pulsar-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From mme...@apache.org
Subject [incubator-pulsar] branch master updated: Use exact dependency version in LICENSE file and use check-binary-license to enforce (#1820)
Date Tue, 22 May 2018 13:37:47 GMT
This is an automated email from the ASF dual-hosted git repository.

mmerli pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-pulsar.git


The following commit(s) were added to refs/heads/master by this push:
     new 5ce4065  Use exact dependency version in LICENSE file and use check-binary-license
to enforce (#1820)
5ce4065 is described below

commit 5ce40658e489c3428887244ed1ec1afaba44c9f9
Author: Matteo Merli <mmerli@apache.org>
AuthorDate: Tue May 22 06:37:43 2018 -0700

    Use exact dependency version in LICENSE file and use check-binary-license to enforce (#1820)
---
 all/src/assemble/LICENSE.bin.txt | 198 +++++++++++++++++++++++++++++----------
 src/check-binary-license         |  93 ++++++++++++++++++
 2 files changed, 244 insertions(+), 47 deletions(-)

diff --git a/all/src/assemble/LICENSE.bin.txt b/all/src/assemble/LICENSE.bin.txt
index dd45fd2..8b0b3cc 100644
--- a/all/src/assemble/LICENSE.bin.txt
+++ b/all/src/assemble/LICENSE.bin.txt
@@ -309,70 +309,174 @@ pulsar-client-cpp/lib/checksum/crc32c_sw.cc
 This projects includes binary packages with the following licenses:
 
