bharos opened a new pull request, #13254: URL: https://github.com/apache/gravitino/pull/13254
### What changes were proposed in this pull request? Reconciles the LICENSE and NOTICE files against what the `v1.3.1-rc1` binary distributions actually bundle. **Additions — bundled but previously unlisted** - **FastDoubleParser** and the three projects it derives code from (`fast_float`, `fast_double_parser`, `bigint`) plus **Schubfach**. `jackson-core` shades FastDoubleParser and ships the license texts in its own `META-INF`; a `jackson-core` jar is present in all four distributions. This also introduces the **Boost Software License 1.0** family, which was not declared anywhere. - The corresponding license texts, added under `licenses/`: `FastDoubleParser.txt`, `FastDoubleParser-thirdparty.txt`, `Schubfach.txt`. - The seven bundled **Dropwizard Metrics** artifacts (`metrics-annotation`, `-core`, `-healthchecks`, `-jmx`, `-json`, `-jvm`, `-servlets`, all `4.2.25`). - **gRPC API** and **gRPC Context** in `LICENSE.bin` and `LICENSE.iceberg`. - **ASM** in the BSD section of `LICENSE.lance`. **Corrections — listed but wrong** - `NOTICE.bin` attributed **Jetty 6.1.26 / Copyright 1995-2016**. No 6.x jetty jar ships; all four distributions bundle `jetty-*-9.4.58.v20250814`, whose `META-INF/NOTICE.txt` reads `Copyright 1995-2018`. Corrected, and the missing Jetty attribution added to `NOTICE.iceberg` and `NOTICE.lance`. - **Log4j** removed from `LICENSE.trino` (five entries) and `NOTICE.trino` (two notice blocks). The Trino connector distribution bundles no `log4j` jar. - The dangling `FastDoubleParser-NOTICE` references in `NOTICE.bin`, `NOTICE.iceberg` and `NOTICE.lance` now point at files that exist. - Web UI paths corrected from `web/LICENSE` and `web/web/NOTICE` to `web/web/` **and** `web-v2/web/`; the `web-v2` UI was not referenced at all. - Typo `Error Pront Annotations` to `Error Prone Annotations` in `LICENSE.iceberg`. ### Why are the changes needed? These are ASF release-policy compliance defects: the distributions bundle third-party code whose license and required attribution are not declared, and declare attribution for code that is not bundled. Most were raised by Justin Mclean on the `v1.3.1-rc1` vote thread; the FastDoubleParser, Jetty version and Dropwizard Metrics items were found while verifying that report. Fix: #13253 ### Does this PR introduce _any_ user-facing change? No code or API change. The LICENSE and NOTICE files shipped in the source and binary distributions change. ### How was this patch tested? Verification was by inspection of the release artifacts rather than by an automated test, since the existing `dev/release/check-license.sh` only validates the source `LICENSE` file and cannot see any of these defects. A follow-up PR extends that script. For each claim, the bundled jar set was listed from the published RC artifacts and compared against the LICENSE/NOTICE entries: ``` BASE=https://dist.apache.org/repos/dist/dev/gravitino/v1.3.1-rc1 curl -sS $BASE/gravitino-1.3.1-bin.tar.gz | tar -tzf - | grep -E 'jetty|metrics-|grpc|jackson-core' ``` The FastDoubleParser text was taken from the `META-INF` entries of the bundled `jackson-core` jar, and the Jetty copyright range from the bundled `jetty-util-9.4.58.v20250814.jar` `META-INF/NOTICE.txt`, so the wording matches the shipped artifacts. Two items from the original report were checked and are **not** defects, so they are deliberately not addressed here: - **DataSketches** is not bundled in any of the four distributions; `paimon-common`, which shades it, is not part of this release. - **Coda Hale / Yammer** attribution is not required. `metrics-core-4.2.25.jar` ships no `META-INF/NOTICE` and no `META-INF/LICENSE`, so there is nothing to propagate into NOTICE. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
