Re: [REMINDER] Please add entries for newly added dependencies to NOTICE file

[Robert Metzger]

The bot now warns if a pull request has been linked to an unassigned Jira
ticket. (It also puts a warning if no docs, no zh-docs have been touched,
or if a pom.xml file has been touched)

On Mon, Apr 15, 2019 at 3:11 PM Robert Metzger  wrote:

> I will add such a feature to the bot!
>
> On Mon, Mar 25, 2019 at 7:41 PM Stephan Ewen  wrote:
>
>> +1 to an enhancement to the Flink bot as a simple first step.
>>
>> The first step could be as simple as adding a red warning message as a
>> comment to the PR whenever a PR touches a POM file.
>> That needs special attention for various reasons, including (but not
>> only) license checks and file updates.
>>
>> On Mon, Mar 25, 2019 at 2:12 AM jincheng sun 
>> wrote:
>>
>>> Hi Aljoscha,
>>> Thanks for bringing this up. The release-1.8 we have been prepared 4
>>> times
>>> RC, and in addition to one performance issue, all of the rest are NOTICE
>>> issues. We really need to pay attention on this.
>>>
>>> I agree with Ufuk, improve the `flink-bot` is a good idea. And the
>>> committer who merge the changes also needs to pay more attention to check
>>> if the change involves NOTICE changes.
>>>
>>> Thanks,
>>> Jincheng
>>>
>>> Bowen Li  于2019年3月24日周日 下午2:04写道：
>>>
>>> > Hi,
>>> >
>>> > I agree with Ufuk that we can start with something simple, achievable,
>>> yet
>>> > effective, like using flink-bot. The wiki that explains licensing of
>>> Flink
>>> > is very good but hard to be found and noticed by new contributors, do
>>> we
>>> > have plan to move it to a more discoverable place like
>>> flink.apache.org?
>>> > Well, even with that, it may not be so directly effective as flinkt-bot
>>> > IMO. We will of course also continue evaluating more automated ways to
>>> > solve this problem.
>>> >
>>> > Besides, there's another proposal from Jark [1] to use flink-bot to
>>> help
>>> > community keep docs in English and Chinese in sync. Looks like we have
>>> > general desires for flink-bot to remind contributors of different
>>> > requirements according to modules they modify, and we may want to
>>> develop
>>> > and adapt flink-bot to fulfill that need. I personally believe
>>> flink-bot
>>> > has proven to be handy, productive and user-friendly since it's
>>> created,
>>> > and we may increase investment on flink-bot for helping devs with
>>> > miscellaneous issues like LICENSING and NOTICE.
>>> >
>>> > [1]
>>> >
>>> >
>>> http://apache-flink-mailing-list-archive.1008284.n3.nabble.com/DISCUSS-Improve-the-flinkbot-tp26965p27863.html
>>> >
>>> > On Tue, Mar 19, 2019 at 10:50 AM Ufuk Celebi  wrote:
>>> >
>>> > > There are definitely license checking tools around that can generate
>>> > > NOTICE files etc. I don't have the details, but Robert should have
>>> > > some input here. I don't know whether they would fit our setup and
>>> how
>>> > > we would integrate them or whether INFRA can get them for is.
>>> > >
>>> > > Note that simple things can already improve the experience going
>>> > > forward. A simple thing for the flink-bot could be to require/propose
>>> > > a NOTICE file check whenever a pom.xml file was modified. What do you
>>> > > think?
>>> > >
>>> > > – Ufuk
>>> > >
>>> > > On Tue, Mar 19, 2019 at 6:43 PM Chesnay Schepler >> >
>>> > > wrote:
>>> > > >
>>> > > > Realistically you can't automatically infer from changes to any pom
>>> > > whether and what we have to change in the notice files.
>>> > > > Doing this on the XML level requires a view over the entire
>>> project to
>>> > > detect dependency changes in parent modules / dependency management
>>> and
>>> > > packaging changes in downstream modules (like flink-dist); this
>>> would be
>>> > > ridiculously complex check.
>>> > > >
>>> > > > Whether you have to change something can be inferred from the
>>> > > shade-plugin output, but not 100% reliably (for example, if a
>>> dependency
>>> > is
>>> > > declared to be included but everything is filtered out (yeah, that
>>> > > happened)).
>>> > > > Theoretically it is even possible to generate the licensing files
>>> from
>>> > > said output, but haven't had time yet to look into whether this is
>>> truly
>>> > > possible.
>>> > > >
>>> > > > On 19.03.2019 07:15, Ufuk Celebi wrote:
>>> > > >
>>> > > > Hey Aljoscha,
>>> > > >
>>> > > > thanks for bringing this up. I think that we should either
>>> integrate
>>> > > > checks for this into our CI/CD environment (using existing tools)
>>> or
>>> > > > add a conditional check for this into flink-bot in case a pom.xml
>>> was
>>> > > > modified. Otherwise it will be easy to forget in the future.
>>> > > >
>>> > > > – Ufuk
>>> > > >
>>> > > > On Mon, Mar 18, 2019 at 12:03 PM Aljoscha Krettek <
>>> aljos...@apache.org
>>> > >
>>> > > wrote:
>>> > > >
>>> > > > Hi All,
>>> > > >
>>> > > > Please remember to add newly added dependencies to the NOTICE file
>>> of
>>> > > flink-dist (which will then end up in NOTICE-binary and so on).
>>> > Discovering
>>> > > this late will cause delays in releases, as it is doing now.