 The Apache Software License, Version 2.0
- * JCommander -- com.beust-*.jar
- * High Performance Primitive Collections for Java -- com.carrotsearch-hppc-*.jar
- * Jackson -- com.fasterxml.jackson*.jar
- * Caffeine -- com.github.ben-manes.caffeine*.jar
- * Gson -- com.google.code.gson-*.jar
- * Guava -- com.google.guava-*.jar
- * Netty Reactive Streams -- com.typesafe.netty-netty-reactive-streams-*.jar
- * Swagger Annotations -- com.wordnik-swagger-annotations-*.jar
- * Swagger -- io.swagger-swagger-*.jar
- * DataSketches -- com.yahoo.datasketches-*.jar
- * Apache Commons -- commons-*.jar org.apache.commons-*.jar
- * Netty -- io.netty-netty-*.jar
- * Prometheus client -- io.prometheus-simpleclient*.jar
- * Bean Validation API -- javax.validation-*.jar
- * Joda Time -- joda-time-*.jar
- * Log4J -- log4j-*.jar
- * Java Native Access JNA -- net.java.dev.jna-*.jar
- * BookKeeper -- org.apache.bookkeeper.*.jar
- * LZ4 -- net.jpountz.lz4-*.jar
- * AsyncHttpClient -- org.asynchttpclient-*.jar
- * Jetty - org.eclipse.jetty-*.jar
- * SnakeYaml -- org.yaml-snakeyaml-*.jar
- * RocksDB - org.rocksdb.*.jar
- * HttpClient - org.apache.httpcomponents.httpclient.jar
- * HttCore - org.apache.httpcomponents.httpcore.jar
- * CommonsLogging - commons-logging-*.jar
+ * JCommander -- com.beust-jcommander-1.48.jar
+ * High Performance Primitive Collections for Java -- com.carrotsearch-hppc-0.7.3.jar
+ * Jackson
+     - com.fasterxml.jackson.core-jackson-annotations-2.8.4.jar
+     - com.fasterxml.jackson.core-jackson-core-2.8.4.jar
+     - com.fasterxml.jackson.core-jackson-databind-2.8.4.jar
+     - com.fasterxml.jackson.dataformat-jackson-dataformat-cbor-2.6.7.jar
+     - com.fasterxml.jackson.dataformat-jackson-dataformat-yaml-2.8.4.jar
+     - com.fasterxml.jackson.datatype-jackson-datatype-joda-2.8.4.jar
+     - com.fasterxml.jackson.jaxrs-jackson-jaxrs-base-2.8.4.jar
+     - com.fasterxml.jackson.jaxrs-jackson-jaxrs-json-provider-2.8.4.jar
+     - com.fasterxml.jackson.module-jackson-module-jaxb-annotations-2.8.4.jar
+     - com.fasterxml.jackson.module-jackson-module-jsonSchema-2.9.0.jar
+ * Caffeine -- com.github.ben-manes.caffeine-caffeine-2.3.3.jar
+ * Proto Google Common Protos -- com.google.api.grpc-proto-google-common-protos-0.1.9.jar
+ * Gson -- com.google.code.gson-gson-2.8.2.jar
+ * Guava -- com.google.guava-guava-20.0.jar
+ * Netty Reactive Streams -- com.typesafe.netty-netty-reactive-streams-2.0.0.jar
+ * Swagger Annotations -- com.wordnik-swagger-annotations-1.5.3-M1.jar
+ * Swagger
+    - io.swagger-swagger-annotations-1.5.3.jar
+    - io.swagger-swagger-core-1.5.3.jar
+    - io.swagger-swagger-models-1.5.3.jar
+ * DataSketches 
+    - com.yahoo.datasketches-memory-0.8.3.jar
+    - com.yahoo.datasketches-sketches-core-0.8.3.jar
+ * Apache Commons 
+    - commons-beanutils-commons-beanutils-1.7.0.jar
+    - commons-beanutils-commons-beanutils-core-1.8.0.jar
+    - commons-cli-commons-cli-1.2.jar
+    - commons-codec-commons-codec-1.10.jar
+    - commons-collections-commons-collections-3.2.1.jar
+    - commons-configuration-commons-configuration-1.6.jar
+    - commons-digester-commons-digester-1.8.jar
+    - commons-io-commons-io-2.5.jar
+    - commons-lang-commons-lang-2.6.jar
+    - commons-logging-commons-logging-1.1.1.jar
+    - org.apache.commons-commons-collections4-4.1.jar
+    - org.apache.commons-commons-lang3-3.4.jar
+ * Netty
