Thank you for the details Alex. WRT SBOM generation, I think this will be become more important as time goes on, so anything we can do to improve the ecosystem will benefit us all IMO.
Gary On Sat, Aug 17, 2024, 11:03 AM Alex Herbert <alex.d.herb...@gmail.com> wrote: > Thanks Gary, see notes below... > > On Sat, 17 Aug 2024 at 15:12, Gary Gregory <garydgreg...@gmail.com> wrote: > > > > +1 > > > > - I tested the src zip files. > > - ASC OK > > - SHA512 OK > > - default Maven build OK > > - Odd output: > > > > [WARNING] > /Users/garydgregory/rc/stats/commons-statistics-1.1-src/commons-statistics-descriptive/src/main/java/org/apache/commons/statistics/descriptive/Statistics.java:[215,25] > > compose(java.util.function.LongConsumer...) in > > org.apache.commons.statistics.descriptive.Statistics is potentially > > ambiguous with compose(java.util.function.IntConsumer...) in > > org.apache.commons.statistics.descriptive.Statistics > > This is strange. I can repeat this on JDK 8 (Terumin) and 11, 17, 21 > on my Macbook (all Temurin). I don't recall seeing it before. As it is > just a warning I think this is OK. I will change the method name in > git master. It is a static method on a package private util class so > will not change binary compatibility. > > > > > [INFO] Creating SPDX File > > > /Users/garydgregory/rc/stats/commons-statistics-1.1-src/commons-statistics-distribution/target/site/org.apache.commons_commons-statistics-distribution-1.1.spdx.json > > [WARNING] The following errors were found in the SPDX file: > > License list version does not match the pattern M.N > > I always see this warning. I thought it was normal given I have not > configured anything overriding commons parent related to the SPDX > plugin. I do not know what exactly the SPDX plugin is expecting for > the license configuration. > > Note that: > target/site/org.apache.commons_commons-statistics-ranking-1.1-SNAPSHOT.spdx.json > contains: > > "licenseConcluded" : "Apache-2.0", > "licenseDeclared" : "Apache-2.0", > "licenseInfoFromFiles" : [ "NOASSERTION" ], > > So it does write in some details about the license. > > Looking at for example commons lang or text, this also has the same > warning. I will have to investigate this further, probably by digging > into the source code for the SPDX plugin. > > > > > INFO] --- javadoc:3.8.0:javadoc (default-cli) @ commons-statistics-docs > --- > > [ERROR] Error fetching link: > > > /Users/garydgregory/rc/stats/commons-statistics-1.1-src/commons-statistics-distribution/target/apidocs. > > Ignored it. > > [ERROR] Error fetching link: > > > /Users/garydgregory/rc/stats/commons-statistics-1.1-src/commons-statistics-descriptive/target/apidocs. > > Ignored it. > > [ERROR] Error fetching link: > > > /Users/garydgregory/rc/stats/commons-statistics-1.1-src/commons-statistics-ranking/target/apidocs. > > Ignored it. > > [ERROR] Error fetching link: > > > /Users/garydgregory/rc/stats/commons-statistics-1.1-src/commons-statistics-inference/target/apidocs. > > Ignored it. > > [INFO] No previous run data found, generating javadoc. > > This always happens. But the docs module does build javadoc for the > entire set of modules so it achieves its purpose for the site build. > > I will take a look as it may require some particular maven build > targets to be run in the dependency projects for javadoc. > > Note that only the inference module depends on other modules (ranking; > distribution). However I believe there is nothing in the public API > from the other modules. So it cannot be known if this warning leads to > an incorrectly cross referenced javadoc. > > Alex > > --------------------------------------------------------------------- > To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org > For additional commands, e-mail: dev-h...@commons.apache.org > >