Re: [REMINDER] Please add entries for newly added dependencies to NOTICE file

[Robert Metzger]

I will add such a feature to the bot!

On Mon, Mar 25, 2019 at 7:41 PM Stephan Ewen  wrote:

> +1 to an enhancement to the Flink bot as a simple first step.
>
> The first step could be as simple as adding a red warning message as a
> comment to the PR whenever a PR touches a POM file.
> That needs special attention for various reasons, including (but not only)
> license checks and file updates.
>
> On Mon, Mar 25, 2019 at 2:12 AM jincheng sun 
> wrote:
>
>> Hi Aljoscha,
>> Thanks for bringing this up. The release-1.8 we have been prepared 4 times
>> RC, and in addition to one performance issue, all of the rest are NOTICE
>> issues. We really need to pay attention on this.
>>
>> I agree with Ufuk, improve the `flink-bot` is a good idea. And the
>> committer who merge the changes also needs to pay more attention to check
>> if the change involves NOTICE changes.
>>
>> Thanks,
>> Jincheng
>>
>> Bowen Li  于2019年3月24日周日 下午2:04写道：
>>
>> > Hi,
>> >
>> > I agree with Ufuk that we can start with something simple, achievable,
>> yet
>> > effective, like using flink-bot. The wiki that explains licensing of
>> Flink
>> > is very good but hard to be found and noticed by new contributors, do we
>> > have plan to move it to a more discoverable place like flink.apache.org
>> ?
>> > Well, even with that, it may not be so directly effective as flinkt-bot
>> > IMO. We will of course also continue evaluating more automated ways to
>> > solve this problem.
>> >
>> > Besides, there's another proposal from Jark [1] to use flink-bot to help
>> > community keep docs in English and Chinese in sync. Looks like we have
>> > general desires for flink-bot to remind contributors of different
>> > requirements according to modules they modify, and we may want to
>> develop
>> > and adapt flink-bot to fulfill that need. I personally believe flink-bot
>> > has proven to be handy, productive and user-friendly since it's created,
>> > and we may increase investment on flink-bot for helping devs with
>> > miscellaneous issues like LICENSING and NOTICE.
>> >
>> > [1]
>> >
>> >
>> http://apache-flink-mailing-list-archive.1008284.n3.nabble.com/DISCUSS-Improve-the-flinkbot-tp26965p27863.html
>> >
>> > On Tue, Mar 19, 2019 at 10:50 AM Ufuk Celebi  wrote:
>> >
>> > > There are definitely license checking tools around that can generate
>> > > NOTICE files etc. I don't have the details, but Robert should have
>> > > some input here. I don't know whether they would fit our setup and how
>> > > we would integrate them or whether INFRA can get them for is.
>> > >
>> > > Note that simple things can already improve the experience going
>> > > forward. A simple thing for the flink-bot could be to require/propose
>> > > a NOTICE file check whenever a pom.xml file was modified. What do you
>> > > think?
>> > >
>> > > – Ufuk
>> > >
>> > > On Tue, Mar 19, 2019 at 6:43 PM Chesnay Schepler 
>> > > wrote:
>> > > >
>> > > > Realistically you can't automatically infer from changes to any pom
>> > > whether and what we have to change in the notice files.
>> > > > Doing this on the XML level requires a view over the entire project
>> to
>> > > detect dependency changes in parent modules / dependency management
>> and
>> > > packaging changes in downstream modules (like flink-dist); this would
>> be
>> > > ridiculously complex check.
>> > > >
>> > > > Whether you have to change something can be inferred from the
>> > > shade-plugin output, but not 100% reliably (for example, if a
>> dependency
>> > is
>> > > declared to be included but everything is filtered out (yeah, that
>> > > happened)).
>> > > > Theoretically it is even possible to generate the licensing files
>> from
>> > > said output, but haven't had time yet to look into whether this is
>> truly
>> > > possible.
>> > > >
>> > > > On 19.03.2019 07:15, Ufuk Celebi wrote:
>> > > >
>> > > > Hey Aljoscha,
>> > > >
>> > > > thanks for bringing this up. I think that we should either integrate
>> > > > checks for this into our CI/CD environment (using existing tools) or
>> > > > add a conditional check for this into flink-bot in case a pom.xml
>> was
>> > > > modified. Otherwise it will be easy to forget in the future.
>> > > >
>> > > > – Ufuk
>> > > >
>> > > > On Mon, Mar 18, 2019 at 12:03 PM Aljoscha Krettek <
>> aljos...@apache.org
>> > >
>> > > wrote:
>> > > >
>> > > > Hi All,
>> > > >
>> > > > Please remember to add newly added dependencies to the NOTICE file
>> of
>> > > flink-dist (which will then end up in NOTICE-binary and so on).
>> > Discovering
>> > > this late will cause delays in releases, as it is doing now.
>> > > >
>> > > > There is a handy guide that Chesnay and Till worked on that explains
>> > > licensing for Apache projects and Flink specifically:
>> > > https://cwiki.apache.org/confluence/display/FLINK/Licensing <
>> > > https://cwiki.apache.org/confluence/display/FLINK/Licensing>
>> > > >
>> > > > Best,
>> > > > Aljoscha
>> > > >
>> > > >
>> > >
>> >
>>
>

