bharos opened a new issue, #13253: URL: https://github.com/apache/gravitino/issues/13253
### Version 1.3.1 ### Describe what's wrong Auditing the `v1.3.1-rc1` binary distributions against the LICENSE/NOTICE files in the tree turned up several bundled components that are either unlisted, listed under a stale version, or referenced through a path that does not exist. **1. FastDoubleParser and its sub-components are bundled but listed nowhere.** `jackson-core` shades FastDoubleParser and ships the corresponding license texts in its own `META-INF`. Every one of the four binary distributions bundles a `jackson-core` jar, yet grepping all LICENSE files for `FastDoubleParser`, `fast_float`, `fast_double_parser`, `bigint`, `Tim Buktu`, `Daniel Lemire`, or `Boost Software` returns zero hits. This also means the Boost Software License 1.0 is bundled but never declared as a license family. **2. `NOTICE.bin` declares a Jetty version that is not shipped.** It attributes `Jetty 6.1.26` / `Copyright 1995-2016`. No `jetty-*-6.x` jar exists in any distribution; all four bundle `jetty-*-9.4.58.v20250814`, whose `META-INF/NOTICE.txt` reads `Copyright 1995-2018`. `NOTICE.iceberg` and `NOTICE.lance` bundle Jetty but carry no Jetty attribution at all. **3. `LICENSE.trino` and `NOTICE.trino` attribute Log4j, which is not bundled.** The Trino connector distribution contains no `log4j` jar, but `LICENSE.trino` lists five Log4j entries and `NOTICE.trino` carries two Log4j notice blocks. **4. Dropwizard Metrics is under-listed.** The main, Iceberg and Lance distributions each bundle seven `metrics-*-4.2.25` jars (annotation, core, healthchecks, jmx, json, jvm, servlets). `LICENSE.bin` lists only `Dropwizard Hadoop Metrics`, which is a different component; `LICENSE.iceberg` adds a bare `Metrics`. **5. gRPC API and gRPC Context are bundled but unlisted** in `LICENSE.bin` and `LICENSE.iceberg`. **6. ASM is bundled but missing from the BSD section of `LICENSE.lance`.** **7. Dangling and incorrect file references.** `NOTICE.bin`, `NOTICE.iceberg` and `NOTICE.lance` point at a `FastDoubleParser-NOTICE` file that does not exist in the distribution. `LICENSE` and `NOTICE` reference `web/LICENSE` and `web/web/NOTICE`; the actual paths are `web/web/` and `web-v2/web/`, and the `web-v2` UI is not referenced at all. **8. Typo:** `Error Pront Annotations` in `LICENSE.iceberg`. ### Error message and/or stacktrace _No response_ ### How to reproduce Download the `v1.3.1-rc1` binary distributions and compare the bundled jars against the corresponding LICENSE/NOTICE files, for example: ``` curl -sS https://dist.apache.org/repos/dist/dev/gravitino/v1.3.1-rc1/gravitino-1.3.1-bin.tar.gz | tar -tzf - | grep -E 'jetty|metrics-|grpc' grep -c FastDoubleParser LICENSE.bin ``` ### Additional context Credit to Justin Mclean for reporting most of these on the RC vote thread. Items 1, 2 and 4 were found while verifying that list. Two items from the original report are **not** defects: - **DataSketches** is not bundled in any of the four distributions (`paimon-common`, which shades it, is not part of the release). - **Coda Hale / Yammer** attribution is not required: `metrics-core-4.2.25.jar` ships no `META-INF/NOTICE` and no `META-INF/LICENSE`, so there is nothing to propagate, and ASF guidance is to keep NOTICE minimal. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