+    - io.netty-netty-3.10.1.Final.jar
+    - io.netty-netty-all-4.1.21.Final.jar
+    - io.netty-netty-codec-http2-4.1.12.Final.jar
+    - io.netty-netty-codec-socks-4.1.12.Final.jar
+    - io.netty-netty-handler-proxy-4.1.12.Final.jar
+    - io.netty-netty-tcnative-boringssl-static-2.0.7.Final.jar
+ * Prometheus client
+    - io.prometheus-simpleclient-0.0.23.jar
+    - io.prometheus-simpleclient_common-0.0.23.jar
+    - io.prometheus-simpleclient_hotspot-0.0.23.jar
+    - io.prometheus-simpleclient_servlet-0.0.23.jar
+ * Bean Validation API -- javax.validation-validation-api-1.1.0.Final.jar
+ * Joda Time -- joda-time-joda-time-2.8.1.jar
+ * Log4J
+    - log4j-log4j-1.2.17.jar
+    - org.apache.logging.log4j-log4j-api-2.10.0.jar
+    - org.apache.logging.log4j-log4j-core-2.10.0.jar
+    - org.apache.logging.log4j-log4j-slf4j-impl-2.10.0.jar
+    - org.apache.logging.log4j-log4j-web-2.10.0.jar
+ * Java Native Access JNA -- net.java.dev.jna-jna-4.2.0.jar
+ * BookKeeper
+    - org.apache.bookkeeper-bookkeeper-server-shaded-4.7.0.jar
+    - org.apache.bookkeeper-circe-checksum-4.7.0.jar
+    - org.apache.bookkeeper.http-http-server-4.7.0.jar
+    - org.apache.bookkeeper.stats-bookkeeper-stats-api-4.7.0.jar
+    - org.apache.bookkeeper.stats-prometheus-metrics-provider-4.7.0.jar
+    - org.apache.distributedlog-distributedlog-core-shaded-4.7.0.jar
+ * LZ4 -- net.jpountz.lz4-lz4-1.3.0.jar
+ * AsyncHttpClient
+    - org.asynchttpclient-async-http-client-2.1.0-alpha26.jar
+    - org.asynchttpclient-async-http-client-netty-utils-2.1.0-alpha26.jar
+ * Jetty
+    - org.eclipse.jetty-jetty-client-9.3.11.v20160721.jar
+    - org.eclipse.jetty-jetty-continuation-9.3.11.v20160721.jar
+    - org.eclipse.jetty-jetty-http-9.3.11.v20160721.jar
+    - org.eclipse.jetty-jetty-io-9.3.11.v20160721.jar
+    - org.eclipse.jetty-jetty-proxy-9.3.11.v20160721.jar
+    - org.eclipse.jetty-jetty-security-9.3.11.v20160721.jar
+    - org.eclipse.jetty-jetty-server-9.3.11.v20160721.jar
+    - org.eclipse.jetty-jetty-servlet-9.3.11.v20160721.jar
+    - org.eclipse.jetty-jetty-servlets-9.3.11.v20160721.jar
+    - org.eclipse.jetty-jetty-util-9.3.11.v20160721.jar
+    - org.eclipse.jetty.websocket-javax-websocket-client-impl-9.3.11.v20160721.jar
+    - org.eclipse.jetty.websocket-websocket-api-9.3.11.v20160721.jar
+    - org.eclipse.jetty.websocket-websocket-client-9.3.11.v20160721.jar
+    - org.eclipse.jetty.websocket-websocket-common-9.3.11.v20160721.jar
+    - org.eclipse.jetty.websocket-websocket-server-9.3.11.v20160721.jar
+    - org.eclipse.jetty.websocket-websocket-servlet-9.3.11.v20160721.jar
+ * SnakeYaml -- org.yaml-snakeyaml-1.15.jar
+ * RocksDB - org.rocksdb-rocksdbjni-5.8.6.jar
+ * HttpClient
+    - org.apache.httpcomponents-httpclient-4.5.5.jar
+    - org.apache.httpcomponents-httpcore-4.4.9.jar
+ * Google Instrumentation API - com.google.instrumentation-instrumentation-api-0.4.3.jar
+ * Google Error Prone Annotations - com.google.errorprone-error_prone_annotations-2.0.19.jar
+ * OkHttp - com.squareup.okhttp-okhttp-2.5.0.jar
+ * Okio - com.squareup.okio-okio-1.6.0.jar
+ * Javassist -- org.javassist-javassist-3.21.0-GA.jar
+ * Amazon AWS SDK
+    - com.amazonaws-aws-java-sdk-core-1.11.297.jar
+    - com.amazonaws-aws-java-sdk-kms-1.11.297.jar
+    - com.amazonaws-aws-java-sdk-s3-1.11.297.jar
+    - com.amazonaws-jmespath-java-1.11.297.jar
+    - software.amazon.ion-ion-java-1.0.2.jar
 
