MOSIP-43813 - Update THIRD-PARTY-NOTICES with package details #450
Conversation
Added detailed third-party package information including licenses, versions, and homepages. Signed-off-by: Rakshithasai123 <rakshithasai2002@gmail.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (1)
Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@CodeRabbit please review the changes and the licenses in the THIRD-PARTY-NOTICES.txt |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 7739 🏁 Script executed: Length of output: 32335 🏁 Script executed: Length of output: 3965 🏁 Script executed: Length of output: 4668 🌐 Web query: 💡 Result: SLF4J is distributed under the MIT (X11) permissive license. [1][2] Sources:
🌐 Web query: 💡 Result: Bouncy Castle is released under the MIT license. (bouncycastle.org) [1] Some Bouncy Castle components include third‑party code with other licenses (e.g., OpenPGP uses a modified bzip2 under Apache‑2.0; MLS client uses Apache‑2.0 and protobuf under BSD‑3‑Clause). (bouncycastle.org) [2] Sources: Citations:
🌐 Web query: 💡 Result: H2 is dual‑licensed: Mozilla Public License 2.0 (MPL 2.0) OR Eclipse Public License 1.0 (EPL 1.0). [1][2] Sources: 🌐 Web query: 💡 Result: The PostgreSQL (pgJDBC) JDBC driver is released under the BSD 2‑clause (“Simplified”) license. You may use, modify and redistribute it provided you retain the copyright/notice and disclaimer in source/binary distributions. [1][2] Sources: @Rakshithasai123, I've completed a thorough review of the THIRD-PARTY-NOTICES.txt file and compared it against the actual dependencies in your pom.xml files. Here are my findings: ✅ Positives
|
|
@CodeRabbit please review the changes and the licenses in the THIRD-PARTY-NOTICES.txt and does the dependencies have the exact licenses as we mentioned THIRD-PARTY-NOTICES.txt |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 7633 🌐 Web query: 💡 Result: JSON.simple (com.googlecode.json-simple) is licensed under the Apache License, Version 2.0. [1][2][3] Sources:
🌐 Web query: 💡 Result: Yes — Mockito is released under the MIT License. [1][2] Sources:
🌐 Web query: 💡 Result: Yes — Google Gson is released under the Apache License, Version 2.0. [1][2] Sources:
🌐 Web query: 💡 Result: Yes — JUnit 5 (including the Jupiter modules) is released under the Eclipse Public License v2.0 (EPL‑2.0). [1][2] Sources:
🌐 Web query: 💡 Result: Yes — springdoc-openapi is released under the Apache License 2.0. [1][2] Sources:
🌐 Web query: 💡 Result: Yes. ModelMapper (groupId org.modelmapper / artifactId modelmapper) is released under the Apache License, Version 2.0. [1][2] Sources: 🌐 Web query: 💡 Result: Yes — PowerMock is released under the Apache License, Version 2.0. [1][2] Sources:
🌐 Web query: 💡 Result: The git-commit-id-maven-plugin is released under the GNU LGPL v3.0 (not Apache 2.0). [1] Sources: @Rakshithasai123, I've completed a thorough verification of all licenses listed in your THIRD-PARTY-NOTICES.txt file against authoritative sources. Here's my detailed analysis: ✅ Correct Licenses (16 out of 18 packages)The following packages have accurate license information:
❌ Issues Found (2 packages)1. H2 Database -
|
Signed-off-by: Rakshithasai123 <rakshithasai2002@gmail.com>
|
@CodeRabbit please review the changes and the licenses in the THIRD-PARTY-NOTICES.txt and does the dependencies have the exact licenses as we mentioned THIRD-PARTY-NOTICES.txt |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 8145 @Rakshithasai123, excellent work! 🎉 I've reviewed the updated THIRD-PARTY-NOTICES.txt file, and I'm happy to confirm that all licenses are now 100% accurate! ✅ All 18 Packages Have Correct LicensesYou've successfully corrected the two issues I identified:
All other 16 packages were already accurate and remain correct:
📝 One Minor NoteThe file references a "license/ directory" at the end: This directory doesn't currently exist in the repository. If you plan to add the full license texts, you'll need to create this directory. Otherwise, you may want to update or remove this statement. 🎯 Final VerdictLicense Accuracy: 100% (18/18 packages correct) ✅ Your THIRD-PARTY-NOTICES.txt file now accurately reflects all the licenses for the dependencies used in your project. Great job on making the corrections! (/^◕ω◕^)/ 🎊 |
|
Rakshithasai123_mosip-mock-services_822228.json Your responsibilities: ────────────────────────────────────────
For every dependency found, verify:
──────────────────────────────────────── ✔ Package name matches the actual pom.xml / module POM dependency Do not accept inferred or guessed licenses or versions unless confirmed from authoritative official sources. ────────────────────────────────────────
