Skip to content

Commit 362c423

Browse files
tobiastobias
authored
Merge pull request #874 from clojars/tobias/require-license
2 parents f410dfa + 235728a commit 362c423

File tree

8 files changed

+161
-12
lines changed

8 files changed

+161
-12
lines changed

‎dev-resources/test-0.0.1/test-no-license.pom‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
5+
<groupId>org.clojars.dantheman</groupId>
6+
<artifactId>test</artifactId>
7+
<version>0.0.1</version>
8+
<packaging>jar</packaging>
9+
10+
<name>asdf</name>
11+
<url>https://example.org</url>
12+
13+
<properties>
14+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
15+
</properties>
16+
<dependencies>
17+
<dependency>
18+
<groupId>org.clojure</groupId>
19+
<artifactId>clojure</artifactId>
20+
</dependency>
21+
</dependencies>
22+
</project>

‎dev-resources/test-0.0.1/test.pom‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,13 @@
1010
<name>asdf</name>
1111
<url>https://example.org</url>
1212

13+
<licenses>
14+
<license>
15+
<name>Apache-2.0</name>
16+
<url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
17+
</license>
18+
</licenses>
19+
1320
<properties>
1421
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
1522
</properties>

‎dev-resources/test-0.0.3-SNAPSHOT/test.pom‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,13 @@
1111
<description>TEST</description>
1212
<url>http://example.com</url>
1313

14+
<licenses>
15+
<license>
16+
<name>Apache-2.0</name>
17+
<url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
18+
</license>
19+
</licenses>
20+
1421
<properties>
1522
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
1623
</properties>

‎resources/queries/queryfile.sql‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -332,6 +332,18 @@ WHERE (
332332
ORDER BY created DESC
333333
LIMIT 1;
334334

335+
--name: find-latest-release
336+
SELECT *
337+
FROM jars
338+
WHERE (
339+
group_name = :groupname
340+
AND
341+
jar_name = :jarname
342+
)
343+
ORDER BY created DESC
344+
LIMIT 1;
345+
346+
335347
--name: max-jars-id
336348
SELECT max(id) AS max_id FROM jars;
337349

‎src/clojars/db.clj‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -316,7 +316,15 @@
316316
:result-set-fn first}))))
317317
(defn all-jars [db]
318318
(map read-edn-fields
319-
(sql/all-jars {} {:connection db}))))
319+
(sql/all-jars {} {:connection db})))
320+
321+
(defn find-latest-release
322+
[db groupname jarname]
323+
(read-edn-fields
324+
(sql/find-latest-release {:groupname groupname
325+
:jarname jarname}
326+
{:connection db
327+
:result-set-fn first}))))
320328

321329
(defn find-dependencies
322330
[db groupname jarname version]

‎src/clojars/routes/repo.clj‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -214,10 +214,24 @@
214214
(name key) (key pom-data) (name key) value)
215215
{:pom pom-data})))
216216

217-
(defn- validate-pom [pom group name version]
217+
(defn- validate-pom-license
218+
[db pom group name]
219+
(when (empty? (:licenses pom))
220+
(let [latest-release (db/find-latest-release db group name)]
221+
;; Require a license if:
222+
;; - this is a new project
223+
;; - the prior released version had a license
224+
(when (or (not latest-release)
225+
(seq (:licenses latest-release)))
226+
(throw-invalid
227+
:missing-license
228+
"the POM file does not include a license. See https://bit.ly/3PQunZU")))))
229+
230+
(defn- validate-pom [db pom group name version]
218231
(validate-pom-entry pom :group group)
219232
(validate-pom-entry pom :name name)
220-
(validate-pom-entry pom :version version))
233+
(validate-pom-entry pom :version version)
234+
(validate-pom-license db pom group name))
221235

222236
(defn- validate-module-entry
223237
"Validates a key in a Gradle module"
@@ -309,7 +323,7 @@
309323
(validate-jar-name+version name version)
310324
(when module
311325
(validate-module module group name version))
312-
(validate-pom pom group name version)
326+
(validate-pom db pom group name version)
313327
(assert-non-redeploy db group name version)
314328
(assert-non-central-shadow group name)
315329

‎test/clojars/integration/uploads_test.clj‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
[clojars.file-utils :as fu]
1111
[clojars.http-utils :refer [clear-sessions!]]
1212
[clojars.integration.steps :refer [create-deploy-token login-as register-as]]
13+
[clojars.routes.repo :as repo]
1314
[clojars.s3 :as s3]
1415
[clojars.test-helper :as help]
1516
[clojars.web.common :as common]
@@ -582,6 +583,86 @@
582583
;; This test throws on failure, so we have this assertion to satisfy kaocha
583584
(is true))
584585

