Richard Zowalla created OPENNLP-1939:
----------------------------------------
Summary: Binary distribution LICENSE lacks libsvm (BSD-3) and
SLF4J (MIT) license texts
Key: OPENNLP-1939
URL: https://issues.apache.org/jira/browse/OPENNLP-1939
Project: OpenNLP
Issue Type: Bug
Components: Build, Packaging and Test
Reporter: Richard Zowalla
Fix For: 3.0.0
Found while verifying 3.0.0\-M6 RC1 \(non\-blocking, same state as in
3.0.0\-M5\).
The binary distribution ships the following third\-party jars in {{lib/}} whose
licenses are not reproduced in the binary {{LICENSE}}:* {{libsvm\-3.35.jar}} \-
BSD 3\-Clause. {{NOTICE}} only mentions it with a copyright line \({{Copyright
\(c\) 2000\-2023 Chih\-Chung Chang and Chih\-Jen Lin}}\); the full BSD\-3 text
is missing. The jar itself carries no license file.
* {{slf4j\-api\-2.0.19.jar}} \- MIT. Only listed in the dependency list of
{{NOTICE}}; the MIT text is missing from {{LICENSE}}.
In addition, {{LICENSE}} contains a CDDL 1.1 section "applies to jersey and
some of its dependencies", but no jersey \(or other CDDL\) artifact is part of
the binary distribution anymore, so this section appears stale.
Per
[https://infra.apache.org/licensing\-howto.html|https://infra.apache.org/licensing-howto.html]
the {{LICENSE}} of a binary distribution should contain \(or point to\) the
licenses of all bundled non\-ALv2 dependencies.
Proposed fix:
\* Append the BSD\-3 text for LIBSVM and the MIT text for SLF4J to the binary
{{LICENSE}} \(opennlp\-distr\).
\* Remove the stale CDDL/jersey section, after double\-checking that no CDDL
artifact is bundled.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
