[ https://issues.apache.org/jira/browse/FLINK-41467 ]
Rui Fan deleted comment on FLINK-41467:
---------------------------------
was (Author: fanrui):
Apache Trusted Releases (ATR) checks on the 1.20.6 rc1 candidate confirm this
issue. ATR reported exactly one BLOCKER:
* Check: {{license.files}}
* Artifact: {{apache_flink-1.20.6.tar.gz}}
* Result: "No NOTICE file found"
The {{apache_flink_libraries}} sdist and the source tgz passed the same check.
Root cause: {{flink-python/MANIFEST.in}} contains {{include NOTICE}}, but no
{{flink-python/NOTICE}} exists and {{flink-python/setup.py}} only copies
{{LICENSE}} into the package, so the {{apache-flink}} sdist (and wheels) ship
without a NOTICE file. This applies to all releases since 1.13.
ASF release policy requires the NOTICE file in every distributed artifact:
https://www.apache.org/legal/release-policy.html#licensing-documentation
Fix: add {{flink-python/NOTICE}} with the standard ASF header (same as the root
NOTICE header). Locally verified that the built {{apache-flink}} sdist then
contains NOTICE at its root, and without the file setuptools warns "no files
found matching 'NOTICE'" and the sdist has no NOTICE.
> PyFlink apache-flink package is missing the NOTICE file
> -------------------------------------------------------
>
> Key: FLINK-41467
> URL: https://issues.apache.org/jira/browse/FLINK-41467
> Project: Flink
> Issue Type: Bug
> Components: API / Python
> Affects Versions: 1.13.0, 2.3.0, 2.2.1, 1.20.5
> Reporter: Rui Fan
> Assignee: Rui Fan
> Priority: Blocker
> Labels: pull-request-available
> Fix For: 2.2.2, 1.20.6, 2.3.1, 2.4.0, 2.5.0
>
>
> The {{apache-flink}} Python package published to PyPI (both the sdist and the
> wheels) has not contained a NOTICE file since 1.13.0.
> {{flink-python/MANIFEST.in}} contains {{include NOTICE}}, but there is no
> {{flink-python/NOTICE}} file and {{flink-python/setup.py}} only copies the
> root LICENSE into the package. The logic that generated a NOTICE file for
> this package was removed together with the bundled licenses in FLINK-22095,
> so {{include NOTICE}} silently matches nothing. The
> {{apache-flink-libraries}} package is not affected, its setup.py still
> generates a NOTICE file.
> The ASF release policy requires every distributed package to ship a NOTICE
> file:
> * https://www.apache.org/legal/release-policy.html#licensing-documentation :
> "Each package MUST provide a LICENSE file and a NOTICE file which account for
> the package's exact content."
> * https://infra.apache.org/licensing-howto.html : a NOTICE file containing
> the standard ASF attribution is required even for packages that only contain
> ASF code.
> The {{apache-flink}} package only contains Apache Flink code (the pyflink
> Python sources plus the bin/conf scripts from flink-dist), so the fix is to
> add a {{flink-python/NOTICE}} file with the standard ASF attribution (same
> header as the root NOTICE):
> {noformat}
> Apache Flink
> Copyright 2014-2026 The Apache Software Foundation
> This product includes software developed at
> The Apache Software Foundation (http://www.apache.org/).
> {noformat}
> The root NOTICE must not be copied as is, because it lists third-party
> material that is not bundled in the Python package.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