For each of these, also confirm that:
──────────────────────────────────────── Validate:
Report any differences across: ────────────────────────────────────────
Ensure the license text and identifier in THIRD-PARTY-NOTICES.txt is EXACT and compliant with the official SPDX definition for that license. ──────────────────────────────────────── • Dependencies present in pom.xml or SBOM but missing in THIRD-PARTY-NOTICES.txt ──────────────────────────────────────── ✔ 100% accurate Please output your findings in a clear, structured format suitable for immediate PR updates. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 7720 🏁 Script executed: Length of output: 60238 🏁 Script executed: Length of output: 53940 🏁 Script executed: Length of output: 7293 🏁 Script executed: Length of output: 3973 🏁 Script executed: Length of output: 8069 🏁 Script executed: Length of output: 69779 🏁 Script executed: Length of output: 4066 🏁 Script executed: Length of output: 3806 I'll now search for license information for the major missing dependencies and then compile the comprehensive validation report. Now let me search for license information for the major missing dependencies: 🏁 Script executed: Length of output: 775 🏁 Script executed: Length of output: 280 🌐 Web query: 💡 Result: Project Lombok is released under the MIT License (the project's LICENSE file / “Project Lombok License”). [1][2] Sources: 🌐 Web query: 💡 Result: Apache HttpComponents (including HttpClient and HttpCore) is released under the Apache License, Version 2.0. (hc.apache.org) Note: some bundled third‑party dependencies included with HttpComponents may use other licenses—see the project’s “Licenses” pages for per-module details. (hc.apache.org) Citations:
🌐 Web query: 💡 Result: Short answer: Spring Cloud is released under the Apache License, Version 2.0 (Apache‑2.0). [1][2] Sources:
🌐 Web query: 💡 Result: Micrometer (the core library and related repositories) is licensed under the Apache License 2.0. [1][2] Sources:
Now let me compile the comprehensive validation report based on all the data collected: Now let me generate a ready-to-use corrected version of the critical sections: 🏁 Script executed: Length of output: 6004 🏁 Script executed: Length of output: 4265 🏁 Script executed: Length of output: 13087 🏁 Script executed: Length of output: 10895 Executive summary
What I compared
MOSIP-specific
Build/test plugins (include per policy)
Ready-to-paste corrections for THIRD-PARTY-NOTICES.txt
B) Narrow existing sections
C) Add missing packages (critical) ================================================================================
|
|
@CodeRabbit which of these libraries need or mandatory a copyright test? Also, give the files what is the copyright year and date who is the copyright for, like Lombok, Junit, or Sonar, like that |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 6222 🌐 Web query: 💡 Result: Use the MIT text plus the Project Lombok copyright header from the project's LICENSE. For current Lombok releases the license header is: Copyright (C) 2009–2021 The Project Lombok Authors. Include that line followed by the full MIT permission notice (the standard MIT license text). (github.com) Citations: 🌐 Web query: 💡 Result: You should include the EPL‑2.0 license file and a short copyright header in source files. JUnit’s repositories are licensed EPL‑2.0 and their source files use a header like the example below: Sample header to add to source files:
*/ Also include the full EPL‑2.0 text (LICENSE) or a NOTICE file where recipients will look (e.g., project root). JUnit’s projects and repo license pages show EPL‑2.0 as the project license. [1][2] Sources: 🌐 Web query: 💡 Result: Short answer: The SonarQube Maven plugin (sonar-maven-plugin / older SonarQube artifacts) has been distributed under GNU LGPL v3. Include the LGPLv3 copyright notice and the FSF copyright line (GNU LESSER GENERAL PUBLIC LICENSE Version 3 — Copyright (C) 2007 Free Software Foundation, Inc.) with the full license text or a pointer to it. SonarSource’s license page and Maven listings confirm LGPL‑3.0 for SonarQube/plugins; note SonarSource introduced a separate SSALv1 for bundled analyzers in late 2024 (doesn't change the LGPLv3 notice for the plugin itself). [1][2][3] Sources:
