Engage in the IP Due Diligence Process

I understand that the project is currently very stable and has no ongoing development. I'm hopeful, though, that committers/maintainers are paying attention and have some ability to engage.

AFAICT, the project team has not engaged in IP due diligence.

I did a quick test with the Eclipse Dash License Tool on Maven dependencies in this repository and discovered some party libraries that may require vetting via the Eclipse IP Due Diligence Process.

$ export JAVA_HOME=/usr/lib/jvm/java-8-temurin-jdk
$ mvn dependency:list -DskipTests -Dfindbugs.skip -Dspotbugs.skip | grep -Poh "\S+:compile$" | sort -u > maven.deps
$ export JAVA_HOME=/usr/lib/jvm/java-21-openjdk/
$ java -jar /gitroot/dash-licenses/shaded/target/org.eclipse.dash.licenses-1.1.1-SNAPSHOT.jar maven.deps -batch 50

I discovered almost 900 Maven "compile" dependencies. Most of these have already been vetted by the Eclipse IP Team, but almost 200 need to be reviewed. We depend heavily on project teams understanding their dependencies, so some of what I discovered may not be entirely accurate. A project committer/maintainer should validate that the means by which I've generated the list and the results are correct.

Note that I've used a pretty clumsy mechanism for generating the dependency list. The Eclipse Dash License Tool does have a Maven plugin, but it uses a much more recent version of Java than the project build and I couldn't quite sort out how to make the plugin work.

Please make sure that you engage in the IP Due Diligence Process for all project dependencies.

The tool can be used to automatically generate requests for the IP Team to review this content. To do this, you'll need to generate an API token on the Eclipse Foundation's GitLab instance and add the following switches to the command:

-review -project locationtech.geowave -token <YOUR TOKEN>

Ideally, you should vet third party content whenever you add or change dependencies.

Let me or the EMO Team know if you require assistance.

/cc @mtdelgadoa @CarmenDelgadoEclipse @rahulmohang

Start by reviewing the repository's Maven dependency output and the Eclipse Dash License Tool process described in the issue. Reproduce the dependency list, validate the nearly 200 results needing review, and use the documented API-token workflow to request Eclipse IP Team reviews; done means all project dependencies have been vetted.