[TSC-250] New ODL project PLASTIC needs a code scan Created: 31/Oct/19  Updated: 01/Nov/19

Status: Confirmed
Project: tsc
Component/s: None
Affects Version/s: None
Fix Version/s: Magnesium

Type: Story Priority: High
Reporter: Allan Clarke Assignee: Stephen Winslow
Resolution: Unresolved Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: Zip Archive odl-plastic.zip     Microsoft Word plastic-2019-10-31.xlsx    

 Description   

The attached zip contains the source code for the Plastic project.

Please have it code scanned.

The project was accepted by the TSC on Oct 17, 2019

Project page is https://wiki.opendaylight.org/view/Project_Proposals:Plastic

 



 Comments   
Comment by Stephen Winslow [ 31/Oct/19 ]

I've completed a license scan of the attached zip file's contents using Fossology. Overall looks very good, most files contain EPL-1.0 notices and only one other finding was detected. Just a couple of minor notes below.

  1. Not a licensing issue, but note that there were a few files in the .zip archive that appear to be Mac metadata files (__MACOSX/ directory and .DS_Store). You'll likely want to exclude those from the repo.
  2. In the file /release-version, below the EPL-1.0 header there is an additional notice: "Use of the software files and documentation is subject to license terms." Although this might be strictly true (as it's subject to EPL-1.0), it could be misread as saying that additional terms apply. I would recommend that the contributor remove this line before contributing it to the ODL repo.
  3. In the root directory, the files mvnw and mvnw.cmd contain Apache-2.0 license notices. This is likely not a significant issue because it appears these are intended to be standalone scripts, and Apache-2.0 is generally understood as a permissive license. However, if these files are not essential, it might be preferable to omit them from the repo so that it is only EPL-1.0.
  4. In the "No license found" tab, there are roughly 50 files listed where license notices were not detected. To improve license notice coverage, EPL-1.0 notices could likely be added to many of these files. Please note though that this can be an ongoing improvement and does not need to be addressed before pulling it into the ODL repo.
    1. Further down, that tab also lists several "excluded file extension" files such as JSON files where license info cannot be easily added, due to a lack of a comments format; these can be disregarded.

I hope this is helpful – happy to discuss if any questions.

Report: plastic-2019-10-31.xlsx

Comment by Allan Clarke [ 31/Oct/19 ]

Will resolve #1-3 (mostly by removing unwanted files)

#4 will probably remain (and won't be an issue)

Generated at Wed Feb 07 20:45:39 UTC 2024 using Jira 8.20.10#820010-sha1:ace47f9899e9ee25d7157d59aa17ab06aee30d3d.