And here's what I did to come up with this list:
mvn apache-rat:check -Drat.numUnapprovedLicenses=9999
ls -1 */target/rat.txt
api/target/rat.txt
bundle/target/rat.txt
implee6/target/rat.txt
impl/target/rat.txt
parent/target/rat.txt
shaded-impl/target/rat.txt
shared-public/target/rat.txt
shared/target/rat.txt
and then went through that list of files by hand.
On Thu, Sep 13, 2012 at 11:07 AM, Mike Kienenberger <mkien...@gmail.com> wrote:
> Due to my lack of maven experience, it's taken me awhile to figure out
> how to configure apache rat so that I could get past the two license
> exceptions in the api project.
>
> Here's the full list of unapproved files in the rest of the project:
>
> implee6/src/main/resources/META-INF/services/javax.servlet.ServletContainerInitializer
>
> impl/src/test/java/org/apache/myfaces/config/annotation/ClassByteCodeAnnotationFilterTest.java
> impl/src/test/resources/META-INF/services/org.apache.myfaces.config.annotation.LifecycleProvider
> impl/src/test/resources/org/apache/myfaces/view/facelets/tag/composite/testSimpleThisResourceReference.xhtml
> impl/src/test/resources/org/apache/myfaces/view/facelets/tag/composite/javax.faces/jsf.js
> impl/src/test/resources/org/apache/myfaces/view/facelets/tag/jsf/html/javax.faces/jsf.js
> impl/src/test/resources/org/apache/myfaces/view/facelets/updateheadres/resources/javax.faces/jsf.js
> impl/src/test/resources/org/apache/myfaces/lifecycle/view2.xhtml
> impl/src/test/resources/org/apache/myfaces/lifecycle/view1.jsp
> impl/src/test/resources/org/apache/myfaces/context/nestedScriptCDATA.xml
> impl/src/main/resources/META-INF/xdoc-component.vmimpl/src/main/resources/META-INF/licenses/glassfish-LICENSE.txt
> impl/src/main/resources/META-INF/licenses/facelets-LICENSE.txt
> impl/src/main/resources/META-INF/services/org.apache.myfaces.config.annotation.LifecycleProvider
> impl/src/main/resources/META-INF/xdoc-tag.vm
> impl/src/main/resources/META-INF/xdoc-web-config.vm
> impl/src/main/resources/org/apache/myfaces/resource/javaee_5.xsd
> impl/src/main/resources/org/apache/myfaces/resource/javaee_web_services_client_1_2.xsd
> impl/src/main/conf/META-INF/.standard-faces-config-base.xml.jsfdia
>
> shared-public/src/test/resources/org/apache/myfaces/shared/application/view2.xhtml
> shared-public/src/test/resources/org/apache/myfaces/shared/application/view1.jsp
>
> shared/src/test/resources/org/apache/myfaces/shared/application/view2.xhtml
> shared/src/test/resources/org/apache/myfaces/shared/application/view1.jsp
>
>
> Here is what needed to be added to the api/om.xml file in order to
> skip the two files. From what I can tell, we probably should write
> license rules for these files rather than exclude them, but that's not
> a show-stopper.
>
> <plugin>
> <groupId>org.apache.rat</groupId>
> <artifactId>apache-rat-plugin</artifactId>
> <configuration>
> <excludes>
>
> <exclude>src/main/resources/META-INF/licenses/dojo-LICENSE.TXT</exclude>
>
> <exclude>src/main/resources/META-INF/licenses/facelets-LICENSE.txt</exclude>
> </excludes>
> </configuration>
> </plugin>
>
>
> On Wed, Sep 12, 2012 at 2:08 AM, Leonardo Uribe <lu4...@gmail.com> wrote:
>> Hi
>>
>> I have updated the artifacts, so we can continue the vote. Please put
>> the vote on the mail with subject:
>>
>> [VOTE] release of Apache MyFaces 2.1.9
>> [VOTE] release of Apache MyFaces 2.0.15
>>
>> regards,
>>
>> Leonardo Uribe
>>
>> 2012/9/11 Leonardo Uribe <lu4...@gmail.com>:
>>> Hi
>>>
>>> It seems that one is the only artifact that does not have the update.
>>> All other source files installed in nexus repository are ok. Maybe it
>>> was because the assembly files were compiled before the final
>>> sources-release.zip file, so the old one was used.
>>>
>>> I'll rebuild everything everything again and send another vote mail.
>>> Thanks for notice it.
>>>
>>> regards,
>>>
>>> Leonardo
>>>
>>> 2012/9/11 Mike Kienenberger <mkien...@gmail.com>:
>>>> So I finally thought to look at the dates of the files inside of the
>>>> the Sep 10th myfaces-core-module-2.1.9-source-release.zip file.
>>>> They are all from
>>>> Sep 4th, so the problem does appear to be that this piece wasn't
>>>> rebuilt in your last release. This is probably why the license files
>>>> are still missing.
>>>>
>>>>
>>>> On Tue, Sep 11, 2012 at 10:51 PM, Mike Kienenberger <mkien...@gmail.com>
>>>> wrote:
>>>>> Leonardo,
>>>>>
>>>>> Rat is still complaining about the same 7 licensing issues.
>>>>>
>>>>> However, only certain instances of these files appear to be missing
>>>>> licenses.
>>>>>
>>>>> myfaces-core-2.1.9-src> find . -name _ExtLang.js -exec ls -1 {} \;
>>>>>
>>>>> .This one has the license header. It comes from
>>>>> myfaces-api-2.1.9-sources.jar inside of
>>>>> myfaces-core-assembly-2.1.9-src.tar.gz
>>>>>
>>>>> exists --
>>>>> ./src/META-INF/internal-resources/org.apache.myfaces.core.impl.util/_ExtLang.js
>>>>>
>>>>>
>>>>> The following two are identical. The first one is the one rat flags
>>>>> as needing a header. I guess that's because it's the "source"
>>>>> version of all the rest of them. It comes from
>>>>> myfaces-core-module-2.1.9-source-release.zip inside of
>>>>> myfaces-core-assembly-2.1.9-src.tar.gz. Maybe this file also needs
>>>>> to be fixed in svn? I was not able to determine where this file comes
>>>>> from in SVN. You had said that module was essentially a snapshot of
>>>>> SVN. Maybe this snapshot did not get updated because we reused the
>>>>> version number?
>>>>>
>>>>> missing --
>>>>> ./src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_ExtLang.js
>>>>>
>>>>> missing --
>>>>> ./src/myfaces-core-module-2.1.9/api/target/classes/META-INF/internal-resources/org.apache.myfaces.core.impl.util/_ExtLang.js
>>>>>
>>>>> [........ The rest of this email can likely be ignored....]
>>>>>
>>>>> The following two are the compressed-down versions with no extra
>>>>> whitespace or comments, which is what you would expect:
>>>>>
>>>>> missing --
>>>>> ./src/myfaces-core-module-2.1.9/api/target/classes/META-INF/internal-resources/javax.faces/META-INF/resources/myfaces/_impl/_util/_ExtLang.js
>>>>>
>>>>> missing --
>>>>> ./src/myfaces-core-module-2.1.9/api/target/classes/META-INF/resources/myfaces/META-INF/resources/myfaces/_impl/_util/_ExtLang.js
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> I have double and triple-checked to insure that I have a new
>>>>> myfaces-core-assembly-2.1.9-src.tar.gz download, and all of the files
>>>>> inside it were built on Sep 10, 8-to-10pm EST, which is right before
>>>>> the email you sent out.
>>>>>
>>>>> -rw-r--r-- 1 mkienenb users 8119569 Sep 10 21:31
>>>>> myfaces-core-assembly-2.1.9-src.tar.gz
>>>>> -rw-r--r-- 1 mkienenb users 8119322 Sep 10 21:30
>>>>> myfaces-core-assembly-2.1.9-src.zip
>>>>>
>>>>> -rw-rw-r-- 1 mkienenb users 900906 Sep 10 20:24
>>>>> myfaces-api-2.1.9-sources.jar
>>>>> drwxrwxr-x 12 mkienenb users 4096 Sep 11 21:50
>>>>> myfaces-core-module-2.1.9
>>>>> -rw-rw-r-- 1 mkienenb users 5863230 Sep 10 20:24
>>>>> myfaces-core-module-2.1.9-source-release.zip
>>>>> -rw-rw-r-- 1 mkienenb users 1809659 Sep 10 20:24
>>>>> myfaces-impl-2.1.9-sources.jar
>>>>> -rw-rw-r-- 1 mkienenb users 423440 Sep 10 20:24
>>>>> myfaces-impl-shared-2.1.9-sources.jar
>>>>> \
>>>>>
>>>>>
>>>>>
>>>>> Unapproved licenses:
>>>>>
>>>>>
>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_EvalHandlers.js
>>>>>
>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_RuntimeQuirks.js
>>>>>
>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/xhrCore/engine/BaseRequest.js
>>>>>
>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_DomExperimental.js
>>>>>
>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_ExtLang.js
>>>>>
>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/dojo-LICENSE.TXT
>>>>>
>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/facelets-LICENSE.txt
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On Mon, Sep 10, 2012 at 10:06 PM, Leonardo Uribe <lu4...@gmail.com> wrote:
>>>>>> Hi
>>>>>>
>>>>>> I have fixed the files with missing licenses, included a fix for
>>>>>> MYFACES-3605, so I'll send another vote over the new artifacts soon.
