Update Gradle plugins and replace unmaintained license plugin

.github/workflows/checks.yml

@@ -13,9 +13,9 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v4
       - name: Set up Java
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
-          distribution: adopt
+          distribution: 'temurin'
           java-version: 17
           cache: gradle
       - name: spotless
@@ -27,9 +27,9 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v4
       - name: Set up Java 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
-          distribution: adopt
+          distribution: 'temurin'
           java-version: 17
           cache: gradle
       - name: javadoc (JDK 17)

.github/workflows/codeql.yml

@@ -42,10 +42,11 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Set up Java
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
-        distribution: adopt
+        distribution: 'temurin'
         java-version: 17
+        cache: gradle
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/release.yml

@@ -7,10 +7,11 @@ jobs:
     runs-on: [besu-research-ubuntu-16]
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@v4
         with:
           distribution: 'temurin' # See 'Supported distributions' for available options
           java-version: '17'
+          cache: gradle
       - name: Login to DockerHub
         run: echo '${{ secrets.DOCKER_PASSWORD_RW }}' | docker login -u '${{ secrets.DOCKER_USER_RW }}' --password-stdin
       - name: Setup Gradle

.github/workflows/sonarcloud.yml

@@ -19,22 +19,17 @@ jobs:
       - name: checkout
         uses: actions/checkout@v4
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: '17'
+          cache: gradle
       - name: Cache SonarCloud packages
         uses: actions/cache@v3
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
           restore-keys: ${{ runner.os }}-sonar
-      - name: Cache Gradle packages
-        uses: actions/cache@v3
-        with:
-          path: ~/.gradle/caches
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
-          restore-keys: ${{ runner.os }}-gradle
       - name: Build and analyze
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any

CHANGELOG.md

@@ -12,6 +12,7 @@
 - New `Sequenced` transaction pool. The pool is an evolution of the `legacy` pool and is likely to be more suitable to enterprise or permissioned chains than the `layered` transaction pool. Select to use this pool with `--tx-pool=sequenced`. Supports the same options as the `legacy` pool [#6211](https://github.com/hyperledger/besu/issues/6211)
 - Set Ethereum Classic mainnet activation block for Spiral network upgrade [#6267](https://github.com/hyperledger/besu/pull/6267)
 - Add custom genesis file name to config overview if specified [#6297](https://github.com/hyperledger/besu/pull/6297)
+- Update Gradle plugins and replace unmaintained License Gradle Plugin with the actively maintained Gradle License Report [#6275](https://github.com/hyperledger/besu/pull/6275)
 
 ### Bug fixes
 

build.gradle

@@ -14,6 +14,7 @@
  */
 
 
+import com.github.jk1.license.filter.LicenseBundleNormalizer
 import groovy.transform.CompileStatic
 import groovy.transform.Memoized
 import net.ltgt.gradle.errorprone.CheckSeverity
@@ -22,15 +23,15 @@ import java.text.SimpleDateFormat
 import java.util.regex.Pattern
 
 plugins {
-  id 'com.diffplug.spotless' version '6.12.0'
-  id 'com.github.ben-manes.versions' version '0.42.0'
-  id 'com.github.hierynomus.license' version '0.16.1-fix'
-  id 'com.jfrog.artifactory' version '4.28.3'
-  id 'io.spring.dependency-management' version '1.0.11.RELEASE'
-  id 'me.champeau.jmh' version '0.7.0' apply false
-  id 'net.ltgt.errorprone' version '2.0.2'
+  id 'com.diffplug.spotless' version '6.23.3'
+  id 'com.github.ben-manes.versions' version '0.50.0'
+  id 'com.github.jk1.dependency-license-report' version '2.5'
+  id 'com.jfrog.artifactory' version '5.1.11'
+  id 'io.spring.dependency-management' version '1.1.4'
+  id 'me.champeau.jmh' version '0.7.2' apply false
+  id 'net.ltgt.errorprone' version '3.0.1'
   id 'maven-publish'
-  id 'org.sonarqube' version '3.4.0.2513'
+  id 'org.sonarqube' version '4.4.1.3373'
 }
 
 sonarqube {
@@ -87,13 +88,35 @@ def _strListCmdArg(name) {
   return _strListCmdArg(name, null)
 }
 
+licenseReport {
+  // This is for the allowed-licenses-file in checkLicense Task
+  // Accepts File, URL or String path to local or remote file
+  allowedLicensesFile = new File("$rootDir/gradle/allowed-licenses.json")
+
+  excludes = [
+    // only used for static analysis, not actually shipped
+    'com.google.errorprone:javac',
+    'org.checkerframework:dataflow-shaded',
+    'org.checkerframework:dataflow-errorprone',
+    // exclude Kotlin multiplatform dependencies container, they have the same license of what they contain
+    'com.squareup.okio:okio',
+    'org.jetbrains.kotlinx:kotlinx-coroutines-core'
+  ]
+
+  // If set to true, then all boms will be excluded from the report
+  excludeBoms = true
+
+  filters = [
+    new LicenseBundleNormalizer(bundlePath: "$rootDir/gradle/license-normalizer-bundle.json")
+  ]
+}
+
 allprojects {
   apply plugin: 'java-library'
   apply plugin: 'io.spring.dependency-management'
   apply plugin: 'jacoco'
   apply plugin: 'net.ltgt.errorprone'
   apply from: "${rootDir}/gradle/versions.gradle"
-  apply from: "${rootDir}/gradle/check-licenses.gradle"
 
