Align Apache RAT configuration with the ATR license check

[ppkarwasz]

Motivation

During a release, the ASF Trusted Releases platform (ATR) re-checks the source archive with the Apache RAT CLI (see atr/tasks/checks/rat.py). ATR never reads the Maven POM: the only exclusion mechanisms it honors are its own predefined exclusions and a .rat-excludes file found in the archive. Any exclusion that lives only in the POM therefore hides a failure locally that ATR will later report against the release candidate.

This PR makes the local apache-rat-plugin check behave like the ATR check, so a build passing verify also passes ATR.

Changes

• Update apache-rat-plugin from 0.16.1 (managed by org.apache:apache) to 0.18.
• The POM configuration now contains only what ATR itself always applies:
  • the MISC, HIDDEN_DIR and MAC standard exclusion collections,
  • the generated-file patterns (*.min.js, *.css.map, etc. from GENERATED_FILE_SUFFIXES in atr/constants.py),
  • the LICENSE_CATEGORIES:0, LICENSE_NAMES:0 and STANDARDS:0 counter minimums.
• Two file-activated profiles reproduce ATR's two code paths, keyed on ${maven.multiModuleProjectDirectory}/.rat-excludes:
  • apache-rat-std-excludes (file absent): additionally applies the MAVEN, ECLIPSE, IDEA, GIT and STANDARD_SCMS collections, as ATR does for archives without a .rat-excludes file;
  • apache-rat-excludes-file (file present): passes the file to RAT via inputExcludeFile, and the SCM/IDE collections are not applied, as in ATR.
• All project-specific exclusions need to be removed from the POM and moved to a new .rat-excludes file.

Impact on downstream projects

Projects inheriting from logging-parent no longer inherit POM-level RAT excludes beyond the ATR-predefined ones. Each project must provide its own .rat-excludes at its repository root. This is intentional: those exclusions were invisible to ATR anyway, and the file makes them effective both locally and during the ATR release check.

[ppkarwasz]

The windows build requires #504.

[vy]

Can we fix ATR to honor the Apache Maven configuration instead, please? Can we, at the minimum, make sure this problem is communicated to the ATR project?

[ppkarwasz]

I did discuss this at the last roundtable, but personally I don't think this is something:

1. Easy to implement,
2. Aligned with the purpose of the ATR license check, which should be an independent check that all the files have a license.

Anyway, our goal is not to distribute files with an unknown license, but to omit the license header on some files and .rat-excludes does not fulfill that purpose.

Therefore I would rather submit a PR to Creadur RAT to recognize the REUSE specification and in particular the REUSE.toml file, which is a way to assign licenses to files that don't carry a license header.