chore: include list of third party dependencies and their licenses in each artifact#8312
chore: include list of third party dependencies and their licenses in each artifact#8312chadlwilson wants to merge 2 commits intodependency-check:mainfrom
Conversation
boring-cyborg
bot
added
ant
|
After more thinking, while it's an improvement on the current state, I'm not super happy about this as there are some weird ASL things about keeping NOTICE.txt and moving straight to including an SBOM in ant/CLI/docker would be better. I'll keep it open for comment for a bit before embarking on something more ambitious via cyclonedx-maven-plugin and see if that can handle the licenses detection/normalisation sufficiently. |
|
Unfortunately cyclonedx-maven-plugin can't do everything here and is a bit limited, especially if we care about retaining NOTICES for ant and cli. I'll poke around a bit more and see if we can add things into the SBOM or merge with a manual SBOM fragment. |
chadlwilson
force-pushed
the
tidy-licenses
branch
from
f9d1483 to
c0d75fd
Compare
… each artifact Replace the outdated embedded static files with license-maven-plugin. Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
chadlwilson
force-pushed
the
tidy-licenses
branch
from
c0d75fd to
6e087c5
Compare
|
I'll return to this after addressing #8353 which will simplify our maven plugins setup. |
1 participant
Description of Change
This change (requesting feedback) replaces the outdated embedded static files with dynamic generation from dependencies via the license-maven-plugin.
Right now it is just generating a
THIRD-PARTY.txtwith a list of the dependencies and their licenses for each transitive runtime non-optional dependency and including it inMETA-INF(for normal jars) or the root (for zips such as ant/cli releases)It is normalising the license names to SPDX IDs.
e.g for the CLI
Related issues
N/A
Have test cases been added to cover the new functionality?
N/A
Questions for feedback
NOTICE.txt. As an alternative I could make it generateNOTICE.txtinstead, and get it to include the general notes on the data sources that are currently mentioned in theNOTICE.txt?antandclisince these are distributed standalone outside dependency management tooling?cyclonedx-maven-pluginorspdx-maven-pluginor similar that will generate an SBOM of some description in addition to this. It might be better to go this direction if they can also handle licenses. Since CycloneDX is OWASP-adjacent I imagine there's a preference for that above spdx.