lizhimins opened a new pull request, #6345: URL: https://github.com/apache/rocketmq-dashboard/pull/6345
`server/pom.xml`'s `binary-license-gate` runs `scripts/legal.py jar` over the repackaged fat JAR and requires every bundled dependency to carry its upstream LICENSE text. It currently fails on **164 artifacts** (`spring-ai-*`, `swagger-ui`, `tencentcloud-sdk-java-*`, `zstd-jni`, `webjars-locator-lite`, `HdrHistogram`, ...): ``` [exec] spring-ai-mcp-2.0.0.jar: missing complete upstream LICENSE/COPYING; a POM name or link is not a substitute ``` `server/Dockerfile` then re-checks the same thing at image build time (`legal.py check-jar`). The result is that neither `mvn package` nor `docker build` can complete on trunk, which blocks deploying **unrelated** source changes to a test machine — that is how this was found: a deploy of 32 merged community PRs could not produce an image. Fixing the gate itself is real release work (collecting 164 license texts, or teaching `legal.py` which of them are already covered by our own Apache-2.0 text) and is tracked separately. This change only makes the gate *switchable*, so a deploy is not held hostage by it: - `ARG LEGAL_GATE=1` around both `check-jar` runs. **The default is unchanged** — a release build still runs the gate. At `LEGAL_GATE=0` the step prints `LEGAL_GATE=0: skipping the embedded-license check; this image is not a release artifact` rather than failing, so a mis-published image is traceable from its build log. - `MAVEN_ARGS` / `LEGAL_GATE` in `deploy/deploy.sh`, both read from `deploy/.env` (environment specific, not tracked). `mvn` arguments were previously hardcoded, so there was no way to pass anything through. `maven-antrun-plugin` has exactly one execution in `server/pom.xml` (`binary-license-gate`), so `-Dmaven.antrun.skip=true` is precise and does not silently disable another step. The two switches have to be flipped together, which the deploy.sh comment now states: the JAR's `META-INF/legal` materials are *produced* by the maven step, so skipping only that one turns "164 jars non-compliant" into "JAR is missing legal materials" at `check-jar`. That was a real dead end hit while testing this. Verified: `LEGAL_GATE` default expands to `if [ "1" = "1" ]` (gate runs) and `--build-arg LEGAL_GATE=0` to the skip branch, in both the `runtime-prebuilt` and `runtime` stages; a full `deploy.sh all` with both switches off produced a healthy image (see #6344 for the startup fix that deploy also needed). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