>>>>>>
>>>>>> regards,
>>>>>>
>>>>>> Leonardo Uribe
>>>>>>
>>>>>> 2012/9/7 Leonardo Uribe <lu4...@gmail.com>:
>>>>>>> Hi
>>>>>>>
>>>>>>> 2012/9/7 Mike Kienenberger <mkien...@gmail.com>:
>>>>>>>> [X] -1 for fatal flaws that should cause these bits not to be
>>>>>>>> released:
>>>>>>>>
>>>>>>>> Looks like we have 5 files missing licensing information.
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> 7 Unknown Licenses
>>>>>>>>
>>>>>>>> *******************************
>>>>>>>>
>>>>>>>> Unapproved licenses:
>>>>>>>>
>>>>>>>> The five files below appear to be missing any kind of licensing
>>>>>>>> information. The rest of the files in this directory have licensing
>>>>>>>> information.
>>>>>>>>
>>>>>>>>
>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_EvalHandlers.js
>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_RuntimeQuirks.js
>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/xhrCore/engine/BaseRequest.js
>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_DomExperimental.js
>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_ExtLang.js
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>> It seems to be related to some refactoring into our code base.
>>>>>>>
>>>>>>>>
>>>>>>>> myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/dojo-LICENSE.TXT
>>>>>>>>
>>>>>>>> "New" BSD or AFL 2.1. Bsd is approved, so maybe just add to exclude
>>>>>>>> list.
>>>>>>>>
>>>>>>>
>>>>>>> Yes
>>>>>>>
>>>>>>>>
>>>>>>>> myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/facelets-LICENSE.txt
>>>>>>>>
>>>>>>>> APL 2, but unusual format? -- add to exclude list?
>>>>>>>>
>>>>>>>
>>>>>>> Yes.
>>>>>>>
>>>>>>> regards,
>>>>>>>
>>>>>>> Leonardo Uribe
>>>>>>>
>>>>>>>>
>>>>>>>> Below is the link describing what we need to do to add files to an
>>>>>>>> exclude list.
>>>>>>>>
>>>>>>>> http://mail-archives.apache.org/mod_mbox/jackrabbit-dev/200907.mbox/%3c510143ac0907010606j73c9d973yf40d8c2b03896...@mail.gmail.com%3E
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> On Thu, Sep 6, 2012 at 11:30 PM, Mike Kienenberger
>>>>>>>> <mkien...@gmail.com> wrote:
>>>>>>>>> Thanks! Not sure how I missed that one. Withdrawing my vote. I'll
>>>>>>>>> let you know how it turns out.
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> On Thu, Sep 6, 2012 at 11:20 PM, Leonardo Uribe <lu4...@gmail.com>
>>>>>>>>> wrote:
>>>>>>>>>> Hi
>>>>>>>>>>
>>>>>>>>>> This artifact:
>>>>>>>>>>
>>>>>>>>>> https://repository.apache.org/content/repositories/orgapachemyfaces-034/org/apache/myfaces/core/myfaces-core-module/2.1.9/myfaces-core-module-2.1.9-source-release.zip
>>>>>>>>>>
>>>>>>>>>> is the one that allows to build it using maven. In practice, it is a
>>>>>>>>>> copy of the sources from the svn. This artifact is included also in:
>>>>>>>>>>
>>>>>>>>>> https://repository.apache.org/content/repositories/orgapachemyfaces-034/org/apache/myfaces/core/myfaces-core-assembly/2.1.9/myfaces-core-assembly-2.1.9-src.zip
>>>>>>>>>>
>>>>>>>>>> Build it is quite simple: unpack and mvn install.
>>>>>>>>>>
>>>>>>>>>> regards,
>>>>>>>>>>
>>>>>>>>>> Leonardo Uribe
>>>>>>>>>>
>>>>>>>>>> 2012/9/6 Mike Kienenberger <mkien...@gmail.com>:
>>>>>>>>>>> So I'm doing the work to vote for a release -- something I haven't
>>>>>>>>>>> participated in in a very long time.
