paulk-asert opened a new issue, #23: URL: https://github.com/apache/grails-intellij-plugin/issues/23
The JetBrains software grant has been filed. This tracks what should be cleaned up before the Grails PMC votes to accept the donation and the Incubator PMC lazily approves the [IP clearance](https://incubator.apache.org/ip-clearance/) form. Grails is a full PMC, so the short-form IP clearance route is correct and no `DISCLAIMER` or `(incubating)` naming applies. **Already in good shape** — signed source-release-is-the-release framing, RAT wired into `check` with individually justified excludes, reproducible builds, `etc/bin` verification scripts, vote templates, SHA-pinned Actions, `.asf.yaml` notifications, GPG/KEYS flow, and `plugin.xml` vendor set to the ASF. The items below are what's left. --- ## 1. Replace the JetBrains-attributed headers with the ASF header **This is Phase 9 of `MIGRATION-PLAN.md`, and the grant now unblocks it.** It is the largest single item: **949 tracked files** carry a JetBrains copyright notice; only 59 carry the ASF header. Current form (e.g. `plugin/src/main/java/org/apache/grails/intellij/plugin/GrailsBundle.java:2`): ``` * Copyright 2000-2026 JetBrains s.r.o. and contributors. * Licensed under the Apache License, Version 2.0 (the "License"); ``` [Source header policy](https://www.apache.org/legal/src-headers.html#headers), for works submitted directly to the ASF by the copyright owner: the owner must "remove such notices, or move them to the NOTICE file", and "Each source file **should** include the following license header — note that there should be **no copyright notice** in the header." [Release Policy](https://www.apache.org/legal/release-policy#licensing-documentation) restates it as a `must`. `NOTICE` already carries the relocated JetBrains attribution, so half of this is done. - [ ] Mechanically replace the JetBrains-attributed ALv2 headers with the canonical header from `HEADER` — one commit, no functional change. Covers the 3 older-form variants (`Copyright 2000-2007`, `Copyright 2000-2024`) too. - [ ] Confirm the `NOTICE` wording against the executed grant text; add the "donated to the ASF" phrasing noted in `MIGRATION-PLAN.md:217`. - [ ] Invert the Phase 8 grep guard (`MIGRATION-PLAN.md:219`): the ASF header becomes required on all non-excluded files, and the JetBrains-attributed form must not reappear. > **RAT will not catch this either way.** It accepts the ALv2 appendix boilerplate, so > `./gradlew rat` is green today and stays green afterwards. The grep guard is the only gate. --- ## 2. Third-party binaries in `plugin/testdata/` `plugin/testdata/` holds 35 real third-party JARs (~5.4 MB — genuine bytecode, not stubs). The `source` job removes only `.git`, `.github`, `.asf.yaml`, `gradlew*` and `gradle/wrapper` (`.github/workflows/release.yml:129-135`), so all of them ship in the signed source release. RAT does not see them (`**/testdata/**` is excluded in `build-logic/src/main/groovy/org.apache.grails.intellij.build.rat.gradle:71-73`), and even un-excluded it would not help: RAT is a header auditor, it buckets binaries separately and does not inspect archive contents. Sorted by [license category](https://www.apache.org/legal/resolved.html), this is smaller than it first looks: | Category | Jars | Status | | --- | --- | --- | | **X** — `hibernate-core-3.3.1.GA.jar` (LGPL 2.1) | 1 | Must not be in the repo at all | | **B** — `junit-4.8.1.jar` (CPL 1.0) | 1 | Must not be in the **source release** | | **A** — Grails / Spring / Groovy / Spock (ALv2) | 33 | `SHOULD` not ship; optional | Category X is unambiguous: *"Apache projects may not distribute Category X licensed components, in source or binary form; in ASF source code or in convenience binaries."* Category B: *"Do not include Category B licensed works in source releases."* ### Proposed fix — delete, don't engineer The Hibernate jar is reachable only via `GrailsTestCase.needHibernate()` (`libs/testFramework/.../GrailsTestCase.java:229`), which exactly **three** test classes override: - `plugin/src/test/java/org/apache/grails/intellij/plugin/domain/GrailsCriteriaBuilderTest.java` - `plugin/src/test/java/org/apache/grails/intellij/plugin/domain/GrailsCriteriaBuilderToManyRelationTest.java` - `plugin/src/test/java/org/apache/grails/intellij/plugin/domain/GrailsTransientPropertyTest.java` All three pair it with `needGormLibrary()` and resolve `grails.orm.HibernateCriteriaBuilder` against the `mockGrails11` fixture — the Grails 1.x/2.x GORM API. That tier is slated for removal, and those Grails versions do not run on any currently supported JVM, so deleting the tests costs no real coverage. - [ ] Delete `plugin/testdata/mockGrails11/lib/hibernate-core-3.3.1.GA.jar` and the three tests above. (Sanity check first that no modern-GORM equivalent is worth writing — if one is, that's a new test against a current fixture, not a rescue of a 2008 jar.) - [ ] Add `plugin/testdata/mockGrails11/lib/junit-4.8.1.jar` to the removal list in the `source` job of `.github/workflows/release.yml`. - [ ] Note in `RELEASE.md` that fixture binaries are stripped from the source distribution, alongside the existing `gradle-bootstrap` explanation. The 33 ALv2 jars stay. They are a `SHOULD`, not a `MUST`, and they disappear on their own when `mockGrails11`/`mockGrails14` are deleted with Grails 1/2 support. > **No test-skipping infrastructure is needed.