adityamparikh commented on PR #138: URL: https://github.com/apache/solr-mcp/pull/138#issuecomment-4633177951
If we merge https://github.com/apache/solr-mcp/pull/142/files we get SBOM with all of the supply chain details. Let me know if that works? On Fri, Jun 5, 2026 at 5:54 AM Jan Høydahl ***@***.***> wrote: > ***@***.**** commented on this pull request. > ------------------------------ > > In NOTICE > <https://github.com/apache/solr-mcp/pull/138#discussion_r3361858982>: > > > @@ -0,0 +1,5 @@ > +Apache Solr MCP Server > +Copyright 2026 The Apache Software Foundation > + > +This product includes software developed at > > Answering my own question. As per > https://infra.apache.org/licensing-howto.html the current LICENSE and > NOTICE files are correct for the source-release artifact. > > But the LICENSE file for the binary release (fat-jar or tgz) must > reference all non-apache licenses used by all dependencies. Not a full > license-text copy but a link to the full license. > > And the NOTICE file embedded in binary release must lift relevant NOTICE > snippets from the Apache-licensed dependencies, notably other ASF project > dependencies. > > Thus we need some tooling to assemble LICENSE/NOTICE for the binary > distro. A common way of doing it is to check in a licenses/ folder with > necessary files, and wire some check task into the build to verify that > newly added deps are mentioned. Solr does a rigid version of this with > separate files in licenses/ for every dependency, even test-deps. That > should not be necessary. And the Solr main dist does not currenty use > different LICENSE/NOTICE files for src and binary distros, this is a bug > and has an open JIRA. The Solr repo also mistakenly adds too much stuff in > NOTICE, stuff which shuold have beed appended to LICENSE intead. Well > well... > > — > Reply to this email directly, view it on GitHub > <https://github.com/apache/solr-mcp/pull/138?email_source=notifications&email_token=ADTWIUNAQ5MOVILA6HGYJNT46KKGNA5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTINBTGUZTEMZZHAY2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#discussion_r3361858982>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/ADTWIUM4ECFRL2TVZHTWQY346KKGNAVCNFSM6AAAAACZ3GJKCKVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHM2DIMZVGMZDGOJYGE> > . > You are receiving this because you authored the thread.Message ID: > ***@***.***> > -- Thanks, Aditya -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
