slachiewicz opened a new issue, #322: URL: https://github.com/apache/maven-remote-resources-plugin/issues/322
#316 gives templates an SPDX ID per dependency (#319, #320, #321). ASF distributions need more than that to get LICENSE right, and this issue tracks the rest. The licensing how-to scopes LICENSE to what a distribution contains: "Do not add to LICENSE and NOTICE dependencies which are not in the distribution. Only bundled bits matter" ([licensing-howto](https://infra.apache.org/licensing-howto.html)). The plugin cannot see that set. `$projects` is the dependency list filtered by scope, so a thin jar lists runtime dependencies it does not bundle, and a shaded jar's `artifactSet` is invisible to it. Projects that check their LICENSE files therefore work from the built artifact, not from the dependency tree: - [Kafka `committer-tools/verify_license.py`](https://github.com/apache/kafka/blob/trunk/committer-tools/verify_license.py) compares the jars in the distribution with the entries in LICENSE. - [Pulsar `CheckBinaryLicenseTask.kt`](https://github.com/apache/pulsar/blob/master/build-logic/conventions/src/main/kotlin/CheckBinaryLicenseTask.kt) reports jars missing from LICENSE and LICENSE entries that are not bundled. - Flink reads the bundled set from the shade plugin's log ([`ShadeParser.java`](https://github.com/apache/flink/blob/master/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/utils/shade/ShadeParser.java)) and fails on forbidden license texts inside jars ([`JarFileChecker.java`](https://github.com/apache/flink/blob/master/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/licensecheck/JarFileChecker.java)). - Spark keeps headings per license family in [`LICENSE-binary`](https://github.com/apache/spark/blob/master/LICENSE-binary) with one text file per license in `licenses-binary/`. ## Plan Each item is its own PR, linked here. 1. **Declared bundled set.** Add a parameter that restricts `$projects` to the artifacts a module bundles, as `groupId:artifactId` patterns. Reading the shade plugin's `artifactSet` from the same module is the alternative; it saves configuration but ties this plugin to shade's model. 2. **Check goal.** Add a goal for the `verify` phase that fails when a bundled dependency has no preferred license or only a Category X one, and warns on Category B. It uses `$spdx.preferred` and `$spdx.category` from #321 and could also check that a rendered LICENSE names every bundled artifact. 3. **Headings and file names.** Add `$spdx.title($id)` for a heading such as "BSD 3-Clause License", and a stable file name per ID for templates that point at per-license text files. The texts stay with each project. 4. **ASF resource bundles.** Once a release contains #319 to #321, use `$spdx.preferred` in the `DEPENDENCIES` and LICENSE templates of apache/maven-apache-resources. NOTICE aggregation stays out of scope: the shade plugin's `ApacheNoticeResourceTransformer` already merges bundled NOTICE files. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
