janhoy opened a new pull request, #4793: URL: https://github.com/apache/solr/pull/4793
https://issues.apache.org/jira/browse/SOLR-15465 The build required a `.sha1`, `-LICENSE-*.txt` and (usually) `-NOTICE.txt` file in `solr/licenses/` for **every** dependency of every project, including test-only and compile-only ones — 429 sha1 files while only ~330 jars actually ship. Per ASF policy, LICENSE/NOTICE is only needed for what we distribute. As discussed in the JIRA, `.sha1` checksums are kept for **all** dependencies since they validate the binaries downloaded from Maven. ## Approach The shipped jar set is derived deterministically from the same build wiring that assembles the full binary distribution, rather than a hand-maintained list: - **`isDistShippingProject`** in `gradle/validation/jar-checks.gradle`: `:solr:server` (its `runtimeClasspath` + `start.jar` covers `server/lib`, `lib/ext` and the webapp's `WEB-INF/lib`) plus every `:solr:modules:*` and `:solr:cross-dc-manager` (whose `lib/` folders are built from their runtime deps). New modules are covered automatically. - A new unresolvable `distJarValidation` configuration collects each shipping project's runtime deps (no `gradle.lockfile` churn). `validateJarLicenses` filters against the **global** union of these sets, since a platform jar like lucene-core is validated in `:solr:core` but ships via `:solr:server`. - `validateJarChecksums` and `updateLicenses` are unchanged (sha1 for everything). - `checkDanglingLicenseFiles` is upgraded from a warning to a build failure, so `solr/licenses/` stays exact. The 91 LICENSE/NOTICE files it flagged as unreferenced (mockito, selenium, junit, testcontainers, s3mock/spring, …) are deleted — the list was computed by the check itself, so shared-prefix files (curator, lucene, zookeeper, jetty) survive. ## Distribution bug found while verifying Cross-checking the computed set against an actual `installFullDist` output revealed the dist shipped 5 jars at versions that were never tested or validated (e.g. cuvs: lucene-backward-codecs 10.2.0 vs 10.4.0, gcs-repository: jackson 2.18.3 vs 2.22.0): the `copyRecursive` copy in `assemblePackaging` does not inherit consistent resolution. Fixed with `alignWithRuntimeClasspath(externalLibs)` in `gradle/solr/packaging.gradle`. Every jar in the dist now has a matching sha1 and exactly one LICENSE file. Related: SOLR-15929 (per-distribution LICENSE/NOTICE files) is deliberately **not** part of this PR, but can reuse the shipping-project predicate and per-project shipped-jar sets introduced here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
