weiqingy opened a new issue, #990: URL: https://github.com/apache/flink-agents/issues/990
### Search before asking - [x] I searched in the [issues](https://github.com/apache/flink-agents/issues) and found nothing similar. ### Description The `META-INF/NOTICE` bundled inside the distribution jar declares 177 third-party artifacts. The jar actually shades **195**. The 18 missing ones are distributed with no attribution entry at all. By entry count, the largest omissions are `com.google.genai:google-genai` (3,363 classes), `io.opencensus:opencensus-api` and `opencensus-contrib-http-util` (413), `com.google.auth:google-auth-library-*` (188), and `org.java-websocket:Java-WebSocket` (100). All 18 trace to a single cause: the Gemini integration's transitive tree, plus five platform classifiers of `netty-tcnative-boringssl-static` whose bare coordinate was already listed. This looks like one missed NOTICE update rather than accumulated drift, and there is **no over-listing** on the other side: all 177 existing rows do correspond to bundled artifacts. Four of the omitted dependencies are under licenses whose text the distribution does not carry at all: `Java-WebSocket` (MIT), `api-common` and `google-auth-library` (BSD-3-Clause), and `javax.annotation-api` (CDDL 1.1 with the GPLv2 Classpath Exception). For the BSD-3 and MIT ones the retained copyright notice is the substance of the obligation, so the omission is not merely cosmetic. This is worth fixing before the next release vote, since LICENSE and NOTICE accuracy is checked there. ### How to reproduce Build the distribution and compare what the shaded jar contains against what the NOTICE declares: ```bash ./tools/build.sh # rows declared in the bundled NOTICE unzip -p dist/common/target/flink-agents-dist-common-*.jar META-INF/NOTICE | grep -c '^- ' # third-party artifacts actually shaded in mvn dependency:list -pl dist/common -DincludeScope=runtime ``` The dependency list resolves 195 third-party artifacts (excluding the project's own modules and `slf4j-api`, which `artifactSet` excludes) against 177 declared rows. A direct spot-check of a single omission: ```bash unzip -l dist/common/target/flink-agents-dist-common-*.jar | grep -c 'com/google/genai' # 3363 unzip -p dist/common/target/flink-agents-dist-common-*.jar META-INF/NOTICE | grep -c genai # 0 ``` ### Version and environment Reproduced on `main` at `7a8a9517`. Not version specific: the omissions come from the dependency tree rather than from any Flink version, and the same 211 coordinates are bundled by every `dist` shade execution. ### Are you willing to submit a PR? - [x] I'm willing to submit a PR! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
