pjfanning opened a new issue, #8801: URL: https://github.com/apache/texera/issues/8801
### What happened? The source release bundles `frontend/.yarn/releases/yarn-4.14.1.cjs`. This is the Yarn Berry release, a ~3 MB minified single-file bundle, and `frontend/.yarnrc.yml` points to it through `yarnPath`. Yarn is **BSD-2-Clause, Copyright (c) 2016-present, Yarn Contributors** (https://github.com/yarnpkg/berry/blob/master/LICENSE.md). The file: - has no licence header, and `.licenserc.yaml` excludes it from the header check with `frontend/.yarn/**`; - is not listed in the root `LICENSE`. ASF policy requires `LICENSE` to point to every bundled third-party work and its licence. BSD-2-Clause is Category A, so the file may be bundled, but it still needs a `LICENSE` entry. There is also a second concern. The file is minified, generated JavaScript rather than source. ASF source releases are meant to contain source, not compiled or generated artefacts. Many ASF projects with Yarn Berry therefore exclude `.yarn/releases/` from the source release and have users run `corepack enable`. `frontend/package.json` already declares `"packageManager": "[email protected]"`, so corepack would fetch the same version. Seen while verifying 1.2.1-incubating-RC1. The file was added in #4470 and is also on `release/v1.3` and `main`, so it affects 1.2.0-incubating and the upcoming 1.3.0-incubating RC too. **Suggested fix:** do one of the following. 1. **Keep it:** add a BSD-2-Clause entry for `frontend/.yarn/releases/yarn-4.14.1.cjs` to the root `LICENSE`, referencing `licenses/LICENSE-BSD-2-Clause.txt` (already present) or a `licenses-3rd-party-code/yarn.txt` with Yarn's copyright line. 2. **Drop it from the source release:** add `frontend/.yarn/releases export-ignore` to `.gitattributes`, so `git archive` (used by `create-release-candidate.yml`) leaves it out. Then document `corepack enable` in the build instructions. Check that the release-mode build in `build.yml` still works without `yarnPath`, or have CI enable corepack first. ### How to reproduce? ```bash B=https://dist.apache.org/repos/dist/dev/incubator/texera/1.2.1-incubating-RC1 curl -sO $B/apache-texera-1.2.1-incubating-src.tar.gz tar xzf apache-texera-1.2.1-incubating-src.tar.gz cd apache-texera-1.2.1-incubating-src ls -l frontend/.yarn/releases/ grep -niE 'yarn' LICENSE # no matches ``` ### Version/Branch 1.2.1-incubating-RC1 (also in 1.2.0-incubating, release/v1.3 and main) ### Commit Hash 3f760c837086efa569b5820dacd60f292d6d4c3a -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
