonstrably contains Angular (283 file references), `@ngx-translate` (232), `@ionic/core` (112), `rxjs` (54, Apache-2.0), `tslib`, `ionicons` — none attributed. Whether this blocks depends on **what the release artifact is**: source tarball only, or a convenience binary. - **The production build requires network access to `fonts.googleapis.com`** (Angular inlines the Inter `@font-face` CSS at build time). Offline, it fails: `Inlining of fonts failed … getaddrinfo EAI_AGAIN`. That is a release-reproducibility question. - **`[email protected]` is LGPL-3.0-only** (ASF Category X). Dev-only, never bundled, but named in `package.json`, which is in a source release. - The 12 unheadered generated scaffolding files described above. The full audit — including a 1,370-package dependency inventory (every one of the 31 runtime packages is Category A) and a clean secrets scan — is written up locally under `audit/` and deliberately **not** committed here, since it is a point-in-time record of `main` and several of its findings are closed by this PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
