Skip to content

Use SPDX identifier in POMs#979

Merged
lhazlewood merged 3 commits intojwtk:masterfrom
TheMrMilchmann:tmm/spdx
Mar 13, 2025
Merged

Use SPDX identifier in POMs#979
lhazlewood merged 3 commits intojwtk:masterfrom
TheMrMilchmann:tmm/spdx

Conversation

@TheMrMilchmann
Copy link
Copy Markdown
Contributor

This replaces the custom name with an SPDX identifier to enable tooling to automatically detect the correct license. Using an SPDX identifier is recommended by the official Maven documentation.

See https://spdx.org/licenses/Apache-2.0.html

This replaces the custom name with an SPDX identifier to enable tooling to automatically detect the correct license.

See https://spdx.org/licenses/Apache-2.0.html
@TheMrMilchmann
Copy link
Copy Markdown
Contributor Author

Just checked the Ci failure. It's unrelated to this change and instead seems to be a spurious issue while downloading the JDK.

@bdemers
Copy link
Copy Markdown
Member

bdemers commented Mar 10, 2025

@TheMrMilchmann I'll re-run the job, looks like that might have been a GH Actions infra issue?

@lhazlewood
Copy link
Copy Markdown
Contributor

Just tried to run it myself as well - the setup JDK task is failing. Seems to be due to:

uses: oracle-actions/setup-java@v1

That project is here: https://github.com/oracle-actions/setup-java
and their latest release version is 1.4.0: https://github.com/oracle-actions/setup-java/releases/tag/v1.4.0

But we're referencing setup-java@v1. If v1 is just an alias for 'latest 1.x release`, then 1.4.0's URI properties file doesn't list anything for JDK 17: https://github.com/oracle-actions/setup-java/blob/v1.4.0/jdk.java.net-uri.properties

I wonder: @TheMrMilchmann can you update the ci.yml line to pin the concrete version to @v1.1.0? That is the last version that references JDK 17: https://github.com/oracle-actions/setup-java/blob/v1.1.0/jdk.java.net-uri.properties

What I don't understand is that it was working until recently, so maybe Oracle stopped hosting the file? Not sure.

@lhazlewood
Copy link
Copy Markdown
Contributor

There does indeed seem to be a version mismatch. From the failed build:

openjdk 21.0.6 2025-01-21 LTS
  OpenJDK Runtime Environment Temurin-21.0.6+7 (build 21.0.6+7-LTS)
  OpenJDK 64-Bit Server VM Temurin-21.0.6+7 (build 21.0.6+7-LTS, mixed mode, sharing)
Warning: Checksum not available for: https://download.oracle.com/java/17/latest/jdk-17_linux-x64_bin.tar.gz

Definitely trying something with JDK 21 instead of 17.

I looked in the old version 1.1.0 jdk.java.net-uri.properties file and downloaded the referenced file for JDK 17 to my local system just now:

curl -O https://download.java.net/java/GA/jdk17.0.2/dfd4a8d0985749f896bed50d7138ee7f/8/GPL/openjdk-17.0.2_linux-aarch64_bin.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  177M  100  177M    0     0  35.1M      0  0:00:05  0:00:05 --:--:-- 35.5M

and then verified the file:

file openjdk-17.0.2_linux-aarch64_bin.tar.gz
openjdk-17.0.2_linux-aarch64_bin.tar.gz: gzip compressed data, last modified: Tue Dec  7 21:48:55 2021, from Unix, original size modulo 2^32 323481600

So it seems that the file is still there, and I'm assuming that changing the ci.yml file and updating it to this could (probably?) fix it:

uses: oracle-actions/[email protected]

@TheMrMilchmann
Copy link
Copy Markdown
Contributor Author

This appears to be intentional oracle-actions/setup-java#94 (comment).

I'm currently travelling but can pin the version on Thursday.

@lhazlewood
Copy link
Copy Markdown
Contributor

I'm confused as to why it failed, but there is this:

Warning: Checksum not available for: https://download.oracle.com/java/17/latest/jdk-17_linux-x64_bin.tar.gz

Which isn't the exact tarball referenced in the 1.1.0 version of jdk.java.net-uri.properties.

I wonder if we'll have to use the explicit uri property when configuring the the setup-java task, e.g.:

      - name: Set up JDK
        uses: oracle-actions/[email protected]
        with:
          uri: 'https://download.java.net/java/GA/jdk17.0.2/dfd4a8d0985749f896bed50d7138ee7f/8/GPL/openjdk-17.0.2_linux-aarch64_bin.tar.gz'

I'm assuming that will work - it's worth a shot.

If not, I think it's probably time to revert from using oracle-actions/setup-java and go back to https://github.com/actions/setup-java which had its last release only two months ago. If I had to guess, I'd assume it has better backwards version support, but it's only a guess.

@lhazlewood
Copy link
Copy Markdown
Contributor

@TheMrMilchmann so I don't keep asking you to try things for me, I created this: #980

Hopefully when that is done, your PR will 'just work'. I'll give it a shot today.

@lhazlewood lhazlewood merged commit 053855f into jwtk:master Mar 13, 2025
23 checks passed
@lhazlewood
Copy link
Copy Markdown
Contributor

@TheMrMilchmann all works as expected now, so I squashed/merged. Sorry for the confusion/delay, and thanks for the pull request!

@TheMrMilchmann TheMrMilchmann deleted the tmm/spdx branch March 14, 2025 10:27
@TheMrMilchmann
Copy link
Copy Markdown
Contributor Author

Sorry for the confusion/delay

No worries & thanks for taking care! 😊

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants