Create NOTICE#40
Conversation
Signed-off-by: rajapandi1234 <138785181+rajapandi1234@users.noreply.github.com>
WalkthroughA NOTICE file documenting third-party licenses used by the project has been added. The file lists Apache-2.0, MIT, and MPL-2.0 licensed components with their corresponding plugins and libraries, version inheritance notes from MOSIP Kernel BOM, and attribution requirements. No code changes. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
Pre-merge checks✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@CodeRabbit review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
NOTICE (1)
46-47: Consider improving version specificity documentation.Lines 46–47 use the placeholder phrase "version as used in project" for MOSIP Kernel Biometrics and ImageDecoder. While delegating to dependency management is reasonable, consider documenting the version constraint (e.g., range, BOM reference) for future maintainers and compliance audits.
| MOSIP | ||
| Copyright (c) 2022 | ||
| Modular Open Source Identity Platform | ||
|
|
||
| This product includes software developed at | ||
| The Apache Software Foundation (https://www.apache.org/). | ||
|
|
||
| The following third-party components are licensed under the | ||
| Apache License 2.0 and require attribution. Their original NOTICE | ||
| contents are retained as required by the Apache License 2.0. | ||
|
|
||
|
|
||
| =============================================================================== | ||
| Apache License 2.0 Components | ||
| =============================================================================== | ||
|
|
||
| • Apache Maven Source Plugin (3.3.1) | ||
| • Apache Maven GPG Plugin (3.2.3) | ||
| • Apache Maven Assembly Plugin (3.1.1) | ||
| • Apache Maven Compiler Plugin (3.11.0) | ||
| • Apache Maven Javadoc Plugin (3.2.0) | ||
| • Apache Maven Surefire Plugin (2.22.0) | ||
| • Apache Maven JAR Plugin (3.0.2) | ||
| • Apache Maven Dependency Plugin (3.1.2) | ||
| • Apache Maven Deploy Plugin (3.1.1) | ||
| • Apache Maven Resources Plugin (3.0.2) | ||
| • Jackson Core (version managed through MOSIP Kernel BOM) | ||
| • Jackson Databind (version managed through MOSIP Kernel BOM) | ||
|
|
||
|
|
||
| =============================================================================== | ||
| MIT License Components | ||
| =============================================================================== | ||
|
|
||
| • SLF4J - jul-to-slf4j | ||
| • SLF4J - jcl-over-slf4j | ||
|
|
||
|
|
||
| =============================================================================== | ||
| MPL-2.0 Components (MOSIP Kernel) | ||
| =============================================================================== | ||
|
|
||
| • MOSIP Kernel BOM (1.3.0-SNAPSHOT) | ||
| • MOSIP Kernel Core (1.3.0-SNAPSHOT) | ||
| • MOSIP Kernel Logger Logback (1.3.0-SNAPSHOT) | ||
| • MOSIP Kernel Biometrics (version as used in project) | ||
| • MOSIP Kernel ImageDecoder (version as used in project) | ||
|
|
||
|
|
||
| =============================================================================== | ||
| Notes | ||
| =============================================================================== | ||
|
|
||
| This project uses components under the following licenses: | ||
|
|
||
| • MPL-2.0: | ||
| MOSIP Kernel modules including Kernel BOM, Core, Logger, Biometrics, | ||
| and ImageDecoder. | ||
|
|
||
| • MIT: | ||
| SLF4J bridging modules such as jul-to-slf4j and jcl-over-slf4j. | ||
|
|
||
| Jackson Core and Jackson Databind versions are inherited from the | ||
| MOSIP Kernel BOM (1.3.0-SNAPSHOT) and therefore not listed explicitly. |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Find pom.xml files and other build configuration
fd -n 'pom\.xml' -o 'build\.gradle' -o 'package\.json'Repository: mosip/imagedecoder