Re: [REMINDER] Please add entries for newly added dependencies to NOTICE file

[Stephan Ewen]

+1 to an enhancement to the Flink bot as a simple first step.

The first step could be as simple as adding a red warning message as a
comment to the PR whenever a PR touches a POM file.
That needs special attention for various reasons, including (but not only)
license checks and file updates.

On Mon, Mar 25, 2019 at 2:12 AM jincheng sun 
wrote:

> Hi Aljoscha,
> Thanks for bringing this up. The release-1.8 we have been prepared 4 times
> RC, and in addition to one performance issue, all of the rest are NOTICE
> issues. We really need to pay attention on this.
>
> I agree with Ufuk, improve the `flink-bot` is a good idea. And the
> committer who merge the changes also needs to pay more attention to check
> if the change involves NOTICE changes.
>
> Thanks,
> Jincheng
>
> Bowen Li  于2019年3月24日周日 下午2:04写道：
>
> > Hi,
> >
> > I agree with Ufuk that we can start with something simple, achievable,
> yet
> > effective, like using flink-bot. The wiki that explains licensing of
> Flink
> > is very good but hard to be found and noticed by new contributors, do we
> > have plan to move it to a more discoverable place like flink.apache.org?
> > Well, even with that, it may not be so directly effective as flinkt-bot
> > IMO. We will of course also continue evaluating more automated ways to
> > solve this problem.
> >
> > Besides, there's another proposal from Jark [1] to use flink-bot to help
> > community keep docs in English and Chinese in sync. Looks like we have
> > general desires for flink-bot to remind contributors of different
> > requirements according to modules they modify, and we may want to develop
> > and adapt flink-bot to fulfill that need. I personally believe flink-bot
> > has proven to be handy, productive and user-friendly since it's created,
> > and we may increase investment on flink-bot for helping devs with
> > miscellaneous issues like LICENSING and NOTICE.
> >
> > [1]
> >
> >
> http://apache-flink-mailing-list-archive.1008284.n3.nabble.com/DISCUSS-Improve-the-flinkbot-tp26965p27863.html
> >
> > On Tue, Mar 19, 2019 at 10:50 AM Ufuk Celebi  wrote:
> >
> > > There are definitely license checking tools around that can generate
> > > NOTICE files etc. I don't have the details, but Robert should have
> > > some input here. I don't know whether they would fit our setup and how
> > > we would integrate them or whether INFRA can get them for is.
> > >
> > > Note that simple things can already improve the experience going
> > > forward. A simple thing for the flink-bot could be to require/propose
> > > a NOTICE file check whenever a pom.xml file was modified. What do you
> > > think?
> > >
> > > – Ufuk
> > >
> > > On Tue, Mar 19, 2019 at 6:43 PM Chesnay Schepler 
> > > wrote:
> > > >
> > > > Realistically you can't automatically infer from changes to any pom
> > > whether and what we have to change in the notice files.
> > > > Doing this on the XML level requires a view over the entire project
> to
> > > detect dependency changes in parent modules / dependency management and
> > > packaging changes in downstream modules (like flink-dist); this would
> be
> > > ridiculously complex check.
> > > >
> > > > Whether you have to change something can be inferred from the
> > > shade-plugin output, but not 100% reliably (for example, if a
> dependency
> > is
> > > declared to be included but everything is filtered out (yeah, that
> > > happened)).
