jdaugherty commented on code in PR #15558:
URL: https://github.com/apache/grails-core/pull/15558#discussion_r3142025448
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy:
##########
@@ -91,34 +91,32 @@ class SbomPlugin implements Plugin<Project> {
'pkg:maven/com.oracle.coherence.ce/[email protected]?type=pom': 'UPL-1.0',
// does not have map based on license id
'pkg:maven/com.oracle.coherence.ce/[email protected]?type=pom': 'UPL-1.0',
// does not have map based on license id
'pkg:maven/com.oracle.coherence.ce/[email protected]?type=pom': 'UPL-1.0',
// does not have map based on license id
- 'pkg:maven/jline/[email protected]?type=jar'
: 'BSD-2-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+ 'pkg:maven/jline/[email protected]?type=jar'
: 'BSD-2-Clause', // legacy jline:jline group, BSD-2; maps incorrectly because
of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
'pkg:maven/opensymphony/[email protected]?type=jar'
: 'OpenSymphony', // custom license approved by legal LEGAL-707
'pkg:maven/org.antlr/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
'pkg:maven/org.jruby/[email protected]?type=jar'
: 'BSD-3-Clause', //
https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt
shows it's a 3 clause
'pkg:maven/org.liquibase.ext/[email protected]?type=jar':
'Apache-2.0', // maps incorrectly because of
https://github.com/liquibase/liquibase/issues/2445 & the base pom does not
define a license
]
+ /**
+ * Group-level license overrides applied AFTER {@link #LICENSE_MAPPING}
fails to match.
+ * The key is a purl prefix (e.g. {@code 'pkg:maven/org.jline/'}) and the
value is the
+ * SPDX license id to force for any artifact whose bomRef starts with that
prefix.
+ *
+ * This exists for groups that:
+ * (a) have a stable license across all artifacts and versions, AND
+ * (b) suffer from cyclonedx-core-java#205 (license is misreported), AND
+ * (c) are pulled transitively by SNAPSHOT dependencies (e.g.
groovy-groovysh ->
+ * org.jline:* drifts on every Groovy SNAPSHOT bump), making
per-version entries
+ * unmaintainable.
+ *
+ * Only add a group entry when ALL three conditions hold. Per-version
entries in
+ * {@link #LICENSE_MAPPING} should still be preferred for one-off
overrides.
+ */
+ private static Map<String, String> LICENSE_GROUP_MAPPING = [
+ 'pkg:maven/org.jline/': 'BSD-3-Clause', // entire org.jline group
is BSD-3-Clause; cyclonedx misreports it (cyclonedx-core-java#205) and versions
drift via groovy-groovysh on every SNAPSHOT bump
Review Comment:
This defeats the entire purpose of this plugin. We should not wholesale map
these. every version has to be checked because at any time a license can
change. We need to review these individually
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