Length of output: 292
🏁 Script executed:
# Get the root pom.xml and examine its structure
git ls-files | grep -E '(^pom\.xml|^[^/]*pom\.xml)$'Repository: mosip/imagedecoder
Length of output: 44
🏁 Script executed:
# Look for any pom.xml in the repository
fd 'pom\.xml$'Repository: mosip/imagedecoder
Length of output: 97
🏁 Script executed:
# Examine the main imagedecoder pom.xml
head -100 imagedecoder/pom.xmlRepository: mosip/imagedecoder
Length of output: 3739
🏁 Script executed:
# Check size and get the full main pom.xml
wc -l imagedecoder/pom.xmlRepository: mosip/imagedecoder
Length of output: 86
🏁 Script executed:
# Check sample pom.xml as well
wc -l sample/pom.xmlRepository: mosip/imagedecoder
Length of output: 80
🏁 Script executed:
# Read the rest of imagedecoder/pom.xml
tail -n +100 imagedecoder/pom.xmlRepository: mosip/imagedecoder
Length of output: 6857
🏁 Script executed:
# Read the full sample/pom.xml
cat sample/pom.xmlRepository: mosip/imagedecoder
Length of output: 6622
🏁 Script executed:
# Check if there's any LICENSE or related documentation in the repo
fd -n 'LICENSE|COPYING' --type fRepository: mosip/imagedecoder
Length of output: 292
🏁 Script executed:
# Look for any documentation about licensing or dependencies
fd -n 'README|CONTRIBUTING|LICENSE' --type f -iRepository: mosip/imagedecoder
Length of output: 292
🏁 Script executed:
# Find LICENSE and README files
fd 'LICENSE|README' --type fRepository: mosip/imagedecoder
Length of output: 94
🏁 Script executed:
# Check what documentation files exist in the root
git ls-files | head -30Repository: mosip/imagedecoder
Length of output: 2049
🌐 Web query:
jacoco-maven-plugin Apache license
💡 Result:
The jacoco-maven-plugin is distributed under the Eclipse Public License version 2.0 (EPL-2.0). [1][2]
Sources:
- JaCoCo license page stating distribution under the Eclipse Public License 2.0. [1]
- jacoco-maven-plugin source header (AgentMojo.java) showing SPDX: EPL-2.0. [2]
🌐 Web query:
central-publishing-maven-plugin license
💡 Result:
The central-publishing-maven-plugin is licensed under the Apache License 2.0. [1][2]
Sources:
[1] Sonatype Central publishing docs.
[2] Maven Repository listing for org.sonatype.central:central-publishing-maven-plugin.
🌐 Web query:
git-commit-id-plugin license
💡 Result:
The git-commit-id-maven-plugin is released under the GNU Lesser General Public License v3 (LGPL-3.0). [1][2]
Sources:
- GitHub repository license section. [1]
- Plugin documentation (project site). [2]
🌐 Web query:
sonar-maven-plugin license
💡 Result:
The Sonar Maven plugin (SonarScanner for Maven) is licensed under the GNU Lesser General Public License v3.0 (LGPL-3.0). (github.com)
Citations:
Update NOTICE file to match actual project dependencies and correct version discrepancies.
The NOTICE file has several critical inaccuracies when compared to the actual build configuration:
-
MOSIP Kernel version is outdated: Both pom.xml files specify 1.2.1-SNAPSHOT, but NOTICE lists 1.3.0-SNAPSHOT for Kernel BOM, Core, and Logger Logback.
-
Missing build plugins:
central-publishing-maven-plugin(0.7.0) – Apache License 2.0maven-dependency-plugin(3.1.2) – Apache License 2.0 (used in sample/pom.xml)maven-resources-plugin(3.0.2) – Apache License 2.0 (used in sample/pom.xml)jacoco-maven-plugin(0.8.11) – Eclipse Public License 2.0 (EPL-2.0)git-commit-id-plugin(3.0.1) – GNU Lesser General Public License 3.0 (LGPL-3.0)sonar-maven-plugin(3.7.0.1746) – GNU Lesser General Public License 3.0 (LGPL-3.0)
-
Phantom dependencies: "MOSIP Kernel Biometrics" and "MOSIP Kernel ImageDecoder" are listed but are not actual external dependencies in the pom.xml files.
-
New license categories needed: Add sections for EPL-2.0 and LGPL-3.0 components to the NOTICE structure.
2 participants
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.