google / google/play-services-plugins

Silent failures when POM files are missing or unresolvable

Open
#387 0 comments 3 reactions 0 assignees View on GitHub
Dominant language
Kotlin
Stars
526
Forks
167
Avg merge
7d 21h
Merged PRs (30d)
2

Description

## Problem

When the plugin resolves POM files for license extraction, failures are silently swallowed:

1. **Network/resolution failures**: `createArtifactResolutionQuery()` returns `UnresolvedArtifactResult` for POMs that can't be fetched. The plugin filters these out silently — the dependency just gets no license entry in the output.

2. **Missing POM files**: `addLicensesFromPom()` logs an error (`POM file $pomFile for $group:$name does not exist`) but continues. The build succeeds with incomplete license data.

3. **No completeness validation**: There's no check that every dependency in AGP's `METADATA_LIBRARY_DEPENDENCIES_REPORT` actually ended up with a license entry in the final output. Missing licenses are invisible to the user.

## Impact

A build can produce `third_party_licenses` / `third_party_license_metadata` files that are silently missing license entries for some dependencies. This could be a compliance issue.

## Considerations

- Some POMs legitimately have no `` block — should that be a warning vs. an error?
- Should there be a strict mode (fail on missing) vs. lenient mode (warn only)?
- Google Play Services artifacts bundle their own license data in the AAR, so missing POMs for those are less critical

## Relevant code

- `OssLicensesPlugin.groovy` — POM resolution query filters out `UnresolvedArtifactResult` silently
- `LicensesTask.groovy:addLicensesFromPom()` — logs error but doesn't fail
- `LicensesTask.groovy:addGooglePlayServiceLicenses()` — logs warn but doesn't fail

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.