bharos opened a new issue, #13255:
URL: https://github.com/apache/gravitino/issues/13255
### What would you like to be improved?
`dev/release/check-license.sh` is the only automated guard on the LICENSE
file, but it passed cleanly on `v1.3.1-rc1` while that release shipped a
reference to a file that does not exist.
The script only validates tokens that begin with `./`:
```bash
if [[ "$line" == "./"* && "$line" == *"."* ]]; then
```
`LICENSE` line 204 of the RC reads:
```
The Web UI also bundles various third-party components also under
different licenses, please see web/LICENSE for these.
```
`web/LICENSE` does not exist — the Web UI license lives at
`web/web/LICENSE`. Because the reference is prose rather than a `./`-prefixed
list entry, the check skips it. Running the script against the RC tree:
```
$ bash dev/release/check-license.sh .
...
different licenses, please see web/LICENSE for these.
...
All files listed in the LICENSE file are present.
$ echo $?
0
```
Two further gaps in the same script:
1. **`NOTICE` is never checked.** Only `$PROJECT_ROOT/LICENSE` is read, yet
`NOTICE` carries the same kind of path reference (`please see web/web/NOTICE
for it's contents`) and is equally part of the release.
2. **A missing `LICENSE` is reported as success.** `LICENSE_FILE=$(cat
"$PROJECT_ROOT"/LICENSE)` is not checked, so when the file is absent `cat`
writes to stderr, the loop body never runs, and the script prints the success
message and exits 0:
```
$ bash dev/release/check-license.sh /tmp/empty-dir
cat: /tmp/empty-dir/LICENSE: No such file or directory
All files listed in the LICENSE file are present.
```
A wrong `PROJECT_ROOT` therefore looks identical to a clean run.
### How should we improve?
Validate any path-like reference, not just `./`-prefixed ones, and check
`NOTICE` alongside `LICENSE`.
To avoid false positives on URLs, Java package names and jar-internal paths
such as `META-INF/NOTICE`, a reference should only be checked when its first
path segment is an existing directory in the project root. Prototyping that
rule against the RC's `LICENSE` and `NOTICE` flags exactly one reference, the
real `web/LICENSE` defect, with no false positives.
The script should also fail loudly when a file it is asked to check is
missing, and report only the problems it finds rather than echoing every line
of the input.
Note that the `LICENSE.bin` / `NOTICE.bin` variants are deliberately out of
scope: their paths describe the binary package layout produced by
`build.gradle.kts` (where the Web UI licenses are relocated to `web/LICENSE`
and `web-v2/LICENSE`), so resolving them against the source tree would report
false failures.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
