Include project LICENSE and NOTICE in app JAR and image #24

New Issue

2026-10-01T04:36:52Z

KofTwentyTwo commented

2026-10-01 04:36:52 +00:00

(Migrated from github.com)

The verified public-snapshot app JAR (SHA256f5d02f7e27cd6e238550625c6a5172456ba6a1c897223201ff470b94554ebaf6) contains70notice-like dependency entries but no exact copies of qqq-all root LICENSE or NOTICE. Dockerfile currently copies only this JAR. This extends QQQ#923 packaged-notice acceptance to the distribution itself; parent/BOM POM-only artifacts are not missing JARs.

Include the exact repository documents in the app artifact under a project-specific path that avoids shaded dependency collisions, and in the image. Preserve all existing dependency notices, application resources/classes and image startup behavior. Add a meaningful packaged-artifact check demonstrating failure on baseline and success on the correction. Verify the actual local JAR and image files without claiming GHCR publication. No dependency/version/Next or release-gate changes. Reviewed signed integration and hosted checks are required; actual public-image acceptance remains under#10 after GHCR access/visibility and released dependency gates.

Implementation: PR #25, signed commit 6d981933b9687ffbceac7d459ae34340cdc99e7e. Own root documents are packaged under META-INF/qqq-all/ and /app/; dependency notices preserved. Independent actual-JAR/image checks passed, both regressions fail against the prior JAR, and full local offline Maven verify passes (25 unit cases including two existing opt-in skips; seven integration cases). Exact cached snapshot inputs are retained in local evidence; this is not final released-dependency acceptance. Smoke run 36817470808 and Circle29 are running. Public image delivery remains pending; leave issue open until the actual distribution is verified.

PR25 merged as signed59e606418c26b58b3d44b7bf89c1767d10377e8f (tree matches reviewed head). Postmerge Smoke36817821008 core/full and Circle30 passed. Image workflow36817820987 verified the app but skipped login and build/publish at its public-package gate; no image was published. Public distribution acceptance therefore remains open.

The verified public-snapshot app JAR (SHA256f5d02f7e27cd6e238550625c6a5172456ba6a1c897223201ff470b94554ebaf6) contains70notice-like dependency entries but no exact copies of qqq-all root LICENSE or NOTICE. Dockerfile currently copies only this JAR. This extends QQQ#923 packaged-notice acceptance to the distribution itself; parent/BOM POM-only artifacts are not missing JARs. Include the exact repository documents in the app artifact under a project-specific path that avoids shaded dependency collisions, and in the image. Preserve all existing dependency notices, application resources/classes and image startup behavior. Add a meaningful packaged-artifact check demonstrating failure on baseline and success on the correction. Verify the actual local JAR and image files without claiming GHCR publication. No dependency/version/Next or release-gate changes. Reviewed signed integration and hosted checks are required; actual public-image acceptance remains under#10 after GHCR access/visibility and released dependency gates. Implementation: PR #25, signed commit `6d981933b9687ffbceac7d459ae34340cdc99e7e`. Own root documents are packaged under `META-INF/qqq-all/` and `/app/`; dependency notices preserved. Independent actual-JAR/image checks passed, both regressions fail against the prior JAR, and full local offline Maven verify passes (25 unit cases including two existing opt-in skips; seven integration cases). Exact cached snapshot inputs are retained in local evidence; this is not final released-dependency acceptance. Smoke run 36817470808 and Circle29 are running. Public image delivery remains pending; leave issue open until the actual distribution is verified. PR25 merged as signed59e606418c26b58b3d44b7bf89c1767d10377e8f (tree matches reviewed head). Postmerge Smoke36817821008 core/full and Circle30 passed. Image workflow36817820987 verified the app but skipped login and build/publish at its public-package gate; no image was published. Public distribution acceptance therefore remains open.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qqq-all#24