weiqingy opened a new pull request, #991: URL: https://github.com/apache/flink-agents/pull/991
Linked issue: #990 ### Purpose of change The bundled `META-INF/NOTICE` declared 177 third-party artifacts while the shaded distribution jar contains 195, so the distribution shipped several thousand classes of third-party code with no attribution entry. This adds the 18 missing rows and the four license texts the distribution did not yet carry. The change is additive: no existing entry is removed, reworded or reordered. All 18 trace to one cause rather than to accumulated drift. `com.google.genai:google-genai` and its transitive tree account for 13 of them, and the other five are platform classifiers of `netty-tcnative-boringssl-static`. The bare coordinate was already listed, but the file's invariant is one row per resolved coordinate including classifier, which is why `netty-transport-native-epoll` already appears only in its classified form. Both the bare and the classified tcnative jars are bundled, so tcnative needs all six rows. Four dependencies are under licenses whose text was not present under `META-INF/licenses/`, so their texts are added: `Java-WebSocket` under MIT, `api-common` and `google-auth-library` under BSD-3-Clause, and `javax.annotation-api` under CDDL 1.1 with the GPLv2 Classpath Exception. The last needed a new section, since the file had no CDDL section before. For the MIT and BSD-3 dependencies the retained copyright notice is the substance of the obligation, so these are the entries where accuracy matters most. Each license text was taken from the dependency's own release, and the license classification for every added artifact was read from that artifact's POM or parent POM rather than from general knowledge of what those projects usually use. None of the added dependencies ships its own `META-INF/NOTICE`, so there was nothing to propagate. There is no over-listing to correct here. All 177 pre-existing rows do correspond to artifacts actually bundled. ### Tests No new tests. This changes a resource file, and there is no existing test that reads NOTICE. Verified on the branch: `tools/build.sh` clean, `tools/check-license.sh` clean (relevant, since the change adds files to a licensing directory). The jar inside the built wheel was checked to carry the updated NOTICE with 195 rows, matching the 195 bundled third-party artifacts one to one in both directions, and the four new license files. The omission set was derived twice by different routes and reconciled: once from the shade plugin's own `Including <coordinate>` log, and once from `mvn dependency:list -DincludeScope=runtime` across the `dist` modules. Both give the same 195 and the same 18. As a completeness check, every entry in the built jar was reconciled against the contents of the 211 bundled artifact jars: of 83,265 class entries, none were unaccounted for. ### API No. This changes only bundled license metadata. ### Documentation - [ ] `doc-needed` - [x] `doc-not-needed` - [ ] `doc-included` ### Was this patch authored or co-authored using generative AI tooling? - [x] Yes - [ ] No `Generated-by: Claude Code 2.1.226`, included in the commit message. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
