Different dash workflows produce different DEPENDENCIE files between plugin and mvn verify

[Siegfriedk]

In our current Tractus-x Project we have lots of pull requests from teams and when i verified if one Team generated/updated their dependencies correct, we had a mix of results.

They were using
mvn verify dependency:list -DskipTests -Dmaven.javadoc.skip=true -DappendOutput=true -DoutputFile=maven.deps java -jar ~/Desktop/org.eclipse.dash.licenses-0.0.1-20220928.055031-560.jar maven.deps -summary DEPENDENCIES

I used the maven plugin approach described here https://blog.waynebeaton.ca/posts/ip/dash-license-tool-maven-plugin/

The https://github.com/eclipse/dash-licenses website mentions another tool: The Maven Reactor

I personally find it slightly confusing to have multiply maven based workflows and would suggest to provide/document a golden path.

[Siegfriedk]

FYI: This repository is seeing the difference between the manual maven call vs. the maven plugin https://github.com/eclipse-tractusx/managed-service-orchestrator

[waynebeaton]

I made some documentation updates that highlights the Maven plugin as the preferred option. There's multiple ways to use the the tool because there are multitude of ways that folks do builds. In some cases, one option is better than other.

FWIW, the Maven reactor is part of Maven. The Eclipse Dash License Tool's Maven plugin uses the Maven Reactor. It's not something separate.

Based on quick look, it looks like the difference between the CLI and Maven results are because the Maven plugin skips dependencies that are not in Maven's compile scope. The CLI option is using the results of the dependency:list plugin which shows everything. I'll update the documentation to highlight this.

There is no "golden path" that works in every case. Ultimately, we depend on committers understanding what their builds are doing and using the tool (or not) to assist with their engagement in the IP due diligence process.

[tom-rm-meyer-ISST]

We noticed this problem within the tractus-x repository. For this repository, we should clarify whether test dependencies are in scope or not. Therefore, we raised this discussion. Maybe the description also helps to understand anyone reading this issue.

[waynebeaton]

They were using mvn verify dependency:list -DskipTests -Dmaven.javadoc.skip=true -DappendOutput=true -DoutputFile=maven.deps java -jar ~/Desktop/org.eclipse.dash.licenses-0.0.1-20220928.055031-560.jar maven.deps -summary DEPENDENCIES

There is a 1.0.0 release that is more current than that build.

I think that we're done here, so I'm going to close the issue. Feel free to reopen if you feel that my assertion that we're done is incorrect.