Purushottam Sinha created FLINK-41497:
-----------------------------------------
Summary: flink-python: NOTICE doesn't credit the third-party code
bundled in Netty
Key: FLINK-41497
URL: https://issues.apache.org/jira/browse/FLINK-41497
Project: Flink
Issue Type: Bug
Components: API / Python
Affects Versions: 2.2.1, 2.3.0, 1.20.5
Reporter: Purushottam Sinha
*Problem*
The flink-python jar bundles two copies of Netty, but its NOTICE and licence
files don't cover the third-party code inside them. Some of it is MIT or BSD,
whose licence text must ship, so the jar doesn't meet ASF licensing policy.
*Evidence*
* The released {{flink-python-2.2.0.jar}} ships {{netty-common}} with SLF4J
(MIT), JSR-166, Apache Harmony and JCTools code. {{META-INF/licenses/}} has
none of these licences.
* {{beam-vendor-grpc-1_69_0}} adds a second Netty 4.1 (HPACK, Base64, jbzip2,
libdivsufsort, jfastlz, Webbit). Only netty-tcnative's NOTICE reaches the jar,
and this copy isn't listed.
* On master the NOTICE lists Netty 4.2.17 under the Beam heading and gRPC
1.59.1, though the vendored gRPC is 1.69.
*Proposed fix*
* Add NOTICE entries and licence files for both copies, reusing the Netty files
from FLINK-41388.
* Move the direct Netty lines out of the Beam section and correct the Beam
sub-list.
* Backport to release-1.20, 2.2, 2.3 and 2.4.
*Acceptance*
* The built jar lists both Netty copies and ships a licence for every MIT/BSD
component they contain.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