586+
(deftest new-project-must-include-license
587+
(-> (session (help/app))
588+
(register-as "dantheman" "test@example.org" "password"))
589+
(let [token (create-deploy-token (session (help/app)) "dantheman" "password" "testing")]
590+
(is (thrown-with-msg?
591+
DeploymentException
592+
#"Forbidden - the POM file does not include a license"
593+
(deploy
594+
{:coordinates '[org.clojars.dantheman/test "0.0.1"]
595+
:jar-file (io/file (io/resource "test.jar"))
596+
:pom-file (io/file (io/resource "test-0.0.1/test-no-license.pom"))
597+
:password token})))
598+
599+
(help/match-audit {:username "dantheman"}
600+
{:user "dantheman"
601+
:group_name "org.clojars.dantheman"
602+
:jar_name "test"
603+
:version "0.0.1"
604+
:message "the POM file does not include a license. See https://bit.ly/3PQunZU"
605+
:tag "missing-license"})))
606+
607+
(deftest existing-project-with-no-license-does-not-require-license
608+
(-> (session (help/app))
609+
(register-as "dantheman" "test@example.org" "password"))
610+
(let [token (create-deploy-token (session (help/app)) "dantheman" "password" "testing")]
611+
;; Deploy a version with no license with license check disabled so we can
612+
;; get this project in a legacy state
613+
(with-redefs [repo/validate-pom-license (constantly true)]
614+
(deploy
615+
{:coordinates '[org.clojars.dantheman/test "0.0.1"]
616+
:jar-file (io/file (io/resource "test.jar"))
617+
:pom-file (io/file (io/resource "test-0.0.1/test-no-license.pom"))
618+
:password token}))
619+
620+
;; Deploy a new version that doesn't have a license
621+
(deploy
622+
{:coordinates '[org.clojars.dantheman/test "0.0.2"]
623+
:jar-file (io/file (io/resource "test.jar"))
624+
:pom-file (help/rewrite-pom (io/file (io/resource "test-0.0.1/test-no-license.pom"))
625+
{:version "0.0.2"})
626+
:password token})
627+
628+
(help/match-audit {:username "dantheman"}
629+
{:user "dantheman"
630+
:group_name "org.clojars.dantheman"
631+
:jar_name "test"
632+
:version "0.0.2"
633+
:tag "deployed"})))
634+
635+
(deftest project-that-had-license-for-most-recent-release-must-provide-license
636+
(-> (session (help/app))
637+
(register-as "dantheman" "test@example.org" "password"))
638+
(let [token (create-deploy-token (session (help/app)) "dantheman" "password" "testing")]
639+
;; Deploy a version with a license
640+
(deploy
641+
{:coordinates '[org.clojars.dantheman/test "0.0.1"]
642+
:jar-file (io/file (io/resource "test.jar"))
643+
:pom-file (io/file (io/resource "test-0.0.1/test.pom"))
644+
:password token})
645+
646+
;; Deploy a new version that doesn't have a license
647+
(is (thrown-with-msg?
648+
DeploymentException
649+
#"Forbidden - the POM file does not include a license"
650+
(deploy
651+
{:coordinates '[org.clojars.dantheman/test "0.0.2"]
652+
:jar-file (io/file (io/resource "test.jar"))
653+
:pom-file (help/rewrite-pom (io/file (io/resource "test-0.0.1/test-no-license.pom"))
654+
{:version "0.0.2"})
655+
:password token})))
656+
657+
(help/match-audit {:username "dantheman"}
658+
{:user "dantheman"
659+
:group_name "org.clojars.dantheman"
660+
:jar_name "test"
661+
:version "0.0.2"
662+
:message "the POM file does not include a license. See https://bit.ly/3PQunZU"
663+
:tag "missing-license"})))
664+
665+
585666
(deftest user-can-deploy-new-version-in-same-session
586667
(-> (session (help/app))
587668
(register-as "dantheman" "test@example.org" "password"))

‎test/clojars/test_helper.clj‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -151,14 +151,12 @@
151151
(defn rewrite-pom [file m]
152152
(let [new-pom (doto (File/createTempFile (.getName file) ".pom")
153153
.deleteOnExit)]
154-
(-> file
155-
slurp
156-
(as-> % (reduce (fn [accum [element new-value]]
157-
(str/replace accum (re-pattern (format "<(%s)>.*?<" (name element)))
158-
(format "<$1>%s<" new-value)))
159-
%
160-
m))
161-
(->> (spit new-pom)))
154+
(spit new-pom
155+
(reduce (fn [accum [element new-value]]
156+
(str/replace accum (re-pattern (format "<(%s)>.*?<" (name element)))
157+
(format "<$1>%s<" new-value)))
158+
(slurp file)
159+
m))
162160
new-pom))
163161

164162
(defn at-as-time-str

0 commit comments

Comments
 (0)