jamesfredley commented on code in PR #15558:
URL: https://github.com/apache/grails-core/pull/15558#discussion_r3142316541
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy:
##########
@@ -91,34 +91,32 @@ class SbomPlugin implements Plugin<Project> {
'pkg:maven/com.oracle.coherence.ce/[email protected]?type=pom': 'UPL-1.0',
// does not have map based on license id
'pkg:maven/com.oracle.coherence.ce/[email protected]?type=pom': 'UPL-1.0',
// does not have map based on license id
'pkg:maven/com.oracle.coherence.ce/[email protected]?type=pom': 'UPL-1.0',
// does not have map based on license id
- 'pkg:maven/jline/[email protected]?type=jar'
: 'BSD-2-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+ 'pkg:maven/jline/[email protected]?type=jar'
: 'BSD-2-Clause', // legacy jline:jline group, BSD-2; maps incorrectly because
of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
'pkg:maven/opensymphony/[email protected]?type=jar'
: 'OpenSymphony', // custom license approved by legal LEGAL-707
'pkg:maven/org.antlr/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
- 'pkg:maven/org.jline/[email protected]?type=jar'
: 'BSD-3-Clause', // maps incorrectly because of
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
'pkg:maven/org.jruby/[email protected]?type=jar'
: 'BSD-3-Clause', //
https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt
shows it's a 3 clause
'pkg:maven/org.liquibase.ext/[email protected]?type=jar':
'Apache-2.0', // maps incorrectly because of
https://github.com/liquibase/liquibase/issues/2445 & the base pom does not
define a license
]
+ /**
+ * Group-level license overrides applied AFTER {@link #LICENSE_MAPPING}
fails to match.
+ * The key is a purl prefix (e.g. {@code 'pkg:maven/org.jline/'}) and the
value is the
+ * SPDX license id to force for any artifact whose bomRef starts with that
prefix.
+ *
+ * This exists for groups that:
+ * (a) have a stable license across all artifacts and versions, AND
+ * (b) suffer from cyclonedx-core-java#205 (license is misreported), AND
+ * (c) are pulled transitively by SNAPSHOT dependencies (e.g.
groovy-groovysh ->
+ * org.jline:* drifts on every Groovy SNAPSHOT bump), making
per-version entries
+ * unmaintainable.
+ *
+ * Only add a group entry when ALL three conditions hold. Per-version
entries in
+ * {@link #LICENSE_MAPPING} should still be preferred for one-off
overrides.
+ */
+ private static Map<String, String> LICENSE_GROUP_MAPPING = [
+ 'pkg:maven/org.jline/': 'BSD-3-Clause', // entire org.jline group
is BSD-3-Clause; cyclonedx misreports it (cyclonedx-core-java#205) and versions
drift via groovy-groovysh on every SNAPSHOT bump
Review Comment:
Addressed in 54b718b526 - reverted the LICENSE_GROUP_MAPPING and dropped the
matching group-fallback branch in pickLicense. Replaced with explicit
per-version entries for the org.jline artifacts that Groovy 6 currently
resolves to (10 at 4.0.12, plus the directly-pinned 3.30.6). Each entry now
cites the upstream-versioned LICENSE.txt URL inline so future maintainers can
re-verify on the next SNAPSHOT bump rather than trusting a wholesale rule. The
3.30.9 / 4.0.7 entries were dropped because Groovy 6.0.0-SNAPSHOT no longer
resolves to those (verified via :grails-shell-cli:dependencies --configuration
runtimeClasspath and the Forcing license for ... log lines on cyclonedxBom).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
