ascheman opened a new issue, #78:
URL: https://github.com/apache/tooling-atr-maven-plugin/issues/78

   ### Context
   
   When verifying release candidates via ATR, the RAT check runs its own 
`apache-rat 0.18` with the standard exclude sets but has no knowledge of a 
project's `apache-rat-plugin` configuration. Files a project deliberately 
excludes therefore surface as "unknown license" false positives — e.g. on the 
Maven Resolver Ant Tasks 1.6.1 RC, 
`src/test/resources/ProjectWorkspaceReader/dummy-file.txt` and 
`.../ant/Resolve/dependencies.txt` (both covered by the project's 
`src/test/resources/**/*.txt` exclude; the project's own `apache-rat:check` is 
green with 0 unknown).
   
   Discussed on dev@tooling: 
https://lists.apache.org/thread/1ks8dbdxr2smhf5y0odmoybwvg0dbrq8 — Dave Fisher 
suggested splitting this into two issues (this one + a companion in 
`tooling-trusted-releases`).
   
   ### Proposal
   
   Since `atr:upload` already runs *inside* Maven, it has the effective project 
model — and thus the effective RAT excludes — available. During upload it could 
serialize those excludes into a well-known `.rat-excludes` file and upload it 
alongside the artifacts.
   
   ### Notes
   
   * Source of truth: the `apache-rat-plugin` configuration in the effective 
model (maven-parent defaults + the project's own `<excludes>` / 
`<excludesFile>`), so profiles and inheritance are resolved correctly — which 
is exactly what an external pom.xml parse could not do reliably.
   * The companion issue (`tooling-trusted-releases`) covers ATR consuming this 
file (`--input-exclude-file`). Projects that don't upload via the plugin keep 
today's behaviour.
   * Related: apache/tooling-trusted-releases#312 (same idea for the non-RAT 
licence check), apache/tooling-trusted-releases#1426 (check-result UX).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to