Some Tycho dependencies missing from dash license check #424
Comments
|
The Eclipse Dash License Tool's Maven plugin uses the standard Maven mechanism to resolve dependencies; the tool sees what Maven gives it. The only mechanisms that exist to skip content require that you actually configure it to do so. I see no such configuration in your build. Note that the "strict dash checking" only adds a conditional that throws an exception when it finds a dependency that is not approved; it does not impact the dependency resolution itself. The mockito libraries appear when I run locally using the latest snapshot build (which is what the GitHub action uses). It looks like the GitHub action is only finding 278 dependencies (vs. 312 when I run locally). I don't know how to account for this difference based on what I observe in the log. The TL;DR: I'm pretty sure that that it's not a bug in the Eclipse Dash License Tool itself. I don't see anything that's out of place in the GitHub action. |
|
@waynebeaton I think the intention is not that it does not work for orbit (what you seem to have used in your "working" example) but that for Tycho it is not detecting the Here is what I get for Tycho (that is not using Tycho but only "plain" maven): Then |
If my assumption is correct, I think it would be nice to have such a line in the summary for the Tycho case: |
|
By default, the Maven plugin only includes those dependencies that are in the
The Eclipse Dash License Tool provides licence information for the list of dependencies that are provided. Making an assessment that certain dependencies are considered separately/differently is not in scope. |
|
I see that explains everything. So if Tycho wants those reviewed, that's their option if they wish. |
|
I made an experiment and with that option it seem to find one not vetted license now: so at least this seem to make a difference |
|
Can you check the summary files. |
This morning I noticed this in my email
Bump org.mockito:mockito-core from 5.14.2 to 5.15.2eclipse-tycho/tycho#4585
So when I ran the Orbit updater tools and built Orbit maven-simrel
https://ci.eclipse.org/orbit/job/orbit-simrel-maven-osgi/
I just assumed that the mockito dependencies were reviewed/approved so I ran the build with strict dash checking, but the build failed:
The subsequent build without strict dash checking created the following to issues:
Then @laeubi ran the license check which recorded the summary files:
With the summary below, where indeed the mockito dependencies are missing.
Is this a bug?
The text was updated successfully, but these errors were encountered: