{"id":23286721,"url":"https://github.com/deviceinsight/dependency-license-exporter","last_synced_at":"2025-04-06T15:35:12.806Z","repository":{"id":46456559,"uuid":"278067342","full_name":"deviceinsight/dependency-license-exporter","owner":"deviceinsight","description":null,"archived":false,"fork":false,"pushed_at":"2025-03-05T16:20:01.000Z","size":40,"stargazers_count":4,"open_issues_count":0,"forks_count":1,"subscribers_count":7,"default_branch":"develop","last_synced_at":"2025-03-05T16:24:22.800Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"FreeMarker","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/deviceinsight.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-07-08T11:09:39.000Z","updated_at":"2025-03-05T16:19:59.000Z","dependencies_parsed_at":"2022-08-02T19:01:34.526Z","dependency_job_id":null,"html_url":"https://github.com/deviceinsight/dependency-license-exporter","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deviceinsight%2Fdependency-license-exporter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deviceinsight%2Fdependency-license-exporter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deviceinsight%2Fdependency-license-exporter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deviceinsight%2Fdependency-license-exporter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/deviceinsight","download_url":"https://codeload.github.com/deviceinsight/dependency-license-exporter/tar.gz/refs/heads/develop","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247503928,"owners_count":20949542,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-20T02:14:10.170Z","updated_at":"2025-04-06T15:35:12.801Z","avatar_url":"https://github.com/deviceinsight.png","language":"FreeMarker","funding_links":[],"categories":[],"sub_categories":[],"readme":"# dependency-license-exporter\n\nThis repo is a small maven project which generates a `jar` to place config files on the classpath\nwhen generating dependency license information using [License Maven Plugin](https://www.mojohaus.org/license-maven-plugin/).\nThese config files allows for a generated license list that matches the company requirements.\n\n## Quick Start\n\nAdd a maven profile to your `pom.xml`:\n\n```xml\n\u003cproject\u003e\n    \u003c!-- ... --\u003e\n    \u003cproperties\u003e\n        \u003c!-- licenses --\u003e\n        \u003clicense-maven-plugin.version\u003e2.0.0\u003c/license-maven-plugin.version\u003e\n        \u003cdependency-license-exporter.version\u003e1.1.1\u003c/dependency-license-exporter.version\u003e\n    \u003c/properties\u003e\n\n    \u003c!-- ... --\u003e\n    \u003cprofiles\u003e\n        \u003cprofile\u003e\n            \u003cid\u003ecreate-license-list\u003c/id\u003e\n            \u003cbuild\u003e\n                \u003cplugins\u003e\n                    \u003cplugin\u003e\n                        \u003cgroupId\u003eorg.codehaus.mojo\u003c/groupId\u003e\n                        \u003cartifactId\u003elicense-maven-plugin\u003c/artifactId\u003e\n                        \u003cversion\u003e${license-maven-plugin.version}\u003c/version\u003e\n                        \u003cdependencies\u003e\n                            \u003cdependency\u003e\n                                \u003cgroupId\u003ecom.deviceinsight\u003c/groupId\u003e\n                                \u003cartifactId\u003edependency-license-exporter\u003c/artifactId\u003e\n                                \u003cversion\u003e${dependency-license-exporter.version}\u003c/version\u003e\n                            \u003c/dependency\u003e\n                        \u003c/dependencies\u003e\n                        \u003cconfiguration\u003e\n                            \u003cuseMissingFile\u003etrue\u003c/useMissingFile\u003e\n                            \u003clicenseMergesUrl\u003eclasspath:license-merges.txt\u003c/licenseMergesUrl\u003e\n                            \u003coverrideUrl\u003eclasspath:override-licenses.txt\u003c/overrideUrl\u003e\n                            \u003cincludedLicenses\u003eclasspath:allowed-licenses-for-deviceinsight.txt\u003c/includedLicenses\u003e\n                            \u003cuseMissingFile\u003efalse\u003c/useMissingFile\u003e\n                            \u003cexcludeTransitiveDependencies\u003etrue\u003c/excludeTransitiveDependencies\u003e\n                            \u003cincludeTransitiveDependencies\u003efalse\u003c/includeTransitiveDependencies\u003e\n                            \u003cexcludedScopes\u003etest,provided\u003c/excludedScopes\u003e\n                            \u003cexcludedGroups\u003e^com\\.deviceinsight|^net\\.centersight\u003c/excludedGroups\u003e\n                            \u003cthirdPartyFilename\u003edependencies-license.adoc\u003c/thirdPartyFilename\u003e\n                            \u003cfileTemplate\u003e/com/deviceinsight/license/exporter/adoc-template.ftl\u003c/fileTemplate\u003e\n                            \u003coutputDirectory\u003e${project.basedir}\u003c/outputDirectory\u003e\n                        \u003c/configuration\u003e\n                        \u003cexecutions\u003e\n                            \u003cexecution\u003e\n                                \u003cid\u003ecreate-license-list\u003c/id\u003e\n                                \u003cgoals\u003e\n                                    \u003c!-- choose one of these goals for your project --\u003e\n                                    \u003cgoal\u003eadd-third-party\u003c/goal\u003e\n                                    \u003cgoal\u003eaggregate-add-third-party\u003c/goal\u003e\n                                \u003c/goals\u003e\n                                \u003cphase\u003egenerate-resources\u003c/phase\u003e\n                            \u003c/execution\u003e\n                        \u003c/executions\u003e\n                    \u003c/plugin\u003e\n                \u003c/plugins\u003e\n            \u003c/build\u003e\n        \u003c/profile\u003e\n    \u003c/profiles\u003e\n\u003c/project\u003e\n```\n\nNow run the following command and a file `dependencies-license.adoc` should be generated in the root folder of the project:\n```bash\nmvn clean generate-resources -Pcreate-license-list\n```\nOr invoke the goal directly:\n```bash\nmvn license:add-third-party\nmvn license:aggregate-add-third-party\n```\n\n## Configuration Guide\n\n\n### Overriding Default Configuration Files\n\nEach project can also override the files included in this plugin with their own, e.g.:\n```xml\n    \u003cconfiguration\u003e\n        \u003c!-- Use custom allowed licenses list --\u003e\n        \u003cincludedLicenses\u003efile:/${maven.multiModuleProjectDirectory}/dependencies-license-allowed.txt\u003c/includedLicenses\u003e\n        \u003c!-- Use custom template --\u003e\n        \u003cfileTemplate\u003e${project.basedir}/dependencies-license-template.ftl\u003c/fileTemplate\u003e\n        \u003c!-- ... --\u003e\n    \u003c/configuration\u003e\n```\n\n### Overriding Found Licenses\n\nIf [License Maven Plugin](https://www.mojohaus.org/license-maven-plugin/) determines a license for a dependency but the\nlicense is incorrect or not specific enough, we can override it:\n\nIn this repo we maintain file with license overrides (`src/main/resources/override-licenses.txt`) where license information can be added.\nthis file is loaded via `overrideUrl` configuration in the profile above.\n\n#### File Format\n\n```text\n${mavenGroupId}--${mavenArtifactId}--${version}=${license}\n```\n\nNOTE: `${license}` should be the `spdx identifier` of the license (see: https://spdx.org/licenses/).\n\n### Missing Licenses\n\nIf [License Maven Plugin](https://www.mojohaus.org/license-maven-plugin/) was unable to determine the license for a dependency\nthe license can manually be added. Missing licenses can be added in two ways:\n\n- Recommended way: Define the license in license overrides, see above\n- If you do not want to define the license in that central place for whatever reason, it is possible to define\n  it in the local project.