`bumplock` does not validate license compliance — stale and missing entries accumulate in `NOTICE.TXT`
Summary
The bumplock process (which updates Gemfile.jruby-*.lock.release on active branches 8.19, 9.4, and 9.5) upgrades gem versions but never runs the license check. As a result, two classes of silent drift build up over time:
- Missing entries — a newly pinned or upgraded gem has no license mapping in
licenseMapping.csvand no corresponding*-NOTICE.txtfile, causing thepassport-controlCI job to fail on the next unrelated PR. - Stale entries — when a gem is upgraded, the old version URL in
tools/dependencies-report/src/main/resources/notices/<gem>-NOTICE.txtis never updated to match the new version, soNOTICE.TXTcontinues to reference the old tag.
Concrete examples found
| Issue | Gem | Details |
|---|---|---|
| Missing license mapping + NOTICE | resolv 0.7.2 |
Pinned in #19483 on 8.19 but licenseMapping.csv had no resolv: entry and resolv-NOTICE.txt didn't exist. The passport-control job failed on build #4344. |
| Stale NOTICE URL | jrjackson 0.5.2 |
jrjackson-NOTICE.txt still pointed to https://github.com/guyboertje/jrjackson/blob/v0.4.6/README.md despite the gem being on 0.5.2. |
Root cause
bumplock only updates the lockfile. It does not call bin/dependencies-report or ./gradlew generateLicenseReport afterwards, so neither missing nor stale license metadata is caught until the passport-control CI step runs on a future PR — often one that has nothing to do with the dependency change.
Proposed fix
Add a bin/dependencies-report --csv /tmp/report.csv step to the bumplock CI job (or as a post-step), identical to what ci/license_check.sh does. A failure would signal that either:
- a new
licenseMapping.csventry is needed, or - a
*-NOTICE.txtfile needs to be created or updated.
This applies to the three active branches that have bumplock: 8.19, 9.4, and 9.5.
References
bumplocklockfiles:Gemfile.jruby-3.4.lock.release- License check script:
ci/license_check.sh - License mapping:
tools/dependencies-report/src/main/resources/licenseMapping.csv - NOTICE templates:
tools/dependencies-report/src/main/resources/notices/
Recent fixes:
Source: elastic/logstash