Repository navigation
SONARJAVA-7286 Add PSI dependencies packaging and third-party license notices - #6454
aurelien-coet-sonarsource wants to merge 1 commit into
Conversation
hashicorp-vault-sonar-prod
Bot
changed the title
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
| This copy of StaxMate processing library is licensed under | ||
| BSD License ("new BSD"). | ||
| See http://www.opensource.org/licenses/bsd-license.php | ||
| for details. | ||
|
|
||
| Full license text is as follows: | ||
|
|
||
| -------------------------------------------------------------------------- | ||
| * Copyright (c) 2007, Tatu Saloranta | ||
| * All rights reserved. | ||
| * | ||
| * Redistribution and use in source and binary forms, with or without | ||
| * modification, are permitted provided that the following conditions are met: | ||
| * * Redistributions of source code must retain the above copyright | ||
| * notice, this list of conditions and the following disclaimer. |
There was a problem hiding this comment.
⚠️ Bug: dk.brics automaton notice ships StaxMate's license and copyright
The new dk.brics.automaton-LICENSE.txt is byte-for-byte the same as license-resources/bsd.txt. That file starts with "This copy of StaxMate processing library is licensed under..." and gives the copyright as "(c) 2007, Tatu Saloranta". It got here through the existing http://www.opensource.org/licenses/bsd-license.php → bsd.txt URL replacement, so any BSD-licensed dependency gets StaxMate's notice. dk.brics automaton is copyright Anders Møller / Aarhus University. Its BSD license says binary redistributions must reproduce its copyright notice, and the bundled notice names the wrong library and the wrong owner. Fix: add a dedicated license text for automaton (for example license-resources/automaton.txt) and either override it in psi-licenses.xml or add a URL replacement that only matches this artifact. Then regenerate the committed file.
Was this helpful? React with 👍 / 👎
| <dependency> | ||
| <groupId>\Qcom.jetbrains.intellij.java\E</groupId> | ||
| <artifactId>\Qjava-frontback-psi\E</artifactId> | ||
| <version>\Q262.10968.63\E</version> |
There was a problem hiding this comment.
💡 Quality: psi-licenses.xml pins IntelliJ version separately from intellij.version
Every IntelliJ override in psi-licenses.xml matches on the literal <version>\Q262.10968.63\E</version>, while the actual dependency version comes from the new ${intellij.version} property in the root pom. When someone bumps intellij.version, none of these overrides match any more. The license plugin then falls back to the artifacts' own POM metadata, which is why the overrides were added in the first place, so licenses go missing or get generated differently and LicenseValidator fails the build. Since the override is keyed on groupId/artifactId, match any version (e.g. <version>.*</version>) or document that this file has to be updated together with intellij.version.
Was this helpful? React with 👍 / 👎
23c3e29 to
ab3853a
Compare
| <filter> | ||
| <artifact>com.jetbrains.intellij.platform:bazel-runfiles</artifact> | ||
| <includes><include>**</include></includes> | ||
| </filter> | ||
| <filter> | ||
| <artifact>com.jetbrains.intellij.platform:core</artifact> | ||
| <includes><include>**</include></includes> | ||
| </filter> | ||
| <filter> | ||
| <artifact>com.jetbrains.intellij.platform:core-impl</artifact> | ||
| <includes><include>**</include></includes> | ||
| </filter> | ||
| <filter> | ||
| <artifact>com.jetbrains.intellij.platform:diagnostic</artifact> | ||
| <includes><include>**</include></includes> |
There was a problem hiding this comment.
⚠️ Bug: 20 newly shaded PSI dependencies ship with no license notice
This PR adds shade filters with <include>**</include> for these artifacts, so they get bundled into the plugin JAR. None of them has a file in src/main/resources/licenses/THIRD_PARTY_LICENSES/:
- IntelliJ platform modules:
bazel-runfiles,diagnostic,diagnostic-telemetry,eel,eel-nio-fs,plugin-system-parser-impl,syntax-extensions,syntax-i18-n,syntax-util,util-class-loader,util-coroutines,util-diff,util-jdom,util-progress,util-rt-java8,util-xml-dom jaxen:jaxen,net.java.dev.jna:jna,net.java.dev.jna:jna-platform(dual LGPL-2.1/Apache-2.0),org.slf4j:log4j-over-slf4j
I checked the published POMs. platform:util and platform:core-impl 262.10968.63 pull in util-jdom, eel, eel-nio-fs, jna-platform, log4j-over-slf4j, diagnostic, diagnostic-telemetry, util-diff, plugin-system-parser-impl and others, mostly with runtime scope, so these are real bundled dependencies. The IntelliJ POMs have no <licenses> block, and psi-licenses.xml only adds overrides for 19 artifacts. That leaves these modules with nothing to generate a notice from, so the build still passes with errorRemedy=xmlOutput and LicenseValidator finds nothing missing. The result is a plugin that redistributes third-party code with no license notice, which is the thing this PR is supposed to fix.
Fix: add psi-licenses.xml entries for the IntelliJ modules that are missing. Make sure the download/validation step also covers the runtime-scoped JNA, jaxen and log4j-over-slf4j artifacts, then commit the license files it produces.
Was this helpful? React with 👍 / 👎
CI failed: The build fails at the third-party license check: 19 PSI-related dependencies have unknown licenses and two icon API artifacts use an Apache license label that the whitelist does not match; this is tied to this PR's new PSI dependencies.OverviewOne unique failure pattern was found across 1 log in job 125307301458 (commit ab3853a). The Maven build and tests completed, but the root-project FailuresThird-party license check fails on unknown and non-whitelisted licenses (confidence: high)
Summary
Code Review
|
| Auto-apply | Compact | Unblock |
|
|
|
Was this helpful? React with 👍 / 👎 | Gitar
|
Summary by Gitar
intellij.versioninpom.xmlcommons-codecandstax2-apidependency management injava-frontend/pom.xmlmaven-shade-pluginfilters andServicesResourceTransformerto bundle PSI dependenciesuseChildFirstClassLoaderand widenedrequireFilesSizebounds insonar-java-plugin/pom.xmlmaven.compiler.releaseto 21 and added surefire JVM args injava-frontend/pom.xmlpsi-licenses.xmland Apache, ASM, and ORO license texts underlicense-resourcesTHIRD_PARTY_LICENSESfiles for the new dependenciesThis will update automatically on new commits.