Eclipse Dash License Tool and The Maven Reactor

Posted on 3 mins read

The Eclipse Dash License Tool identifies the licenses of content. It is intended primarily for use by Eclipse committers to vet third party content used by their Eclipse open source project.

The license tool has a Maven plugin that you can use find license information for all of your Maven project’s dependencies. That is, the Maven plugin can identify the entire transitive closure of dependencies described in your project’s pom.xml file(s) (dependencies of dependencies recursively) and from that sort out curated license information.

You can generate a file that summarizes the licenses of all of the dependencies by asking the plugin to create a summary file.

$ mvn org.eclipse.dash:license-tool-plugin:license-check -Ddash.summary=DEPENDENCIES
...
$ cat DEPENDENCIES
maven/mavencentral/com.fasterxml.jackson.core/jackson-annotations/2.10.3, Apache-2.0, approved, CQ21280
maven/mavencentral/com.fasterxml.jackson.core/jackson-core/2.10.3, Apache-2.0, approved, CQ21186
maven/mavencentral/com.fasterxml.jackson.core/jackson-databind/2.10.3, Apache-2.0, approved, CQ21187
maven/mavencentral/com.fasterxml.jackson.jaxrs/jackson-jaxrs-base/2.10.3, Apache-2.0, approved, #813
maven/mavencentral/com.fasterxml.jackson.jaxrs/jackson-jaxrs-json-provider/2.10.3, Apache-2.0, approved, #811
maven/mavencentral/com.fasterxml.jackson.module/jackson-module-jaxb-annotations/2.10.3, Apache-2.0, approved, #816
...
$ _

The Maven plugin gets its information from the Maven reactor. The Maven reactor works through dependency declarations; sorts out dependencies of dependencies, dependencies of dependencies of dependencies, and so on; and mashes it all together to build a comprehensive list of dependencies while downloading half of Maven Central into your local cache. The short version is that as far as the Dash License Tool is concerned, when the Maven reactor thinks that a particular library is a dependency, it’s a dependency, whether you agree with the assessment or not.

I’m certainly not a Maven expert, all I know for certain is that saying things like “the Maven reactor something-or-other…” makes me feel like I sound smart.

The dependency plugin uses the same information. If you’re not sure why a particularly library is being included, you can use the dependency plugin to find out. In the example below, the sshd-core library is being pulled in as a prerequisite of ssh-sftp, and sshd-common as a prerequisite of sshd-core:

$ mvn dependency:tree
...
[INFO] +- org.apache.sshd:sshd-sftp:jar:2.8.0:compile
[INFO] |  \- org.apache.sshd:sshd-core:jar:2.8.0:compile
[INFO] |     \- org.apache.sshd:sshd-common:jar:2.8.0:compile
...

Maven doesn’t know what you mean, it only knows what you say. If you’re certain that the prerequisites aren’t really needed or shouldn’t be included in the generated list of project dependencies, you have three options:

The first (and IMHO best) option is to exclude the transient dependencies in the pom.xml file. By adding exclusions to your dependency declaration, you can force the Maven reactor to skip those libraries:

...
<dependency>
    <groupId>org.apache.sshd</groupId>
    <artifactId>sshd-sftp</artifactId>
    <version>${apache-sshd-version}</version>
    <exclusions>
        <exclusion>
            <groupId>org.apache.sshd</groupId>
            <artifactId>sshd-core</artifactId>
        </exclusion>
        <exclusion>
            <groupId>org.apache.sshd</groupId>
            <artifactId>sshd-common</artifactId>
        </exclusion>
    </exclusions>
</dependency>
...

I describe this as the best option because it forces you to express your intent with precision (and lets the tools validate your belief that you “don’t use” a particular library).

The second option is to tell the Dash License Tool to skip specific groups or artifacts. You can use the excludeArtifactIds option when you invoke the license tool:

$ mvn -DexcludeArtifactIds=sshd-core,sshd-commons org.eclipse.dash:license-tool-plugin:license

The third option is either automatically or manually modify the generated output. This option is terrible: friends don’t let friends modify generated content.