🌐 Web query: 💡 Result: Include the standard Apache License 2.0 header and the project NOTICE contents. Recommended boilerplate for source files is the ASF header shown in the ASF policy: Licensed to the Apache Software Foundation (ASF) under one (Plus the standard “AS IS” disclaimer). See the ASF Source Header and Copyright Notice Policy. [1] Also include the project’s NOTICE text (which provides the attribution/copyright years and “This product includes software developed at The Apache Software Foundation”) distributed with HttpComponents releases (see the HttpComponents project licenses / NOTICE information). [2] References: 🌐 Web query: 💡 Result: Mockito is released under the MIT License. The canonical copyright line used is: "Copyright (c) 2007 Mockito contributors" (the project and downstream packaging sometimes list additional years/years ranges). [1][2] Sources:
🌐 Web query: 💡 Result: Use the Apache License 2.0 boilerplate plus Spring’s copyright line. For Spring source files/package headers include e.g.: Copyright (c) 2002-2025 Pivotal, Inc. (Replace 2025 with the correct end year for the Spring release you distribute.) See the Apache “how to apply” boilerplate and Spring’s license/notice text for examples. [1][2][3] Sources:
🌐 Web query: 💡 Result: The PostgreSQL JDBC (pgJDBC) driver is released under the BSD 2‑clause ("Simplified") License. The license header used is: Copyright (c) 1997, PostgreSQL Global Development Group. All rights reserved. Key requirements: (1) Redistributions of source must retain the copyright notice, license conditions and disclaimer; (2) Redistributions in binary form must reproduce them in documentation or other materials. The standard BSD‑2‑clause disclaimer of warranty/liability also applies. [1] Official pgJDBC license page: [1]. Additional project info: pgJDBC home page. [2] Sources: 🌐 Web query: 💡 Result: Use Bouncy Castle's MIT-style license header. Recommended text (replace year range if you need a different last year): Copyright (c) 2000–2023 The Legion of the Bouncy Castle Inc. (https://www.bouncycastle.org) Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. [1] Source: Bouncy Castle license page. [1] References Copyright Notice Requirements for DependenciesBased on the SBOM analysis and license requirements, here's a comprehensive breakdown of which libraries require copyright notices (legally mandatory) and their copyright information: 📋 MANDATORY Copyright Notices by License TypeApache License 2.0 Dependencies ✅ MANDATORYApache-2.0 requires: copyright notice + NOTICE file + license text
License Text Snippet (Apache-2.0): MIT License Dependencies ✅ MANDATORYMIT requires: copyright notice must be retained
License Text for Lombok (MIT): License Text for Mockito (MIT): License Text for Bouncy Castle (MIT): Eclipse Public License 2.0 ✅ MANDATORYEPL-2.0 requires: copyright notice
License Text for JUnit (EPL-2.0): License Text for Jacoco (EPL-2.0): BSD License Dependencies ✅ MANDATORYBSD requires: copyright notice must be retained
License Text for PostgreSQL (BSD-2-Clause): License Text for JAI ImageIO Core (BSD-3-Clause): License Text for JAI JPEG2000 (BSD-3-Clause-No-Nuclear-License): LGPL-3.0 License Dependencies ✅ MANDATORYLGPL-3.0 requires: copyright notice + source availability
License Text for LGPL-3.0: CDDL/GPL Dual-Licensed ✅ MANDATORYCDDL requires: copyright notice
License Text (CDDL-1.1): Mozilla Public License 2.0 ✅ MANDATORYMPL-2.0 requires: copyright notice
License Text (MPL-2.0): 📝 Summary of Copyright RequirementsCritical (Must Include)
Recommended Actions
Would you like me to generate a complete |
|
@CodeRabbit which of these libraries need or mandatory a copyright test? Also, give the files what is the copyright year and date who is the copyright for, like Lombok, Junit, or Sonar, like that |
|
Tip For best results, initiate chat on the files or code changes. @Rakshithasai123, I provided a comprehensive answer to this exact question in my previous response above. That response includes: ✅ Complete copyright information for all dependencies, organized by license type:
✅ Full license text snippets for each license type with copyright placeholders ✅ Specific examples for the libraries you mentioned:
Could you clarify what additional information you need? Would you like me to:
Please let me know what would be most helpful! 😊 |
@CodeRabbit which of these libraries need or mandatory a copyright test? Also, give the files what is the copyright year and date who is the copyright for, like Lombok, Junit, or Sonar, like that
|
|
Tip For best results, initiate chat on the files or code changes. @Rakshithasai123, here's your complete COPYRIGHT NOTICES file in the exact format you requested, including all dependencies that legally require copyright attribution: This COPYRIGHT NOTICES file includes: ✅ All 50+ dependencies organized by license type Key highlights:
You can place this file in your repository root as |
Signed-off-by: Rakshithasai123 <rakshithasai2002@gmail.com>
1 participant
Added detailed third-party package information including licenses, versions, and homepages.