Skip to content

Create THIRD-PARTY-NOTICES #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mahesh-Binayak merged 1 commit into from
Jan 6, 2026
Merged

Create THIRD-PARTY-NOTICES #39

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
152 changes: 152 additions & 0 deletions THIRD-PARTY-NOTICES
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,152 @@
THIRD-PARTY-NOTICES

This project includes third-party packages that are distributed under various open-source licenses. Below is a list of packages and their associated licenses.

================================================================================
Package: org.slf4j:jcl-over-slf4j
Version: Not specified
License: MIT License (Inferred from project’s official repository)
Homepage: https://www.slf4j.org
================================================================================
Comment on lines +6 to +10

@coderabbitai coderabbitai Bot Jan 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

git ls-files | grep -E "(THIRD-PARTY|pom\.xml)" | head -20

Repository: mosip/imagedecoder

Length of output: 117

🏁 Script executed:

cat -n THIRD-PARTY-NOTICES | head -100

Repository: mosip/imagedecoder

Length of output: 5188

🏁 Script executed:

# Check if pom.xml exists
if [ -f pom.xml ]; then
  echo "=== pom.xml found ==="
  wc -l pom.xml
else
  echo "pom.xml not found"
fi

Repository: mosip/imagedecoder

Length of output: 79

🏁 Script executed:

cat -n imagedecoder/pom.xml | head -150

Repository: mosip/imagedecoder

Length of output: 6154

🏁 Script executed:

# Search for specific dependencies in pom.xml
echo "=== SLF4J dependencies ==="
rg -n "jcl-over-slf4j|jul-to-slf4j" imagedecoder/pom.xml -A 2 -B 2

echo -e "\n=== Jackson dependencies ==="
rg -n "jackson-core|jackson-databind" imagedecoder/pom.xml -A 2 -B 2

echo -e "\n=== JUnit vintage ==="
rg -n "junit-vintage-engine" imagedecoder/pom.xml -A 2 -B 2

Repository: mosip/imagedecoder

Length of output: 833

🌐 Web query:

SLF4J jcl-over-slf4j license official

💡 Result:

The official license for org.slf4j:jcl-over-slf4j is the Apache License, Version 2.0. [1][2]

Sources:
[1] SLF4J project / artifact listings and package metadata (Apache-2.0).
[2] Libraries.io / Maven metadata for org.slf4j:jcl-over-slf4j (Apache-2.0).

🌐 Web query:

SLF4J jul-to-slf4j license official

💡 Result:

The SLF4J jul-to-slf4j bridge is distributed under the MIT license. [1][2]

Sources:

  • SLF4J official license page. [1]
  • SLF4J GitHub repository (repository license/MIT). [2]

🌐 Web query:

FasterXML Jackson-core license official

💡 Result:

jackson-core (FasterXML) is licensed under the Apache License, Version 2.0. See the project repo LICENSE and the Apache 2.0 text for the official terms. [1] [2]

Sources:
[1] FasterXML jackson-core (GitHub) — "Apache-2.0 license".
[2] Apache License, Version 2.0 (official text).

🌐 Web query:

FasterXML Jackson-databind license official

💡 Result:

The jackson-databind project is licensed under the Apache License, Version 2.0. [1][2]

Sources:
[1] FasterXML/jackson-databind GitHub repository — License: Apache-2.0.
[2] jackson-databind project wiki — "Project is licensed under Apache License 2.0."

🌐 Web query:

JUnit 5 junit-vintage-engine license official

💡 Result:

The junit-vintage-engine (JUnit 5 Vintage) is published under the Eclipse Public License version 2.0 (EPL-2.0). [1][2]

Sources:
[1] JUnit 5 documentation (junit-vintage described as JUnit module; project uses EPL-2.0). (junit.org)
[2] JUnit GitHub repository (junit-team/junit-framework) — license: EPL-2.0. (github.com)

Citations:

Fix incorrect license for jcl-over-slf4j and verify all licenses are from official sources.

The license information in THIRD-PARTY-NOTICES contains an error: org.slf4j:jcl-over-slf4j is listed as "MIT License" but the official source indicates it is licensed under Apache License 2.0.

Additionally, several packages lack explicit version specifications in pom.xml (they are managed transitively through kernel-bom):

  • org.slf4j:jcl-over-slf4j, org.slf4j:jul-to-slf4j
  • com.fasterxml.jackson.core:jackson-core, jackson-databind
  • org.junit.vintage:junit-vintage-engine

For accurate legal compliance documentation, specify versions explicitly in pom.xml and source license information directly from official repositories rather than inferring. Consider integrating an automated license verification tool like maven-license-plugin into the build process to ensure accuracy.


================================================================================
Package: org.apache.maven.plugins:maven-source-plugin
Version: 3.3.1
License: Apache License 2.0
Homepage: https://maven.apache.org/plugins
================================================================================

================================================================================
Package: io.mosip.kernel:kernel-core
Version: 1.3.0-SNAPSHOT
License: MPL-2.0 (Inferred from MOSIP official repository)
Homepage: https://mosip.io
================================================================================
Comment on lines +20 to +24

@coderabbitai coderabbitai Bot Jan 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

# First, locate the THIRD-PARTY-NOTICES file
find . -name "THIRD-PARTY-NOTICES" -type f

Repository: mosip/imagedecoder

Length of output: 83

🏁 Script executed:

# Check file size and content
wc -l ./THIRD-PARTY-NOTICES
echo "---"
cat -n ./THIRD-PARTY-NOTICES

Repository: mosip/imagedecoder

Length of output: 7907

🏁 Script executed:

# Find and examine pom.xml files
find . -name "pom.xml" -type f | head -5

Repository: mosip/imagedecoder

Length of output: 101

🏁 Script executed:

# Examine the main pom.xml to check kernel package versions
cat ./imagedecoder/pom.xml

Repository: mosip/imagedecoder

Length of output: 10534

Update THIRD-PARTY-NOTICES with correct kernel package versions and remove duplicates.