\n  * Remove the configuration `\u003cuseMissingFile\u003etrue\u003c/useMissingFile\u003e` or define it as `false`\n  * The build will generate a file `src/license/THIRD-PARTY.properties`, see: [missingFile configuration](https://www.mojohaus.org/license-maven-plugin/add-third-party-mojo.html#missingFile)\n  * Define the license in that file \\\n   The file format is the same as in the license overrides\n  * Note: The `override-licenses.txt` will override that definition\n\n\n### Merging Licenses\n\nDependencies might declare the name of the same license in different ways e.g. (`Apache 2`, `Apache 2.0`, `...`) in order\nto consolidate the used licenses different names can be merged into one using the file `src/main/resources/license-merges.txt`\nwhich is loaded via `licenseMergesUrl` configuration in the profile above.\n\n#### File Format\n\n```text\n${spdx identifier}|${license spelling A}|${license spelling B}|${license spelling C}\n```\n\nIn order to have a consistent naming of the licenses the first entry in a row should be the `spdx identifier` of the\nlicense (see: https://spdx.org/licenses/).\n\nWhenever a new `spdx identifier` is added, make sure to add it to the output templates as well, e.g.\n`src/main/resources/com/deviceinsight/license/exporter/adoc-template.ftl`.\nThis way we can directly generate a link to the license description.\n\n### Multi module project\n\nThere are two different goals: `add-third-party` and `aggregate-add-third-party`.\nWith `add-third-party` the dependency file is created for each module.\nIf only one dependency file in a multi module project should be generated, the `aggregate-add-third-party` goal can be used.\n\n### Allowed Licenses\nProjects can be configured to fail at build time when containing a library whose license is not allowed:\n\n```xml\n    \u003cconfiguration\u003e\n        \u003cfailOnBlacklist\u003etrue\u003c/failOnBlacklist\u003e\n        \u003cincludedLicenses\u003eclasspath:allowed-licenses.txt\u003c/includedLicenses\u003e\n    \u003c/configuration\u003e\n```\n\n### Built-in Templates for Generated License List\nThis plugin provides two built-in asciidoc templates for the generated license files.\n`adoc-template.ftl` lists the libraries with groupId:artifactId, version, URL and the SPDX link to the license.\n`adoc-template-four-columns.ftl` lists the libraries with human readable name - linked to the library's homepage, \ngroupId:artifactId, version,  and the SPDX link to the license.\n\n```xml\n    \u003cconfiguration\u003e\n        \u003cfileTemplate\u003e/com/deviceinsight/license/exporter/adoc-template-four-columns.ftl\u003c/fileTemplate\u003e\n        \u003c!-- ... --\u003e\n    \u003c/configuration\u003e\n```\n\n## Releasing\n\nCreating a new release involves the following steps:\n\n* `mvn gitflow:release-start gitflow:release-finish`\n* `git push origin master`\n* `git push --tags`\n* `git push origin develop`\n\nIn order to deploy the release to Maven Central, you need to create an account at https://central.sonatype.com.\n\nThen, generate a login token at https://oss.sonatype.org at _Profile_ / _User Token_. Add this login token to the file `~/.m2/settings.xml`:\n\n```xml\n\u003csettings\u003e\n  \u003cservers\u003e\n    \u003cserver\u003e\n      \u003cid\u003eossrh\u003c/id\u003e\n      \u003cusername\u003e...token-username...\u003c/username\u003e\n      \u003cpassword\u003e...token-password...\u003c/password\u003e\n    \u003c/server\u003e\n  \u003c/servers\u003e\n\u003c/settings\u003e\n```\n\nThe account also needs access to the project on Maven Central. This can be requested by another project member.\n\nThen check out the release you want to deploy (`git checkout x.y.z`) and run `mvn deploy -Prelease`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeviceinsight%2Fdependency-license-exporter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdeviceinsight%2Fdependency-license-exporter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeviceinsight%2Fdependency-license-exporter/lists"}