Try to use RAT 0.18 - help needed with Maven project structure

[ottlinger]

Trying to add configuration for RAT 0.18, but the basic scan does not pass and reports many thousand new unlicensed files .... as I'm not sure about the Maven project layout I don't know where RAT is configured for the whole project.

Can you help out? @slachiewicz @slawekjaranowski

[cstamas]

The other day was tinkering with same problem, and we have issues as well:
https://issues.apache.org/jira/browse/RAT-567
https://issues.apache.org/jira/browse/RAT-554

Idea is that Maven POM should really not contain RAT config, merely a plugin definition with one liner config, that points to some sort of RAT config file, presumably in repository root. This way, that file would end up in source bundle as well, and could be picked up by tools like ATR is, as currently we have divergence between config used in build by Maven, ATR reports unrelated errors, etc.

[cstamas]

RAT plugin as I found, top to bottom:
ASF parent POM: https://github.com/apache/maven-apache-parent/blob/master/pom.xml
ASF Maven parent POM: https://github.com/apache/maven-parent/blob/master/pom.xml#L1280-L1311
ASF Maven project root POM: https://github.com/apache/maven/blob/master/pom.xml#L812-L835

[gnodet]

Code Review

All five findings independently confirmed. This is a WIP PR where the author is requesting help with the RAT 0.18 upgrade — here are the issues to address:

1. .mvn directory exclusion removed (pom.xml:820): The .mvn/ directory contains tracked files (maven.config, readme.txt) without Apache license headers. Since .mvn/ is NOT in .gitignore, <inputExcludeParsedScm>GIT</inputExcludeParsedScm> will not exclude it. The .mvn exclusion must be retained in the <inputExcludes> section.

2. Hardcoded version override (pom.xml:813): <version>0.18</version> overrides the parent-managed version (ASF parent specifies 0.16.1). The inline comment acknowledges this uncertainty — needs resolution before merge.

3. Spotless CI failure (pom.xml:813): The inline XML comment <!-- Remove if correct version comes from parent --> on the same line as the <version> element causes the Spotless formatting check to fail. Moving the comment to a separate line will fix this.

4. Exclusion pattern semantics (pom.xml:822, low): Pattern changes from dir/** to dir (e.g., src/test/projects/** → src/test/projects) rely on RAT 0.18's <inputExcludes> handling directory matching implicitly. Worth validating.

5. Broad standard exclusions (pom.xml:815, low): <inputExcludeStds><exclude>ALL</exclude></inputExcludeStds> activates all built-in exclusion sets. May be correct for the upgrade but implications should be understood, especially given the reported "many thousand new unlicensed files."

The NOTICE file change (http → https for ASF URL) is a legitimate standalone improvement that could be split into a separate trivial PR.

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of gnodet

[ottlinger]

@gnodet thanks for adding the generator's response:

1. .mvn is included in RAT's defaults and does not need to be put there explicitly.
2. & 3. Once https://github.com/apache/maven-apache-parent/pull/587/changes is merged and deployed, this line can be removed.
3. The change in patterns is a RAT 0.18 feature.
4. Use RAT's inclusion configuration to not scan IDE/SCM/build tool-specific stuff.

Hope that helps.

Due to the change in minimal JDK version I'm still not sure if RAT0.18 can be used within your build stack as JDK17 is require to build RAT.

[gnodet]

Thanks for the detailed explanations @ottlinger! That clarifies the RAT 0.18 changes well:

1. Good to know .mvn is already covered by RAT defaults — makes sense to remove the explicit exclusion.
2. & 3. Understood — the version management will be cleaner once apache/maven-apache-parent#587 lands.
3. Noted on the pattern syntax being a RAT 0.18 feature.
4. Makes sense to leverage RAT's inclusion config for those exclusions.

The JDK 17 minimum requirement for RAT 0.18 is indeed worth confirming against the Maven build matrix. Previous review findings stand as informational context for other reviewers.

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of gnodet