[
https://issues.apache.org/jira/browse/OPENNLP-1939?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Richard Zowalla updated OPENNLP-1939:
-------------------------------------
Fix Version/s: 2.5.13
> Binary distribution LICENSE lacks libsvm (BSD-3) and SLF4J (MIT) license texts
> ------------------------------------------------------------------------------
>
> Key: OPENNLP-1939
> URL: https://issues.apache.org/jira/browse/OPENNLP-1939
> Project: OpenNLP
> Issue Type: Bug
> Components: Build, Packaging and Test
> Reporter: Richard Zowalla
> Priority: Major
> Fix For: 2.5.13, 3.0.0
>
>
> Found while verifying 3.0.0\-M6 RC1 \(non\-blocking, same state as in
> 3.0.0\-M5\).
> The binary distribution ships the following third\-party jars in {{lib/}}
> whose licenses are not reproduced in the binary {{LICENSE}}:*
> {{libsvm\-3.35.jar}} \- BSD 3\-Clause. {{NOTICE}} only mentions it with a
> copyright line \({{Copyright \(c\) 2000\-2023 Chih\-Chung Chang and Chih\-Jen
> Lin}}\); the full BSD\-3 text is missing. The jar itself carries no license
> file.
> * {{slf4j\-api\-2.0.19.jar}} \- MIT. Only listed in the dependency list of
> {{NOTICE}}; the MIT text is missing from {{LICENSE}}.
> In addition, {{LICENSE}} contains a CDDL 1.1 section "applies to jersey and
> some of its dependencies", but no jersey \(or other CDDL\) artifact is part
> of the binary distribution anymore, so this section appears stale.
> Per
> [https://infra.apache.org/licensing\-howto.html|https://infra.apache.org/licensing-howto.html]
> the {{LICENSE}} of a binary distribution should contain \(or point to\) the
> licenses of all bundled non\-ALv2 dependencies.
> Proposed fix:
> \* Append the BSD\-3 text for LIBSVM and the MIT text for SLF4J to the binary
> {{LICENSE}} \(opennlp\-distr\).
> \* Remove the stale CDDL/jersey section, after double\-checking that no CDDL
> artifact is bundled.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
