manuzhang opened a new pull request, #7602: URL: https://github.com/apache/datafusion-comet/pull/7602
## Which issue does this PR close? Part of #7383. It does not close it: the audit of the remaining bundled dependencies is still open. ## Rationale for this change The shaded Comet JAR bundles relocated `com.google.protobuf:protobuf-java` 3.25.5 classes (BSD-3-Clause, in the shade `artifactSet` in `spark/pom.xml`), but the license and copyright text is not in `META-INF/LICENSE`. The protobuf-java JAR carries no license file of its own, so nothing else supplies it. This was raised in the [review of #7382](https://github.com/apache/datafusion-comet/pull/7382#pullrequestreview-5758047588). ## What changes are included in this PR? - Add the protobuf-java 3.25.5 license and copyright to `dev/licenses/LICENSE-binary.txt`. The text matches the `LICENSE` file at the upstream `v25.5` tag. - Make `dev/ensure-jars-have-correct-contents.sh` fail when `protobuf.version` in the root `pom.xml` differs from the version the LICENSE names, or when the property is missing or ambiguous. This mirrors the existing lz4_flex and Zstandard checks against `native/Cargo.lock`. The same review also asked about `lib/dictBuilder/divsufsort.c` (MIT) in the Zstandard sources. This PR does not add its text. The `zdict_builder` feature is enabled, so the file is compiled and its object is pulled into the link, but the linker drops the code: there are no `divsufsort`, `ZDICT_`, `COVER_` or `FASTCOVER_` symbols in the released 1.2.0 Linux `libcomet.so` (amd64 and aarch64) or in local macOS release, ci and debug builds. Windows was not checked. ## How are these changes tested? - `dev/ci/test-jar-contents.py`, which runs in Preflight, has two new tests and one new case: a `protobuf.version` that differs from the LICENSE, a missing or duplicated `protobuf.version` property, and a LICENSE with the protobuf copyright line removed. All 16 tests pass locally, and disabling the new check in the script fails the drift test. - `test_license_matches_cargo_lock_and_pom` (renamed) runs the checker against the repository's real `pom.xml`, so a protobuf bump fails Preflight until `LICENSE-binary.txt` is updated. - I did not rebuild the JARs with Maven. The shade configuration is unchanged and packages the same file. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
