mongodb/mongo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SERVER-122016: exclude first-party components from README.third_party.md and re-add WiredTiger vendored test library table (#50434)

Browse Source 
GitOrigin-RevId: 3a49a0db4e130569fcd57f735a4c637499bfe3cb
This commit is contained in:
Jason Hills 2026-03-26 16:50:54 -04:00 committed by MongoDB Bot
parent 9f9bac4916
commit 3a094225fd
5 changed files with 97 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
README.third_party.md
View File

@ -27,6 +27,7 @@ a notice will be included in
| [Asio C++ Library] | BSL-1.0 | 1.34.2 | | ✗ |
| [benchmark] | Apache-2.0 | 1.5.2 | | |
| [Boost C++ Libraries] | BSL-1.0 | 1.88.0 | | ✗ |
| [bzip2] | bzip2-1.0.6 | 1.0.8 | | ✗ |
| [c-ares] | MIT | 1.27.0 | | ✗ |
| [cpptrace] | MIT | 1.0.3 | | |
| [CRoaring] | Apache-2.0 OR MIT | 3.0.1 | | ✗ |
@ -41,13 +42,12 @@ a notice will be included in
| [immer] | BSL-1.0 | 0.9.1 | | ✗ |
| [Intel® Decimal Floating-Point Math Library] | BSD-3-Clause | 2.0.1 | | ✗ |
| [JSON Schema Store] | Apache-2.0 | 6847cfc3a17a04a7664474212db50c627e1e3408 | | |
| [json-c] | MIT | 0.17 | | ✗ |
| [JSON-Schema-Test-Suite] | MIT | 728066f9c5c258ba3b1804a22a5b998f2ec77ec0 | | |
| [libdwarf] | LGPL-2.1-or-later, BSD-3-Clause, Public Domain | 2.1.0 | | |
| [libmongocrypt] | Apache-2.0 | 1.15.0 | ✗ | ✗ |
| [LibTomCrypt] | Unlicense | 1.18.2 | ✗ | ✗ |
| [libunwind] | MIT | 1.8.1 | | ✗ |
| [linenoise] | BSD-2-Clause | 6cdc775807e57b2c3fd64bd207814f8ee1fe35f3 | | ✗ |
| [MongoDB C Driver] | Apache-2.0 | 1.28.1 | ✗ | ✗ |
| [Mozilla Firefox ESR] | MPL-2.0 | 140.7.0esr | | ✗ |
| [MurmurHash3] | Public Domain | a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb | | ✗ |
| [nlohmann/json] | MIT | 3.11.3 | ✗ | |
@ -60,6 +60,7 @@ a notice will be included in
| [pypi/ocspbuilder] | MIT | 0.10.2 | | |
| [pypi/ocspresponder] | Apache-2.0 | 0.5.0 | | |
| [re2] | BSD-3-Clause | 2025-08-05 | | ✗ |
| [rnp] | BSD-2-Clause, Apache-2.0, MIT | 0.18.1 | | ✗ |
| [S2 Geometry Library] | Apache-2.0 | a25c502bda9d7e0274b9e2b7825fbddf13cc0306 | ✗ | ✗ |
| [SafeInt] | MIT | 3.0.28a | | ✗ |
| [siphash] | CC0-1.0, MIT, Apache 2.0 with LLVM exception | eee7d0d84dc7731df2359b243aa5e75d85f6eaef | | ✗ |
@ -69,9 +70,8 @@ a notice will be included in
| [timelib] | MIT | 2022.13 | | ✗ |
| [Unicode Character Database] | Unicode-DFS-2016 | 8.0.0 | ✗ | ✗ |
| [valgrind.h] | BSD-4-Clause | 093bef43d69236287ccc748591c9560a71181b0a | | ✗ |
| [WiredTiger] | GPL-2.0-only OR GPL-3.0-only | 12.0.0 | ✗ | ✗ |
| [yaml-cpp] | MIT | 0.6.3 | | ✗ |
| [zlib] | Zlib | 1.3 | ✗ | ✗ |
| [zlib] | Zlib | 1.3.2 | ✗ | ✗ |
| [Zstandard (zstd)] | BSD-3-Clause OR GPL-2.0-only | 1.5.5 | ✗ | ✗ |
[Abseil Common Libraries (C++)]: https://github.com/abseil/abseil-cpp.git