 BSD 3-clause "New" or "Revised" License
- * EA Agent Loader -- com.ea.agentloader-*.jar -- licenses/LICENSE-EA-Agent-Loader.txt
- * Google auth library - com.google.auth-google-auth-library-*.jar -- licenses/LICENSE-google-auth-library.txt
- * JLine -- jline-*.jar -- licenses/LICENSE.JLine.txt
+ * EA Agent Loader
+    - com.ea.agentloader-ea-agent-loader-1.0.2.jar -- licenses/LICENSE-EA-Agent-Loader.txt
+ * Google auth library
+    - com.google.auth-google-auth-library-credentials-0.4.0.jar -- licenses/LICENSE-google-auth-library.txt
+ * JLine -- jline-jline-0.9.94.jar -- licenses/LICENSE.JLine.txt
  * LevelDB -- (included in org.rocksdb.*.jar) -- licenses/LICENSE-LevelDB.txt
- * JSR305 -- com.google.code.findbugs-jsr305-*.jar -- licenses/LICENSE-JSR305.txt
+ * JSR305 -- com.google.code.findbugs-jsr305-3.0.0.jar -- licenses/LICENSE-JSR305.txt
 
 BSD 2-Clause License
- * HdrHistogram -- HdrHistogram-*.jar -- licenses/LICENSE-HdrHistogram.txt
+ * HdrHistogram -- org.hdrhistogram-HdrHistogram-2.1.9.jar -- licenses/LICENSE-HdrHistogram.txt
 
 MIT License
- * Java SemVer -- com.github.zafarkhaja-java-semver-*.jar -- licenses/LICENSE-SemVer.txt
- * SLF4J -- org.slf4j.*.jar -- licenses/LICENSE-SLF4J.txt
- * Lombok -- org.projectlombok-*.jar  -- licenses/LICENSE-Lombok.txt
+ * Java SemVer -- com.github.zafarkhaja-java-semver-0.9.0.jar -- licenses/LICENSE-SemVer.txt
+ * SLF4J -- licenses/LICENSE-SLF4J.txt
+    - org.slf4j-jul-to-slf4j-1.7.25.jar
+    - org.slf4j-slf4j-api-1.7.25.jar
+    - org.slf4j-jcl-over-slf4j-1.7.25.jar
+ * Lombok -- org.projectlombok-lombok-1.16.20.jar  -- licenses/LICENSE-Lombok.txt
 
 Protocol Buffers License
- * Protocol Buffers -- com.google.protobuf-*.jar -- licenses/LICENSE-protobuf.txt
+ * Protocol Buffers
+   - com.google.protobuf-protobuf-java-3.5.1.jar -- licenses/LICENSE-protobuf.txt
+   - com.google.protobuf-protobuf-java-util-3.3.1.jar -- licenses/LICENSE-protobuf.txt
+   - com.google.protobuf.nano-protobuf-javanano-3.0.0-alpha-5.jar -- licenses/LICENSE-protobuf.txt
 
 CDDL-1.1 -- licenses/LICENSE-CDDL-1.1.txt
- * Java Annotations API -- javax.annotation-*.jar
- * Java Servlet API -- javax.servlet-*.jar
- * WebSocket Server API -- javax.websocket-*.jar
- * Java Web Service REST API -- javax.ws.rs.*.jar
- * HK2 - Dependency Injection Kernel -- org.glassfish.hk2*.jar
- * Jersey -- org.glassfish.jersey.*.jar
- * Javassist -- org.javassist-*.jar
- * Mimepull -- org.jvnet.mimepull-*.jar
+ * Java Annotations API -- javax.annotation-javax.annotation-api-1.2.jar
+ * Java Servlet API -- javax.servlet-javax.servlet-api-3.1.0.jar
+ * WebSocket Server API -- javax.websocket-javax.websocket-api-1.0.jar
+ * Java Web Service REST API -- javax.ws.rs-javax.ws.rs-api-2.1.jar
+ * HK2 - Dependency Injection Kernel
+    - org.glassfish.hk2-hk2-api-2.5.0-b30.jar
+    - org.glassfish.hk2-hk2-locator-2.5.0-b30.jar
+    - org.glassfish.hk2-hk2-utils-2.5.0-b30.jar
+    - org.glassfish.hk2-osgi-resource-locator-1.0.1.jar
+    - org.glassfish.hk2.external-aopalliance-repackaged-2.5.0-b30.jar
+    - org.glassfish.hk2.external-javax.inject-2.5.0-b30.jar
+ * Jersey
+    - org.glassfish.jersey.bundles.repackaged-jersey-guava-2.25.jar
+    - org.glassfish.jersey.containers-jersey-container-servlet-2.25.jar
+    - org.glassfish.jersey.containers-jersey-container-servlet-core-2.25.jar
+    - org.glassfish.jersey.core-jersey-client-2.25.jar
+    - org.glassfish.jersey.core-jersey-common-2.25.jar
+    - org.glassfish.jersey.core-jersey-server-2.25.jar
+    - org.glassfish.jersey.ext-jersey-entity-filtering-2.25.jar
+    - org.glassfish.jersey.media-jersey-media-jaxb-2.25.jar
+    - org.glassfish.jersey.media-jersey-media-json-jackson-2.25.jar
+    - org.glassfish.jersey.media-jersey-media-multipart-2.25.jar
+ * Mimepull -- org.jvnet.mimepull-mimepull-1.9.6.jar
 
