google / google/play-services-plugins
Silent failures when POM files are missing or unresolvable
- Dominant language
- Kotlin
- Stars
- 526
- Forks
- 167
- Avg merge
- 7d 21h
- Merged PRs (30d)
- 2
Description
## Problem
When the plugin resolves POM files for license extraction, failures are silently swallowed:
1. **Network/resolution failures**: `createArtifactResolutionQuery()` returns `UnresolvedArtifactResult` for POMs that can't be fetched. The plugin filters these out silently — the dependency just gets no license entry in the output.
2. **Missing POM files**: `addLicensesFromPom()` logs an error (`POM file $pomFile for $group:$name does not exist`) but continues. The build succeeds with incomplete license data.
3. **No completeness validation**: There's no check that every dependency in AGP's `METADATA_LIBRARY_DEPENDENCIES_REPORT` actually ended up with a license entry in the final output. Missing licenses are invisible to the user.
## Impact
A build can produce `third_party_licenses` / `third_party_license_metadata` files that are silently missing license entries for some dependencies. This could be a compliance issue.
## Considerations
- Some POMs legitimately have no `` block — should that be a warning vs. an error?
- Should there be a strict mode (fail on missing) vs. lenient mode (warn only)?
- Google Play Services artifacts bundle their own license data in the AAR, so missing POMs for those are less critical
## Relevant code
- `OssLicensesPlugin.groovy` — POM resolution query filters out `UnresolvedArtifactResult` silently
- `LicensesTask.groovy:addLicensesFromPom()` — logs error but doesn't fail
- `LicensesTask.groovy:addGooglePlayServiceLicenses()` — logs warn but doesn't fail
Contributor guide
Assessment
This issue has not been assessed yet.