ppkarwasz commented on code in PR #12309:
URL: https://github.com/apache/seatunnel/pull/12309#discussion_r4007823317
##########
seatunnel-connectors-v2/connector-file/connector-file-base/pom.xml:
##########
@@ -122,6 +122,11 @@
<version>${commons.lang3.version}</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-secure-xml</artifactId>
Review Comment:
The dependency-license check will not fail. It only inventories what the
distribution ships in `lib/`: `seatunnel-connectors-v2/pom.xml` and
`seatunnel-e2e/pom.xml` run `maven-dependency-plugin` with
`skip=${e2e.dependency.skip}`, which the root pom defaults to `true`, and the
ci-tools dependency is test-scoped while the script copies runtime scope only.
Running `tools/dependencies/checkLicense.sh` on this branch gives an empty diff
and exit code 0. Adding the jar to `known-dependencies.txt` would actually make
the check fail, since the script also flags listed jars that are not found.
That the check never sees what connectors shade into their own jars is a **real
gap** (dom4j, from the same connector, is listed nowhere either), but it is a
**pre-existing** one and **out of scope** here.
Independently of the check, the PR already complies with [Assembling LICENSE
and NOTICE files](https://infra.apache.org/licensing-howto.html). Commons
Secure XML is an `Apache-2.0` component with no sub-components under other
licenses, so the guide says LICENSE needs no change. Its NOTICE contains
nothing that needs bubbling up:
- The ASF copyright attribution is already present:
https://github.com/apache/seatunnel/blob/41a9c4b8fb0bbd6e0538cfd2728ead4651032ff6/seatunnel-dist/release-docs/NOTICE#L2
- So is "This product includes software developed at The Apache Software
Foundation", which the guide explicitly says not to duplicate when bundling
another ASF product:
https://github.com/apache/seatunnel/blob/41a9c4b8fb0bbd6e0538cfd2728ead4651032ff6/seatunnel-dist/release-docs/NOTICE#L8-L9
The guide's rule is "Do not add anything to NOTICE which is not legally
required", and nothing here is.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