@ -84,7 +84,6 @@ a notice will be included in
[JSON Schema Store]: https://github.com/schemastore/schemastore.git
[JSON-Schema-Test-Suite]: https://github.com/json-schema-org/JSON-Schema-Test-Suite.git
[LibTomCrypt]: https://github.com/libtom/libtomcrypt.git
[MongoDB C Driver]: https://github.com/mongodb/mongo-c-driver.git
[Mozilla Firefox ESR]: https://github.com/mozilla-firefox/firefox.git
[MurmurHash3]: https://github.com/aappleby/smhasher/blob/a6bd3ce/
[PCRE2 - Perl-Compatible Regular Expressions]: https://github.com/pcre2project/pcre2.git
@ -94,9 +93,9 @@ a notice will be included in
[SafeInt]: https://github.com/dcleblanc/safeint.git
[Snowball Stemming Algorithms (libstemmer)]: http://github.com/snowballstem/snowball.git
[Unicode Character Database]: https://www.unicode.org/Public/8.0.0/
[WiredTiger]: https://github.com/wiredtiger/wiredtiger.git
[Zstandard (zstd)]: https://github.com/facebook/zstd.git
[benchmark]: https://github.com/google/benchmark.git
[bzip2]: https://github.com/libarchive/bzip2
[c-ares]: https://github.com/c-ares/c-ares.git
[cpptrace]: https://github.com/jeremy-rifkin/cpptrace.git
[fmt]: https://github.com/fmtlib/fmt.git
@ -106,8 +105,8 @@ a notice will be included in
[googletest]: https://github.com/google/googletest.git
[gperftools]: https://github.com/gperftools/gperftools.git
[immer]: https://github.com/arximboldi/immer.git
[json-c]: https://github.com/json-c/json-c
[libdwarf]: https://github.com/davea42/libdwarf-code.git
[libmongocrypt]: https://github.com/mongodb/libmongocrypt.git
[libunwind]: https://github.com/libunwind/libunwind.git
[linenoise]: https://github.com/antirez/linenoise
[nlohmann/json]: https://github.com/nlohmann/json.git
@ -117,6 +116,7 @@ a notice will be included in
[pypi/ocspbuilder]: https://pypi.org/project/ocspbuilder/
[pypi/ocspresponder]: https://pypi.org/project/ocspresponder/
[re2]: https://github.com/google/re2.git
[rnp]: https://github.com/rnpgp/rnp
[siphash]: https://github.com/veorq/siphash/
[snappy]: https://github.com/google/tcmalloc.git
[tcmalloc]: https://github.com/google/tcmalloc.git
@ -125,6 +125,22 @@ a notice will be included in
[yaml-cpp]: https://github.com/jbeder/yaml-cpp.git
[zlib]: https://zlib.net/fossils/
## WiredTiger Vendored Test Libraries
The following libraries are transitively included by WiredTiger,
and are used by that component for testing. They don't appear in
released binary artifacts.
| Name |
| ------------------------------ |
| pkg:pypi/concurrencytest@0.1.2 |
| pkg:pypi/discover@0.4.0 |
| pkg:pypi/extras@0.0.3 |
| pkg:pypi/iso8601@2.1.0 |
| pkg:pypi/python-subunit@1.4.4 |
| pkg:pypi/testscenarios@0.4 |
| pkg:pypi/testtools@2.7.1 |
## Dynamically Linked Libraries
Sometimes MongoDB needs to load libraries provided and managed by the

