zhoujinsong opened a new pull request, #4430:
URL: https://github.com/apache/amoro/pull/4430
- Add a 'npm packages bundled into the dashboard (amoro-web)' section to
LICENSE-binary covering all bundled frontend libraries (MIT and Apache-2.0)
- Add NOTICE-binary entries for the Apache-2.0 bundled packages (echarts,
swagger-ui)
- Ship the amoro-web/licenses directory inside the dashboard jar so the
third-party license texts are distributed with the artifacts
- Sync the licenses directory with package.json: add missing entries
(vue-virtual-scroller, @vue/devtools-api, swagger-ui, swagger-ui-dist,
vite-plugin-vue-devtools) and remove stale ones (@tsconfig/node18, babel,
unplugin-auto-import, vue-draggable-plus)
<!--
Thanks for sending a pull request!
Here are some tips for you:
1. If this is your first time, please read our contributor guidelines:
https://amoro.apache.org/how-to-contribute/
2. If the PR is related to an issue in
https://github.com/apache/amoro/issues, add '[AMORO-XXXX]' in your PR title,
e.g., '[AMORO-XXXX] Your PR title ...'.
3. If the PR is unfinished, add '[WIP]' in your PR title, e.g.,
'[WIP][AMORO-XXXX] Your PR title ...'.
-->
## Why are the changes needed?
<!--
Please clarify why the changes are needed. For instance,
1. If you add a feature, you can talk about its use case.
2. If you fix a bug, you can clarify why it is a bug.
3. Use Fix/Resolve/Close #{ISSUE_NUMBER} to link this PR to its related
issue
-->
This PR fixes missing third-party license declarations for the frontend
dependencies bundled into the `amoro-web` dashboard.
The dashboard build (vite) bundles ~14 npm packages directly into the
static assets shipped inside `amoro-web-*.jar`, but neither
`LICENSE-binary` nor `NOTICE-binary` declared any of them. This gap was
found during the 0.9.0 release validation.
## Brief change log
<!--
Clearly describe the changes made in modules, classes, methods, etc.
-->
1. **LICENSE-binary**
- Add a "npm packages bundled into the dashboard (amoro-web)" section
to the `MIT License` group (14 packages: vue, vue-router, pinia,
ant-design-vue, axios, dayjs, monaco-editor, echarts, swagger-ui, ...)
- Add the Apache-2.0 bundled packages (echarts, swagger-ui,
swagger-ui-dist) to the `Apache License Version 2.0` group
2. **NOTICE-binary**
- Add copyright entries for the Apache-2.0 bundled packages
(Apache ECharts, swagger-ui), as required for NOTICE-bearing
licenses. MIT packages require no NOTICE entries.
3. **amoro-web/pom.xml**
- Package the `licenses/` directory into the dashboard jar under
`/licenses/`, so the full license texts are distributed with the
artifacts and downstream users can verify them.
4. **amoro-web/licenses/ (sync with package.json)**
- Add missing entries: `vue-virtual-scroller`, `@vue/devtools-api`,
`swagger-ui`, `swagger-ui-dist`, `vite-plugin-vue-devtools`
- Remove stale entries for dependencies no longer used:
`@tsconfig/node18`, `babel`, `unplugin-auto-import`,
`vue-draggable-plus`
## How was this patch tested?
- `mvn package -pl amoro-web -Pskip-dashboard-build`: verified the
`licenses/` directory is packaged into `amoro-web-*.jar` (30 entries)
- `mvn apache-rat:check`: BUILD SUCCESS
- Manually cross-checked `licenses/` against `package.json`
(14 dependencies + 18 devDependencies) — no missing or stale entries
- Verified bundled packages actually appear in the built static assets
## Documentation
- Does this pull request introduce a new feature? ( no)
- If yes, how is the feature documented? (not applicable)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
