From b398bb91ab28b799ea39dc2d1b5bd0b849392443 Mon Sep 17 00:00:00 2001 From: Matthias Sohn Date: Wed, 12 Oct 2022 23:33:14 +0200 Subject: [PATCH] Fail build if there are license issues with dependencies Configure the dash license-tool-plugin to fail the build if there are license issues with build dependencies. This plugin will generate a list of all build dependencies and their license to target/dash/summary. Delete the checked-in dependency list DEPENDENCIES since the build now always generates it to target/dash/summary. See https://github.com/eclipse/dash-licenses#example-maven-plugin Change-Id: I0c2bf8eb166d85b840d42afc61750b4a083b7659 --- DEPENDENCIES | 70 ---------------------------------------------------- pom.xml | 12 +++++++++ 2 files changed, 12 insertions(+), 70 deletions(-) delete mode 100644 DEPENDENCIES diff --git a/DEPENDENCIES b/DEPENDENCIES deleted file mode 100644 index ffb3d9058..000000000 --- a/DEPENDENCIES +++ /dev/null @@ -1,70 +0,0 @@ -maven/mavencentral/args4j/args4j/2.33, MIT, approved, CQ11068 -maven/mavencentral/com.google.code.gson/gson/2.8.9, Apache-2.0, approved, CQ23496 -maven/mavencentral/com.googlecode.javaewah/JavaEWAH/1.1.13, Apache-2.0, approved, CQ11658 -maven/mavencentral/com.jcraft/jsch/0.1.55, BSD-3-Clause, approved, CQ19435 -maven/mavencentral/com.jcraft/jzlib/1.1.3, BSD-2-Clause, approved, CQ6218 -maven/mavencentral/commons-codec/commons-codec/1.11, Apache-2.0 AND BSD-3-Clause, approved, CQ15971 -maven/mavencentral/commons-logging/commons-logging/1.2, Apache-2.0, approved, CQ10162 -maven/mavencentral/javax.servlet/javax.servlet-api/4.0.0, (CDDL-1.1 OR GPL-2.0-only WITH Classpath-exception-2.0) AND Apache-2.0, approved, CQ16125 -maven/mavencentral/junit/junit/4.13.2, EPL-2.0, approved, CQ23636 -maven/mavencentral/net.bytebuddy/byte-buddy-agent/1.9.0, Apache-2.0, approved, clearlydefined -maven/mavencentral/net.bytebuddy/byte-buddy/1.9.0, Apache-2.0, approved, clearlydefined -maven/mavencentral/net.i2p.crypto/eddsa/0.3.0, CC0-1.0, approved, CQ22537 -maven/mavencentral/net.java.dev.jna/jna-platform/5.8.0, Apache-2.0 OR LGPL-2.1-or-later, approved, CQ23218 -maven/mavencentral/net.java.dev.jna/jna/5.8.0, Apache-2.0 OR LGPL-2.1-or-later, approved, CQ23217 -maven/mavencentral/net.sf.jopt-simple/jopt-simple/4.6, MIT, approved, clearlydefined -maven/mavencentral/org.apache.ant/ant-launcher/1.10.12, Apache-2.0 AND W3C AND LicenseRef-Public-Domain, approved, CQ15560 -maven/mavencentral/org.apache.ant/ant/1.10.12, Apache-2.0 AND W3C AND LicenseRef-Public-Domain, approved, CQ15560 -maven/mavencentral/org.apache.commons/commons-compress/1.21, Apache-2.0 AND BSD-3-Clause AND bzip2-1.0.6 AND LicenseRef-Public-Domain, approved, CQ23710 -maven/mavencentral/org.apache.commons/commons-math3/3.2, Apache-2.0, approved, clearlydefined -maven/mavencentral/org.apache.httpcomponents/httpclient/4.5.13, Apache-2.0 AND LicenseRef-Public-Domain, approved, CQ23527 -maven/mavencentral/org.apache.httpcomponents/httpcore/4.4.14, Apache-2.0, approved, CQ23528 -maven/mavencentral/org.apache.sshd/sshd-common/2.8.0, Apache-2.0 AND ISC, approved, #2349 -maven/mavencentral/org.apache.sshd/sshd-core/2.8.0, Apache-2.0, approved, #2331 -maven/mavencentral/org.apache.sshd/sshd-osgi/2.8.0, Apache-2.0, approved, CQ23892 -maven/mavencentral/org.apache.sshd/sshd-sftp/2.8.0, Apache-2.0, approved, CQ23893 -maven/mavencentral/org.assertj/assertj-core/3.20.2, Apache-2.0, approved, clearlydefined -maven/mavencentral/org.bouncycastle/bcpg-jdk18on/1.71, Apache-2.0, approved, #2665 -maven/mavencentral/org.bouncycastle/bcpkix-jdk18on/1.71, MIT, approved, #2662 -maven/mavencentral/org.bouncycastle/bcprov-jdk18on/1.71, MIT AND LicenseRef-scancode-ocb-open-source-2013, approved, #2666 -maven/mavencentral/org.bouncycastle/bcutil-jdk18on/1.71, MIT, approved, #2663 -maven/mavencentral/org.eclipse.jetty.toolchain/jetty-servlet-api/4.0.6, EPL-2.0 OR Apache-2.0, approved, rt.jetty -maven/mavencentral/org.eclipse.jetty/jetty-http/10.0.6, EPL-2.0 OR Apache-2.0, approved, rt.jetty -maven/mavencentral/org.eclipse.jetty/jetty-io/10.0.6, EPL-2.0 OR Apache-2.0, approved, rt.jetty -maven/mavencentral/org.eclipse.jetty/jetty-security/10.0.6, EPL-2.0 OR Apache-2.0, approved, rt.jetty -maven/mavencentral/org.eclipse.jetty/jetty-server/10.0.6, EPL-2.0 OR Apache-2.0, approved, rt.jetty -maven/mavencentral/org.eclipse.jetty/jetty-servlet/10.0.6, EPL-2.0 OR Apache-2.0, approved, rt.jetty -maven/mavencentral/org.eclipse.jetty/jetty-util/10.0.6, EPL-2.0 OR Apache-2.0, approved, rt.jetty -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.ant.test/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.ant/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.archive/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.gpg.bc/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.http.apache/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.http.server/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.http.test/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.junit.http/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.junit.ssh/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.junit/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.lfs.server.test/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.lfs.server/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.lfs.test/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.lfs/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.pgm.test/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.pgm/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.ssh.apache.agent/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.ssh.apache.test/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.ssh.apache/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.ssh.jsch/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.test/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit.ui/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.eclipse.jgit/org.eclipse.jgit/6.3.0-SNAPSHOT, BSD-3-Clause, approved, technology.jgit -maven/mavencentral/org.hamcrest/hamcrest-core/1.3, BSD-2-Clause, approved, CQ11429 -maven/mavencentral/org.mockito/mockito-core/2.23.0, Apache-2.0 AND MIT, approved, #958 -maven/mavencentral/org.objenesis/objenesis/2.6, Apache-2.0, approved, CQ15478 -maven/mavencentral/org.openjdk.jmh/jmh-core/1.32, GPL-2.0-only with Classpath-exception-2.0, approved, #959 -maven/mavencentral/org.openjdk.jmh/jmh-generator-annprocess/1.32, GPL-2.0-only with Classpath-exception-2.0, approved, #962 -maven/mavencentral/org.osgi/org.osgi.core/6.0.0, Apache-2.0, approved, #1794 -maven/mavencentral/org.slf4j/jcl-over-slf4j/1.7.32, Apache-2.0, approved, CQ12843 -maven/mavencentral/org.slf4j/slf4j-api/1.7.30, MIT, approved, CQ13368 -maven/mavencentral/org.slf4j/slf4j-simple/1.7.30, MIT, approved, CQ7952 -maven/mavencentral/org.tukaani/xz/1.9, LicenseRef-Public-Domain, approved, CQ23498 diff --git a/pom.xml b/pom.xml index 07850c23d..44745058a 100644 --- a/pom.xml +++ b/pom.xml @@ -185,6 +185,10 @@ jacoco reuseReports ${project.build.directory}/jacoco.exec + + + true + technology.jgit @@ -556,6 +560,14 @@ org.eclipse.dash license-tool-plugin + + + license-check + + license-check + + +