16
buildscripts/sbom/metadata.cdx.json
View File

@ -2416,6 +2416,10 @@
{
"name": "import_script_path",
"value": "src/third_party/libmongocrypt/import.sh"
},
{
"name": "mdb_first_party",
"value": "true"
}
]
},
@ -2465,6 +2469,10 @@
{
"name": "import_script_path",
"value": "src/third_party/libbson/import.sh"
},
{
"name": "mdb_first_party",
"value": "true"
}
]
},
@ -2510,6 +2518,10 @@
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "mdb_first_party",
"value": "true"
}
]
},
@ -3217,6 +3229,10 @@
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "mdb_first_party",
"value": "true"
}
]
},

12
sbom.json
View File

@ -1804,6 +1804,10 @@
{
"name": "import_script_path",
"value": "src/third_party/libmongocrypt/import.sh"
},
{
"name": "mdb_first_party",
"value": "true"
}
]
},
@ -1853,6 +1857,10 @@
{
"name": "import_script_path",
"value": "src/third_party/libbson/import.sh"
},
{
"name": "mdb_first_party",
"value": "true"
}
]
},
@ -2463,6 +2471,10 @@
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "mdb_first_party",
"value": "true"
}
]
},

8
src/third_party/scripts/README.third_party.md.template vendored
View File

@ -23,6 +23,14 @@ $component_chart
$component_links
## WiredTiger Vendored Test Libraries
The following libraries are transitively included by WiredTiger,
and are used by that component for testing. They don't appear in
released binary artifacts.
$wiredtiger_chart
## Dynamically Linked Libraries
Sometimes MongoDB needs to load libraries provided and managed by the

38
src/third_party/scripts/gen_thirdpartyreadme.py vendored
View File

@ -2,6 +2,7 @@ import bisect
import json
import logging
import os
import re
import sys
import warnings
@ -26,9 +27,14 @@ def main():
component_links_string = sbom_to_component_links_string(sbom)
wiredtiger_chart = folders_to_wiredtiger_chart()
right_pad_chart_values(wiredtiger_chart)
wiredtiger_chart_string = chart_to_string(wiredtiger_chart)
template_data = {
"component_chart": component_chart_string,
"component_links": component_links_string,
"wiredtiger_chart": wiredtiger_chart_string,
}
create_markdown_with_template(template_data)
@ -56,6 +62,8 @@ def sbom_to_component_chart(sbom: dict) -> list[list[str]]:
component_chart = []
for component in components:
if is_first_party(component):
continue
check_component_validity(component)
name = component["name"]
license_string = []
@ -109,6 +117,8 @@ def sbom_to_component_links_string(sbom: dict) -> list[list[str]]:
link_list = []
for component in components:
if is_first_party(component):
continue
check_component_validity(component)
info_link = get_component_info_link(component)
bisect.insort(link_list, f"[{component['name'].replace('|', '')}]: {info_link}")
@ -116,6 +126,34 @@ def sbom_to_component_links_string(sbom: dict) -> list[list[str]]:
return "\n".join(link_list)
WIREDTIGER_3RDPARTY_PATH = "src/third_party/wiredtiger/test/3rdparty"
_WIREDTIGER_FOLDER_RE = re.compile(r"(.*-\d+\.\d+(\.\d+)?).*")
def folders_to_wiredtiger_chart() -> list[list[str]]:
wiredtiger_chart = [["Name"]]
try:
folder_names = os.listdir(WIREDTIGER_3RDPARTY_PATH)
except FileNotFoundError:
logging.warning("Warning: %s does not exist. Skipping wiredtiger chart.", WIREDTIGER_3RDPARTY_PATH)
return wiredtiger_chart
for folder in folder_names:
m = _WIREDTIGER_FOLDER_RE.fullmatch(folder)
if m:
name, version = m.group(1).rsplit("-", 1)
bisect.insort(wiredtiger_chart, [f"pkg:pypi/{name}@{version}"])
return wiredtiger_chart
def is_first_party(component: dict) -> bool:
for prop in component.get("properties", []):
if prop.get("name") == "mdb_first_party" and prop.get("value") == "true":
return True
return False
def check_component_validity(component) -> None:
for required_key in ["name", "version", "licenses"]:
if required_key not in component: