]
Petr Sakař updated WFLY-8418:
-----------------------------
Security: (was: Red Hat Internal)
(7.1.0) Enhance the way licenses are presented and fix
inconsistencies
----------------------------------------------------------------------
Key: WFLY-8418
URL:
https://issues.jboss.org/browse/WFLY-8418
Project: WildFly
Issue Type: Enhancement
Components: Build System
Affects Versions: 11.0.0.Alpha1
Reporter: Petr Sakař
Assignee: Petr Sakař
Priority: Critical
Labels: downstream_dependency
We need to provide a better view of the existing license information presented in the
docs/licenses.xml file, in the form of a docs/licenses.html file that lists:
Group/Artifact/Version/License (name+original URL)/Local Copy(relative pathname link to
local copy of the license in the licenses dir).
This can be achieved with an .xslt transformation that runs as part of the build process,
which produces the desired licenses.html, and it would allow us to zip and forward the
entire doc/licenses directory to a client that wants to evaluate the licenses used in
EAP.
In addition we need to sanitize a bit the presented licensing information:
- License Names should adhere to the standard presented here:
https://spdx.org/licenses/
(full license name). Apparently we present the same license using different names which
can be confusing, e.g. The Apache Software License, Version 2.0, Apache Software License,
Version 2.0, Apache License, Version 2.0, Apache 2, ASL 2.0 all refer essentially to
Apache License 2.0
- The ActiveMQ package misses license name information, it should probably be Apache
License 2.0.
- relaxngDatatype misses full license info
- Again, we shouldn't list simply "lgpl"
Some example is attached on the JIRA.
Licenses.html *MUST* contain a reference to the EAP version it applies to. It *MUST* also
contain a timestamp (or build number) to uniquely identify it should it need changes
within one EAP release cycle.