jacek-lewandowski commented on code in PR #2434:
URL: https://github.com/apache/cassandra/pull/2434#discussion_r1260676634
##########
.build/build-owasp.xml:
##########
@@ -83,4 +85,67 @@
</fileset>
</dependency-check>
</target>
+
+ <target depends="init" name="license-report">
+ <exec executable="jq" osfamily="unix" dir="${basedir}" logError="true"
failonerror="false" failifexecutionfails="false">
+ <arg value="-M"/>
+ <arg value=".dependencies[] | .fileName + "=" +
.license"/>
+ <arg value="${build.dir}/owasp/dependency-check-report.json"/>
+ <redirector output="${build.dir}/owasp/license-report.txt"/>
+ </exec>
+
+ <loadfile property="wrongly-licensed"
srcFile="${build.dir}/owasp/license-report.txt">
+ <filterchain>
+ <linecontainsregexp negate="true">
+ <regexp
pattern="^.*=.*(www.apache.org/licenses/LICENSE-2.0|Apache Software License,
Version 2.0)"/>
+ </linecontainsregexp>
+ <linecontainsregexp negate="true">
+ <regexp pattern="^.*=.*MIT License"/>
+ </linecontainsregexp>
+ <linecontainsregexp negate="true" casesensitive="false">
+ <regexp pattern="^.*=.*(BSD.\d.Clause|BSD licen[cs]e)"/>
+ </linecontainsregexp>
+ <linecontainsregexp negate="true">
+ <regexp pattern="^.*=.*(Eclipse Public
License|www.eclipse.org/legal/epl-v10.html)"/>
+ </linecontainsregexp>
+ <linecontainsregexp negate="true">
+ <regexp pattern="^.*=.*(Creative Commons)"/>
+ </linecontainsregexp>
+ <linecontainsregexp negate="true">
+ <regexp pattern="^.*=.*(ISC)"/>
+ </linecontainsregexp>
+ <replaceregex pattern=""" replace="" byline="true"
flags="g"/>
+ <trim/>
+ <sortfilter/>
+ </filterchain>
+ </loadfile>
+
+ <echo message="${wrongly-licensed}"
output="${build.dir}/owasp/license-report.txt"/>
+
+ <loadfile property="wrongly-licensed-comparable"
srcFile="${build.dir}/owasp/license-report.txt">
+ <filterchain>
+ <replaceregex pattern="=.*$" replace="" byline="true"
flags="g"/>
+ <striplinebreaks/>
+ </filterchain>
+ </loadfile>
+
+ <loadfile property="license-exceptions-comparable"
srcfile="${build.helpers.dir}/license-exceptions.txt" failonerror="false">
Review Comment:
In `.build/license-exceptions.txt` there is a list of jars we allow despite
their license is unknown or not approved. In the end we compare the list of
reported jars (see above) and the list of exceptions defined here. If those
lists do not match, we fail the build.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
