pjfanning opened a new pull request, #866:
URL: https://github.com/apache/pekko-grpc/pull/866
1.3.x port of #865.
### Motivation
`pekko-grpc-codegen` and `pekko-grpc-scalapb-protoc-plugin` publish assembly
jars and bat archives that bundle classes from 3rd party projects, so their
`META-INF/LICENSE` and `META-INF/NOTICE` have to account for those projects.
`legal/AssemblyLicense.txt` and `legal/AssemblyNotice.txt` exist for that, but:
- The codegen assembly merged `META-INF/LICENSE` with
`MergeStrategy.concat`, so the jar and bat shipped `legal/AssemblyLicense.txt`
with a dependency's plain Apache 2.0 text appended to it rather than the
curated file. (On `main` the same line was `discard`, which dropped the LICENSE
entirely.)
- `legal/AssemblyLicense.txt` had drifted from what is actually bundled. It
listed `org.checkerframework:checker-qual`, which guava dropped in favour of
`org.jspecify:jspecify`, and jspecify was not listed anywhere.
- scalapb-protoc-plugin let `compilerplugin` resolve protobuf-java
transitively, rather than pinning it the way codegen and runtime do.
Nothing failed the build when the legal files fell behind a dependency
change.
### Modification
- Merge `META-INF/LICENSE` and `META-INF/NOTICE` with
`MergeStrategy.preferProject` in both assemblies, so our own files win over the
ones the dependencies bring in.
- Swap `checker-qual` for `jspecify` in `legal/AssemblyLicense.txt` and drop
the MIT text that was only there for checker-qual.
- Pin protobuf-java in scalapb-protoc-plugin via a new `Dependencies` group,
the same way codegen and runtime already do. **No dependency version was
changed** - this branch stays on protobuf-java 3.25.9.
- Add `project/AssemblyLicenseCheck.scala` with two tasks, wired into both
assembly projects and run in CI as the `checkAssemblyLicenses` alias:
- `assemblyLicenseCheck` fails when a module on the assembly classpath is
not named in the assembly LICENSE file, and warns about listed modules that are
not bundled for the Scala version being built (the assemblies are cross built,
so e.g. `scala3-library` is legitimately absent from a 2.12 run).
- `assemblyMetaInfCheck` opens the published assembly jar and bat archive
and fails unless each carries `META-INF/LICENSE` and `META-INF/NOTICE` matching
the files in `legal/`.
The LICENSE and NOTICE stay hand curated, which is what the ASF wants:
almost none of the bundled jars ship a `META-INF/NOTICE` of their own, so the
text has to come from the upstream projects. The new tasks guard the curation
rather than replace it.
### Result
Both assembly jars and both bat archives ship the curated LICENSE and NOTICE
covering the 3rd party classes they bundle, and CI fails if a dependency change
leaves the legal files behind.
### Tests
- `sbt checkAssemblyLicenses` - passed on Scala 2.12. `assemblyLicenseCheck`
failed before the `AssemblyLicense.txt` fix, reporting that
`org.jspecify:jspecify` was not accounted for.
- `sbt scalafmtSbtCheck` - passed.
### References
Refs #865
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
