Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions hugegraph-server/hugegraph-dist/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
<assembly.dir>${project.basedir}/src/assembly</assembly.dir>
<assembly.descriptor.dir>${assembly.dir}/descriptor</assembly.descriptor.dir>
<assembly.static.dir>${assembly.dir}/static</assembly.static.dir>
<jansi.version>2.4.0</jansi.version>
</properties>

<dependencies>
Expand Down Expand Up @@ -123,6 +124,15 @@
<artifactId>grpc-stub</artifactId>
<version>${grpc.version}</version>
</dependency>

<!-- Added updated jar to avoid java.lang.NoClassDefFoundError: org/fusesource/jansi/AnsiConsole when launching
gremlin console on arm64 -->
<dependency>
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

‼️ Update the known dependency inventory

Evidence: this PR adds org.fusesource.jansi:jansi:2.4.0, and the dependency-check job diffs the generated inventory with install-dist/scripts/dependency/known-dependencies.txt; the failed job shows +jansi-2.4.0.jar, while the tracked file has no such entry.

Impact: the release dependency gate will keep failing for this PR, and the newly bundled jar is not recorded in the deterministic dependency inventory.

Requested fix: regenerate and commit install-dist/scripts/dependency/known-dependencies.txt, or add the missing jansi-2.4.0.jar entry in the correct sorted position.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Add a distro regression check

Evidence: the fix is purely in distro packaging, so the normal unit/core/api suites do not exercise the gremlin-console.sh classpath. I could not find an automated check that launches the packaged console or at least asserts the tarball contains lib/jansi-*.jar.

Impact: this exact classpath regression can silently return after a dependency or assembly change and only be caught by users starting the packaged console.

Requested fix: add a distro-level smoke check, for example launching bin/gremlin-console.sh -- -e <script> from the assembled server, or at minimum asserting the packaged archive contains the Jansi jar.

<groupId>org.fusesource.jansi</groupId>
<artifactId>jansi</artifactId>
<version>${jansi.version}</version>
<scope>runtime</scope>
</dependency>
</dependencies>

<build>
Expand Down
6 changes: 6 additions & 0 deletions install-dist/release-docs/LICENSE
Original file line number Diff line number Diff line change
Expand Up @@ -929,3 +929,9 @@ The text of each license is also included in licenses/LICENSE-[project].txt.

https://central.sonatype.com/artifact/xmlpull/xmlpull/1.1.3.1 -> Public Domain
https://central.sonatype.com/artifact/xpp3/xpp3_min/1.1.4c -> Public Domain

#
# jansi 2.4.0 (https://github.com/fusesource/jansi)
#
# This product includes software developed by the Jansi project (http://fusesource.github.io/jansi/).
# See licenses/LICENSE-jansi-2.4.0.txt for license details (Apache License 2.0 or LGPL 3.0+).
9 changes: 9 additions & 0 deletions install-dist/release-docs/NOTICE
Original file line number Diff line number Diff line change
Expand Up @@ -1887,3 +1887,12 @@ swagger-ui NOTICE

swagger-ui
Copyright 2020-2021 SmartBear Software Inc.

========================================================================

#
# jansi 2.4.0 (https://github.com/fusesource/jansi)
#
# This product includes software developed by the Jansi project (http://fusesource.github.io/jansi/).
# See licenses/LICENSE-jansi-2.4.0.txt for license details (Apache License 2.0 or LGPL 3.0+).

16 changes: 16 additions & 0 deletions install-dist/release-docs/licenses/LICENSE-jansi-2.4.0.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
Copyright (c) 2007-2021, the original author(s)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

‼️ Vendor the full license text

Evidence: this new file is a 16-line summary with URLs, but the surrounding install-dist/release-docs/licenses/LICENSE-*.txt files vendor complete upstream license texts. The new LICENSE entry also points readers here for license details, which this summary does not provide.

Impact: the release docs for the newly bundled jar are incomplete, which is an ASF release/legal risk even if the runtime dependency is correct.

Requested fix: replace this file with the full upstream license text for the license option HugeGraph is relying on for distribution, and align the LICENSE/NOTICE wording with that choice.

All rights reserved.

This software is dual-licensed under the Apache License, Version 2.0 and the GNU Lesser General Public License, version 3 or later (LGPL-3.0-or-later).

You may obtain a copy of the Apache License at

http://www.apache.org/licenses/LICENSE-2.0

You may obtain a copy of the GNU Lesser General Public License at

http://www.gnu.org/licenses/lgpl-3.0.html

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

This product includes software developed by the Jansi project (http://fusesource.github.io/jansi/).
Loading