 Eclipse Public License 1.0 -- licenses/LICENSE-AspectJ.txt
- * AspectJ -- org.aspectj-*.jar
+ * AspectJ
+    - org.aspectj-aspectjrt-1.8.9.jar
+    - org.aspectj-aspectjweaver-1.8.9.jar
 
 Public Domain (CC0) -- licenses/LICENSE-CC0.txt
- * Reactive Streams -- org.reactivestreams-*.jar
+ * Reactive Streams -- org.reactivestreams-reactive-streams-1.0.0.jar
 
 Bouncy Castle License
- * Bouncy Castle -- org.bouncycastle*.jar -- licenses/LICENSE-bouncycastle.txt
-
+ * Bouncy Castle -- licenses/LICENSE-bouncycastle.txt
+    - org.bouncycastle-bcpkix-jdk15on-1.55.jar
+    - org.bouncycastle-bcprov-jdk15on-1.55.jar
 
 ------------------------
 
diff --git a/src/check-binary-license b/src/check-binary-license
new file mode 100755
index 0000000..c890c87
--- /dev/null
+++ b/src/check-binary-license
@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# Script to check licenses on a binary tarball.
+# It extracts the list of bundled jars, the NOTICE, and the LICENSE
+# files. It checked that every non-pulsar jar bundled is mentioned in the
+# LICENSE file. It checked that all jar files mentioned in NOTICE and
+# LICENSE are actually bundled.
+
+# all error fatal
+set -e
+
+TARBALL="$1"
+if [ -z $TARBALL ]; then
+    echo "Usage: $0 <binary-tarball>"
+    exit -1
+fi
+
+JARS=$(tar -tf $TARBALL | grep '\.jar' | grep -v '/examples/' | grep -v '/instances/'| sed
's!.*/!!' | sort)
+
+LICENSEPATH=$(tar -tf $TARBALL  | awk '/^[^\/]*\/LICENSE/')
+LICENSE=$(tar -O -xf $TARBALL "$LICENSEPATH")
+NOTICEPATH=$(tar -tf $TARBALL  | awk '/^[^\/]*\/NOTICE/')
+NOTICE=$(tar -O -xf $TARBALL $NOTICEPATH)
+
+LICENSEJARS=$(echo "$LICENSE" | sed -nE 's!.* (.*\.jar).*!\1!gp')
+NOTICEJARS=$(echo "$NOTICE" | sed -nE 's!.* (.*\.jar).*!\1!gp')
+
+LINKEDINLICENSE=$(echo "$LICENSE" | sed -nE 's!.*(lib/[[:graph:]]*).*!\1!gp' | sed 's!\.$!!')
+
+# errors not fatal
+set +e
+
+EXIT=0
+
+
+# Check all bundled jars are mentioned in LICENSE
+for J in $JARS; do
+    echo $J | grep -q "org.apache.pulsar"
+    if [ $? == 0 ]; then
+        continue
+    fi
+
+    echo "$LICENSE" | grep -q $J
+    if [ $? != 0 ]; then
+        echo $J unaccounted for in LICENSE
+        EXIT=1
+    fi
+done
+
+# Check all jars mentioned in LICENSE are bundled
+for J in $LICENSEJARS; do
+    echo "$JARS" | grep -q $J
+    if [ $? != 0 ]; then
+        echo $J mentioned in LICENSE, but not bundled
+        EXIT=2
+    fi
+done
+
+# Check all jars mentioned in NOTICE are bundled
+for J in $NOTICEJARS; do
+    echo "$JARS" | grep -q $J
+    if [ $? != 0 ]; then
+        echo $J mentioned in NOTICE, but not bundled
+        EXIT=3
+    fi
+done
+
+
+if [ $EXIT != 0 ]; then
+    echo
+    echo It looks like there are issues with the LICENSE/NOTICE.
+fi
+
+exit $EXIT
+

-- 
To stop receiving notification emails like this one, please contact
mmerli@apache.org.

Mime
View raw message