pjfanning opened a new pull request, #865:
URL: https://github.com/apache/pekko-grpc/pull/865
### Motivation
`pekko-grpc-codegen` and `pekko-grpc-scalapb-protoc-plugin` publish assembly
jars and bat archives that bundle classes from 3rd party projects, so their
`META-INF/LICENSE` and `META-INF/NOTICE` have to account for those projects.
`legal/AssemblyLicense.txt` and `legal/AssemblyNotice.txt` exist for that, but:
- The codegen assembly jar and bat shipped **no `META-INF/LICENSE` at all**.
The merge strategy discarded `META-INF/LICENSE` to stop guava/failureaccess
colliding, and that also discarded the copy the `ApacheSonatypePlugin` resource
generator puts in the jar.
- `legal/AssemblyLicense.txt` had drifted from what is actually bundled. It
listed `org.checkerframework:checker-qual`, which guava dropped in favour of
`org.jspecify:jspecify`, and jspecify was not listed anywhere.
- The scalapb-protoc-plugin assembly bundled protobuf-java 4.35.0, pulled in
transitively by `compilerplugin`, rather than the pinned 4.36.0 that codegen
and runtime bundle.
Nothing failed the build when the legal files fell behind a dependency
change.
### Modification
- Merge `META-INF/LICENSE` and `META-INF/NOTICE` with
`MergeStrategy.preferProject` in both assemblies, so our own files win over the
ones the dependencies bring in.
- Swap `checker-qual` for `jspecify` in `legal/AssemblyLicense.txt` and drop
the MIT text that was only there for checker-qual.
- Pin protobuf-java in scalapb-protoc-plugin via a new `Dependencies` group,
the same way codegen and runtime already do.
- Add `project/AssemblyLicenseCheck.scala` with two tasks, wired into both
assembly projects and run in CI as the `checkAssemblyLicenses` alias:
- `assemblyLicenseCheck` fails when a module on the assembly classpath is
not named in the assembly LICENSE file, and warns about listed modules that are
not bundled for the Scala version being built (the assemblies are cross built,
so e.g. `scala3-library` is legitimately absent from a 2.12 run).
- `assemblyMetaInfCheck` opens the published assembly jar and bat archive
and fails unless each carries `META-INF/LICENSE` and `META-INF/NOTICE` matching
the files in `legal/`.
The LICENSE and NOTICE stay hand curated, which is what the ASF wants: only
1 of the ~20 bundled jars ships a `META-INF/NOTICE` of its own, so the text has
to come from the upstream projects. The new tasks guard the curation rather
than replace it.
### Result
Both assembly jars and both bat archives ship a LICENSE and NOTICE covering
the 3rd party classes they bundle, both bundle protobuf-java 4.36.0, and CI
fails if a dependency change leaves the legal files behind.
### Tests
- `sbt checkAssemblyLicenses` - passed. `assemblyMetaInfCheck` fails on the
codegen assembly before the merge strategy fix (`META-INF/LICENSE` is missing),
and `assemblyLicenseCheck` fails before the `AssemblyLicense.txt` fix
(`org.jspecify:jspecify` is not accounted for).
- `sbt scalafmtSbtCheck` - passed.
### References
None - assembly jar license completeness
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
