JackieTien97 commented on code in PR #17945:
URL: https://github.com/apache/iotdb/pull/17945#discussion_r3449638656
##########
LICENSE-binary:
##########
@@ -241,7 +241,7 @@ org.eclipse.jetty.ee10:jetty-ee10-servlet:12.0.36
org.eclipse.jetty:jetty-util:12.0.36
com.google.code.findbugs:jsr305:3.0.2
Review Comment:
`libthrift:0.23.0` now brings `org.apache.commons:commons-lang3:3.18.0` as a
runtime transitive dependency (`iotdb-server -> libthrift -> commons-lang3`),
and the server/confignode assemblies include module dependencies under `lib`.
Since the binary LICENSE only updates the libthrift entry and does not list
commons-lang3, the released binary would contain an Apache-2.0 dependency that
is not disclosed here. Please add `org.apache.commons:commons-lang3:3.18.0` to
this section, or otherwise exclude it and verify Thrift does not require it at
runtime.
##########
iotdb-client/jdbc/src/main/feature/feature.xml:
##########
@@ -27,7 +27,7 @@
<bundle>mvn:org.apache.iotdb/service-rpc/${project.version}</bundle>
<bundle>mvn:org.apache.iotdb/iotdb-thrift/${project.version}</bundle>
Review Comment:
This placeholder can be published literally in the JDBC Karaf features
artifact. The resources step filters `src/main/feature` into
`target/classes/feature`, but `iotdb-client/jdbc/pom.xml` still attaches
`src/main/feature/feature.xml` directly as the `features` classifier. After
this change, the attached `*-features.xml` would contain
`mvn:org.apache.thrift/libthrift/${thrift.version}`, which Karaf cannot
resolve. Please attach the filtered file instead, or keep a concrete `0.23.0`
version here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