>>>>>>>>>>>
>>>>>>>>>>> Leonardo's key in KEYS - check
>>>>>>>>>>> .jar.md5 matches - check
>>>>>>>>>>> .jar.asc.md5 matches - check
>>>>>>>>>>> .jar.sha1 matches -check
>>>>>>>>>>> .jar.asc.sha1 matches -check
>>>>>>>>>>> .asc files mat
>>>>>>>>>>>
>>>>>>>>>>> Includes source - check
>>>>>>>>>>> Source builds -- Not seeing any kind of build system or build
>>>>>>>>>>> instructions.
>>>>>>>>>>>
>>>>>>>>>>> Checking our web site only shows how to build from an svn checkout.
>>>>>>>>>>>
>>>>>>>>>>> Did we somehow lose the ability to build from our released source
>>>>>>>>>>> when
>>>>>>>>>>> we switched to maven?
>>>>>>>>>>> Because unless something has changed this is a big deal.
>>>>>>>>>>>
>>>>>>>>>>> http://www.apache.org/dev/release.html#what
>>>>>>>>>>> ====================
>>>>>>>>>>> What Must Every ASF Release Contain?
>>>>>>>>>>>
>>>>>>>>>>> Every ASF release *must* contain a source package, which must be
>>>>>>>>>>> sufficient for a user to build and test the release provided they
>>>>>>>>>>> have
>>>>>>>>>>> access to the appropriate platform and tools.
>>>>>>>>>>> [...]
>>>>>>>>>>> What are the ASF requirements on approving a release?
>>>>>>>>>>>
>>>>>>>>>>> [...] Before voting +1 PMC members are required to download the
>>>>>>>>>>> signed
>>>>>>>>>>> source code package, compile it as provided, and test the resulting
>>>>>>>>>>> executable on their own platform, along with also verifying that the
>>>>>>>>>>> package contains the required contents.
>>>>>>>>>>> ====================
>>>>>>>>>>>
>>>>>>>>>>> We hit this issue in Cayenne a couple years back and had to do some
>>>>>>>>>>> work to fix it.
>>>>>>>>>>>
>>>>>>>>>>> http://markmail.org/thread/njray5dbazwcdcts
>>>>>>>>>>>
>>>>>>>>>>> The natural inclination is to argue about it and try to say it's not
>>>>>>>>>>> required. One can read through lots of threads on that if you
>>>>>>>>>>> really
>>>>>>>>>>> want to satisfy that need.
>>>>>>>>>>>
>>>>>>>>>>> But it all comes down to the fact that our "open source" releases
>>>>>>>>>>> need
>>>>>>>>>>> to be something that someone can modify and build. And right now,
>>>>>>>>>>> that isn't doable. Source control systems come and go. The ASF
>>>>>>>>>>> might disappear next year. Or you might just be some poor guy who,
>>>>>>>>>>> five years from now, has to work on a project I wrote to fix some
>>>>>>>>>>> minor bug and find that the particular branch for Myfaces 2.1.9
>>>>>>>>>>> accidentally got corrupted. The reasons for why it is done this way
>>>>>>>>>>> are numerous and worthwhile. But even if that doesn't sell you on
>>>>>>>>>>> it, in the end it comes down to being a requirement of a release,
>>>>>>>>>>> whether or not you agree with it.
>>>>>>>>>>>
>>>>>>>>>>> http://mail-archives.apache.org/mod_mbox/cayenne-dev/201008.mbox/%3CAANLkTi=ykjoaw6sukpti_wfhcolkly4xcwo_cpfjx...@mail.gmail.com%3E
>>>>>>>>>>>
>>>>>>>>>>> http://mail-archives.apache.org/mod_mbox/cayenne-dev/201008.mbox/%3CAANLkTi=ut4he_ntjqmaqn4tj2jxgbeakbsrcdo9zh...@mail.gmail.com%3E
>>>>>>>>>>>
>>>>>>>>>>> http://mail-archives.apache.org/mod_mbox/cayenne-dev/201008.mbox/%3caanlktikogyvs+l8syj0bovcub1780xytfca9bvmve...@mail.gmail.com%3E
>>>>>>>>>>>
>>>>>>>>>>> But don't just take my word on it, read through the 123 messages on
>>>>>>>>>>> the legal discuss thread :)
>>>>>>>>>>>
>>>>>>>>>>> http://markmail.org/thread/njray5dbazwcdcts
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> So at least for now,
>>>>>>>>>>>
>>>>>>>>>>> [X] -1 for fatal flaws that should cause these bits not to be
>>>>>>>>>>> released:
>>>>>>>>>>>
>>>>>>>>>>> - Release cannot be built and tested from source.
