pjfanning opened a new issue, #8800: URL: https://github.com/apache/texera/issues/8800
### What happened? The source release ships about 230 image assets under `frontend/src/assets/`. Some of them are clearly third-party, but `LICENSE` covers only the 3 SVGRepo SVGs. Seen while verifying 1.2.1-incubating-RC1. The same assets were in 1.2.0-incubating. **1. Icons8 icon with no attribution** `frontend/src/assets/operator_images/icons8-chat_bubble.png` is the workflow comment icon, referenced in `frontend/src/app/workspace/service/joint-ui/joint-ui.service.ts:1025`. It was added in #1417. The filename shows it comes from Icons8. Icons8's free licence requires attribution (a link to icons8.com), and without a paid licence it is not clearly compatible with redistribution under Apache-2.0. `LICENSE` and `NOTICE` don't mention it. **2. Third-party logos used as operator icons** These are the official logos of other organisations. They are copyrighted artwork as well as trademarks, and nothing records where the files came from or under what terms: | File | Logo | |---|---| | `operator_images/TwitterSearch.png`, `TwitterFullArchiveSearch.png`, `TwitterFeed.png`, `TwitterConverter.png` | Twitter bird | | `operator_images/RedditSearch.png` | Reddit "Snoo" | | `operator_images/PostgreSQLSource.png` | PostgreSQL "Slonik" elephant with wordmark | | `operator_images/HuggingFace*.png` | Hugging Face logo | Each of these needs one of the following: - the source and licence recorded in `LICENSE`, if the image is under a compatible licence; - confirmation that the brand's usage terms allow redistribution in an Apache-2.0 release; - or replacement with a generic or project-made icon. **3. Everything else has no recorded provenance** The other ~200 PNGs in `operator_images/`, the tutorial GIFs/JPEG (`frontend/src/assets/Tutor_*`), `card_background.jpg`, and so on may well be project-made. Some look like they came from icon sets (for example `SklearnRandomForest.png` is a generic "shuffle" glyph). None of them record where they came from. Minor: `operator_images/MysqlSink.png` is actually a JPEG (`CREATOR: gd-jpeg`) despite the `.png` extension. That suggests it was downloaded from somewhere. **Expected:** - every bundled third-party image is listed in `LICENSE` with its source and licence (as the SVGRepo icons already are), with the licence text under `licenses/`; - images whose licence isn't compatible are replaced; - images the project made itself are confirmed as such. ### How to reproduce? ```bash B=https://dist.apache.org/repos/dist/dev/incubator/texera/1.2.1-incubating-RC1 curl -sO $B/apache-texera-1.2.1-incubating-src.tar.gz tar xzf apache-texera-1.2.1-incubating-src.tar.gz cd apache-texera-1.2.1-incubating-src ls frontend/src/assets/operator_images/ | grep -iE 'icons8|twitter|reddit|postgres|huggingface' grep -niE 'icons8|twitter|reddit|postgres|hugging' LICENSE # no matches file frontend/src/assets/operator_images/MysqlSink.png ``` ### Version/Branch 1.2.1-incubating-RC1 (also present in 1.2.0-incubating) ### Commit Hash 3f760c837086efa569b5820dacd60f292d6d4c3a -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