The THIRD-PARTY-NOTICES file lists incorrect versions for the kernel packages. According to pom.xml, the actual declared versions are 1.2.1-SNAPSHOT, but the file contains entries for 1.3.0-SNAPSHOT and 1.3.0-beta.1:

  • kernel-core: Declared as 1.2.1-SNAPSHOT in pom.xml, but listed as 1.3.0-SNAPSHOT (lines 20-24) and 1.3.0-beta.1 (lines 132-136)
  • kernel-bom: Declared as 1.2.1-SNAPSHOT in pom.xml, but listed as 1.3.0-SNAPSHOT (lines 62-66) and 1.3.0-beta.1 (lines 125-129)
  • kernel-logger-logback: Declared as 1.2.1-SNAPSHOT in pom.xml, but listed as 1.3.0-SNAPSHOT (lines 69-73) and 1.3.0-beta.1 (lines 139-143)

Update all three packages to 1.2.1-SNAPSHOT and remove the duplicate beta.1 entries (lines 125-143).

🤖 Prompt for AI Agents 
In @THIRD-PARTY-NOTICES around lines 20-24, Update the THIRD-PARTY-NOTICES
entries for kernel-core, kernel-bom, and kernel-logger-logback to match the
pom.xml by changing their versions to 1.2.1-SNAPSHOT (replace any 1.3.0-SNAPSHOT
occurrences), and remove the duplicate 1.3.0-beta.1 entries associated with
these kernel packages so each package appears once with version 1.2.1-SNAPSHOT.


================================================================================
Package: com.fasterxml.jackson.core:jackson-core
Version: Not specified
License: Apache License 2.0 (Inferred)
Homepage: https://github.com/FasterXML/jackson-core
================================================================================

================================================================================
Package: org.slf4j:jul-to-slf4j
Version: Not specified
License: MIT License (Inferred)
Homepage: https://www.slf4j.org
================================================================================

================================================================================
Package: org.apache.maven.plugins:maven-gpg-plugin
Version: 3.2.3
License: Apache License 2.0
Homepage: https://maven.apache.org/plugins
================================================================================

================================================================================
Package: pl.project13.maven:git-commit-id-plugin
Version: 3.0.1
License: GNU Lesser General Public License v3.0 (LGPL-3.0)
Homepage: https://github.com/git-commit-id/git-commit-id-maven-plugin
================================================================================

================================================================================
Package: org.apache.maven.plugins:maven-assembly-plugin
Version: 3.1.1
License: Apache License 2.0
Homepage: https://maven.apache.org/plugins
================================================================================

================================================================================
Package: io.mosip.kernel:kernel-bom
Version: 1.3.0-SNAPSHOT
License: MPL-2.0 (Inferred)
Homepage: https://mosip.io
================================================================================

================================================================================
Package: io.mosip.kernel:kernel-logger-logback
Version: 1.3.0-SNAPSHOT
License: MPL-2.0 (Inferred)
Homepage: https://mosip.io
================================================================================

================================================================================
Package: org.apache.maven.plugins:maven-compiler-plugin
Version: 3.11.0
License: Apache License 2.0
Homepage: https://maven.apache.org/plugins
================================================================================

================================================================================
Package: com.fasterxml.jackson.core:jackson-databind
Version: Not specified
License: Apache License 2.0 (Inferred)
Homepage: https://github.com/FasterXML/jackson-databind
================================================================================

================================================================================
Package: org.junit.vintage:junit-vintage-engine
Version: Not specified
License: Eclipse Public License 2.0 (EPL-2.0)
Homepage: https://junit.org/junit5/
================================================================================

================================================================================
Package: org.apache.maven.plugins:maven-javadoc-plugin
Version: 3.2.0
License: Apache License 2.0
Homepage: https://maven.apache.org/plugins
================================================================================

================================================================================
Package: org.apache.maven.plugins:maven-surefire-plugin
Version: 2.22.0
License: Apache License 2.0
Homepage: https://maven.apache.org/plugins
================================================================================

================================================================================
Package: org.apache.maven.plugins:maven-jar-plugin
Version: 3.0.2
License: Apache License 2.0
Homepage: https://maven.apache.org/plugins
================================================================================

================================================================================
Package: org.apache.maven.plugins:maven-dependency-plugin
Version: 3.1.2
License: Apache License 2.0
Homepage: https://maven.apache.org/plugins
================================================================================

================================================================================
Package: io.mosip.kernel:kernel-bom
Version: 1.3.0-beta.1
License: MPL-2.0
Homepage: https://mosip.io
================================================================================

================================================================================
Package: io.mosip.kernel:kernel-core
Version: 1.3.0-beta.1
License: MPL-2.0
Homepage: https://mosip.io
================================================================================

================================================================================
Package: io.mosip.kernel:kernel-logger-logback
Version: 1.3.0-beta.1
License: MPL-2.0
Homepage: https://mosip.io
================================================================================

================================================================================
Package: io.mosip.imagedecoder:imagedecoder
Version: 0.10.0-beta.1
License: MPL-2.0
Homepage: https://github.com/mosip
================================================================================

Full license texts and additional details for each of the above packages are available in the license/ directory of this repository. Please refer to those files or the original source of each package for complete legal terms and conditions.
Loading