** `etc/bin/verify.sh` runs checksums and > signatures, `rat` against the source distribution, and a reproducible `buildPlugin` — it > never runs `check` or `test` from the extracted source dist. Nothing in the release > verification path breaks when fixture jars are absent. --- ## 3. Convenience binary is missing `LICENSE` and `NOTICE` at the top level Unpacking the plugin ZIP from CI ([run 31048294908](https://github.com/apache/grails-intellij-plugin/actions/runs/31048294908)): ``` apache-grails-intellij-plugin/ └── lib/ ├── apache-grails-intellij-plugin-262.0.0.jar # has META-INF/LICENSE + NOTICE ├── org.apache.grails.intellij.*.jar # 4 jars, neither ├── modules/*.jar # 6 jars, neither └── standardDsls/ ``` There is no `LICENSE` or `NOTICE` at the root of the ZIP. They exist only inside the composed plugin jar's `META-INF/`, which `etc/bin/verify-distributions.sh:145-147` documents as deliberate. [Policy](https://www.apache.org/legal/src-headers.html#faq-binaries) is explicit that both files are required *"whether the unit of distribution is a .jar, .msi, .tar.gz, .zip, .exe installer, or any other file format"*. The unit being voted on and staged to `dist.apache.org/dev/grails/intellij/${VERSION}/distribution/` is the ZIP. - [ ] Place `LICENSE` and `NOTICE` at `apache-grails-intellij-plugin/` in the ZIP. - [ ] Extend the assertion in `verify-distributions.sh` to check for them there. - [ ] Optionally add them to each sub-jar's `META-INF/` — cheap and removes any argument. --- ## 4. Smaller items - [ ] **`LICENSE` third-party section.** Currently stock ALv2 with no additions. After #2, confirm whether anything bundled still needs an entry — `gradlew`/`gradlew.bat` are ALv2 from Gradle Inc., and any surviving fixture jars would need listing. - [ ] **Planning docs ship in the source release.** `MIGRATION-PLAN.md` and `IMPROVEMENT-PLAN.md` are RAT-excluded as "removed before the first release", but nothing removes them. `AGENTS.md` (10.5 KB) also ships, with no header and no RAT exclude. Either delete at the tag or add to the `source` job's removal list. - [ ] **Trademark attribution.** Not present anywhere. Add to `README.md` and the Marketplace listing: *"Apache, Apache Grails, Grails, and the Apache feather logo are trademarks of The Apache Software Foundation."* ([branding requirements](https://www.apache.org/foundation/marks/pmcs)) - [ ] **`NOTICE` line 11.** `Licensed under the Apache License, Version 2.0.` is redundant in a NOTICE file, which should carry only required attributions. Cosmetic, but reviewers comment on it. - [ ] **IP clearance form.** Record the upstream commit id of the donated snapshot. The import (`3d4bc40`) is a squash whose message names only the repository. Also worth one line noting that the `mockGrails11/scripts/*.groovy` fixtures (`Copyright 2004-2005 the original author or authors`) trace to the Grails codebase already granted to the ASF, so their provenance is covered independently of the JetBrains grant. --- ## Checked and confirmed fine — no action - Grails is a full PMC (`pmc: true` in Whimsy LDAP); short-form IP clearance is the right route, no `DISCLAIMER` needed. - `libs/testFramework/**` files in `com.intellij` / `org.jetbrains` packages were present in the original import commit `3d4bc40`, not copied in later. JetBrains owns them and they are within the donated tree — they need only the header swap in #1. - `mockGrails11/scripts/*.groovy` likewise arrived with the import and trace to the Grails codebase, so the existing Grails grant covers them. - `servlet-api-2.5.jar` is the Mortbay/Jetty build (`package: org.mortbay`, `implementation-version: 6.1.14`), which is ALv2 — not the CDDL `javax.servlet` artifact. - Release signing, checksums, `dist.apache.org` dev→release staging, vote templates and the "source release is the release, plugin ZIP is a convenience binary" framing all match policy. ## Suggested sequencing #2 first (it settles what `LICENSE` must say), then #1 as one mechanical commit, then #3, then #4. #1 is the noisiest diff but carries the least risk. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
