chore: include list of third party dependencies and their licenses in each artifact#8312
Draft
chadlwilson wants to merge 1 commit intodependency-check:mainfrom
Draft
chore: include list of third party dependencies and their licenses in each artifact#8312chadlwilson wants to merge 1 commit intodependency-check:mainfrom
chadlwilson wants to merge 1 commit intodependency-check:mainfrom
Conversation
… each artifact Replace the outdated embedded static files with license-maven-plugin. Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
boring-cyborg
bot
added
ant
Collaborator
Author
|
After more thinking, while it's na improvement on the current state, I'm not super happy about this as there are some weird ASL things about keeping NOTICE.txt and moving straight to including an SBOM in ant/CLI/docker would be better. I'll keep it open for comment for a bit before embarking on something more ambitious via cyclonedx-maven-plugin and see if that can handle the licenses detection/normalisation sufficiently. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of Change
This change (requesting feedback) replaces the outdated embedded static files with dynamic generation from dependencies via the license-maven-plugin.
Right now it is just generating a
THIRD-PARTY.txtwith a list of the dependencies and their licenses for each transitive runtime non-optional dependency and including it inMETA-INF(for normal jars) or the root (for zips such as ant/cli releases)It is normalising the license names to SPDX IDs.
e.g for the CLI
Related issues
N/A
Have test cases been added to cover the new functionality?
N/A
Questions for feedback
NOTICE.txt. As an alternative I could make it generateNOTICE.txtinstead, and get it to include the general notes on the data sources that are currently mentioned in theNOTICE.txt?antandclisince these are distributed standalone outside dependency management tooling?cyclonedx-maven-pluginorspdx-maven-pluginor similar that will generate an SBOM of some description in addition to this. It might be better to go this direction if they can also handle licenses. Since CycloneDX is OWASP-adjacent I imagine there's a preference for that above spdx.