   version = rootProject.version
 
@@ -177,7 +200,7 @@ allprojects {
     }
     groovyGradle {
       target '*.gradle'
-      greclipse('4.21.0').configFile(rootProject.file('gradle/formatter.properties'))
+      greclipse('4.21').configFile(rootProject.file('gradle/formatter.properties'))
       endWithNewline()
     }
     // Below this line are currently only license header tasks
@@ -323,7 +346,6 @@ allprojects {
     options.addStringOption('Xwerror', '-html5')
     options.encoding = 'UTF-8'
   }
-
 }
 
 task deploy() {}
@@ -624,10 +646,10 @@ task autocomplete(type: JavaExec) {
   }
 }
 
-installDist { dependsOn checkLicenses, untunedStartScripts, evmToolStartScripts }
+installDist { dependsOn checkLicense, untunedStartScripts, evmToolStartScripts }
 
 distTar {
-  dependsOn checkLicenses, autocomplete, untunedStartScripts, evmToolStartScripts
+  dependsOn checkLicense, autocomplete, untunedStartScripts, evmToolStartScripts
   doFirst {
     delete fileTree(dir: 'build/distributions', include: '*.tar.gz')
   }
@@ -636,7 +658,7 @@ distTar {
 }
 
 distZip {
-  dependsOn checkLicenses, autocomplete, untunedStartScripts, evmToolStartScripts
+  dependsOn checkLicense, autocomplete, untunedStartScripts, evmToolStartScripts
   doFirst {
     delete fileTree(dir: 'build/distributions', include: '*.zip')
   }
@@ -958,7 +980,6 @@ task checkSpdxHeader(type: CheckSpdxHeader) {
     "(.*${sep}build${sep}.*)",
     "(.*${sep}src${sep}[^${sep}]+${sep}generated${sep}.*)"
   ].join("|")
-
 }
 
 task jacocoRootReport(type: org.gradle.testing.jacoco.tasks.JacocoReport) {

gradle.properties

@@ -14,3 +14,5 @@ org.gradle.jvmargs=-Xmx4g \
 --add-opens jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED \
 --add-opens jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED \
 --add-opens jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
+# Could be moved to sonar properties after https://sonarsource.atlassian.net/browse/SONARGRADL-134
+systemProp.sonar.gradle.skipCompile=true

gradle/allowed-licenses.json

@@ -0,0 +1,65 @@
+{
+  "allowedLicenses": [
+    {
+      "moduleLicense": "Apache License, Version 2.0",
+      "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
+    },
+    {
+      "moduleLicense": "BSD Zero Clause License",
+      "moduleLicenseUrl": "https://opensource.org/licenses/0BSD"
+    },
+    {
+      "moduleLicense" : "The 2-Clause BSD License",
+      "moduleLicenseUrl" : "https://opensource.org/licenses/BSD-2-Clause"
+    },
+    {
+      "moduleLicense": "The 3-Clause BSD License",
+      "moduleLicenseUrl": "https://opensource.org/licenses/BSD-3-Clause"
+    },
+    {
+      "moduleLicense": "Bouncy Castle Licence",
+      "moduleLicenseUrl": "https://www.bouncycastle.org/licence.html"
+    },
+    {
+      "moduleLicense": "COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0",
+      "moduleLicenseUrl": "https://oss.oracle.com/licenses/CDDL"
+    },
+    {
+      "moduleLicense" : "COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.1",
+      "moduleLicenseUrl" : "https://oss.oracle.com/licenses/CDDL-1.1"
+    },
+    {
+      "moduleLicense": "Eclipse Distribution License - v 1.0",
+      "moduleLicenseUrl": "http://www.eclipse.org/legal/epl-v10.html"
+    },
+    {
+      "moduleLicense": "Eclipse Public License - v 2.0",
+      "moduleLicenseUrl": "https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt"
+    },
+    {
+      "moduleLicense": "MIT License",
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
+    },
+    {
+      "moduleLicense": "CC0-1.0",
+      "moduleLicenseUrl": "https://creativecommons.org/publicdomain/zero/1.0/legalcode"
+    },
+    {
+      "moduleLicense": "Public-Domain"
+    },
+    {
+      "moduleLicense": "Unicode/ICU License",
+      "moduleLicenseUrl": "https://raw.githubusercontent.com/unicode-org/icu/main/icu4c/LICENSE"
+    },
+    {
+      "moduleLicense": "Creative Commons Legal Code",
+      "moduleVersion": "1.0.3",
+      "moduleName": "org.reactivestreams:reactive-streams"
+    },
+    {
+      "moduleLicense": "Eclipse Public License - v 1.0",
+      "moduleVersion": "4.13.2",
+      "moduleName": "junit:junit"
+    }
+  ]
+}