> > > > Theoretically it is even possible to generate the licensing files
> from
> > > said output, but haven't had time yet to look into whether this is
> truly
> > > possible.
> > > >
> > > > On 19.03.2019 07:15, Ufuk Celebi wrote:
> > > >
> > > > Hey Aljoscha,
> > > >
> > > > thanks for bringing this up. I think that we should either integrate
> > > > checks for this into our CI/CD environment (using existing tools) or
> > > > add a conditional check for this into flink-bot in case a pom.xml was
> > > > modified. Otherwise it will be easy to forget in the future.
> > > >
> > > > – Ufuk
> > > >
> > > > On Mon, Mar 18, 2019 at 12:03 PM Aljoscha Krettek <
> aljos...@apache.org
> > >
> > > wrote:
> > > >
> > > > Hi All,
> > > >
> > > > Please remember to add newly added dependencies to the NOTICE file of
> > > flink-dist (which will then end up in NOTICE-binary and so on).
> > Discovering
> > > this late will cause delays in releases, as it is doing now.
> > > >
> > > > There is a handy guide that Chesnay and Till worked on that explains
> > > licensing for Apache projects and Flink specifically:
> > > https://cwiki.apache.org/confluence/display/FLINK/Licensing <
> > > https://cwiki.apache.org/confluence/display/FLINK/Licensing>
> > > >
> > > > Best,
> > > > Aljoscha
> > > >
> > > >
> > >
> >
>

Re: [REMINDER] Please add entries for newly added dependencies to NOTICE file

[jincheng sun]

Hi Aljoscha,
Thanks for bringing this up. The release-1.8 we have been prepared 4 times
RC, and in addition to one performance issue, all of the rest are NOTICE
issues. We really need to pay attention on this.

I agree with Ufuk, improve the `flink-bot` is a good idea. And the
committer who merge the changes also needs to pay more attention to check
if the change involves NOTICE changes.

Thanks,
Jincheng

Bowen Li  于2019年3月24日周日 下午2:04写道：

> Hi,
>
> I agree with Ufuk that we can start with something simple, achievable, yet
> effective, like using flink-bot. The wiki that explains licensing of Flink
> is very good but hard to be found and noticed by new contributors, do we
> have plan to move it to a more discoverable place like flink.apache.org?
> Well, even with that, it may not be so directly effective as flinkt-bot
> IMO. We will of course also continue evaluating more automated ways to
> solve this problem.
>
> Besides, there's another proposal from Jark [1] to use flink-bot to help
> community keep docs in English and Chinese in sync. Looks like we have
> general desires for flink-bot to remind contributors of different
> requirements according to modules they modify, and we may want to develop
> and adapt flink-bot to fulfill that need. I personally believe flink-bot
> has proven to be handy, productive and user-friendly since it's created,
> and we may increase investment on flink-bot for helping devs with
> miscellaneous issues like LICENSING and NOTICE.
>
> [1]
>
> http://apache-flink-mailing-list-archive.1008284.n3.nabble.com/DISCUSS-Improve-the-flinkbot-tp26965p27863.html
>
> On Tue, Mar 19, 2019 at 10:50 AM Ufuk Celebi  wrote:
>
> > There are definitely license checking tools around that can generate
> > NOTICE files etc. I don't have the details, but Robert should have
> > some input here. I don't know whether they would fit our setup and how
> > we would integrate them or whether INFRA can get them for is.
> >
> > Note that simple things can already improve the experience going
> > forward. A simple thing for the flink-bot could be to require/propose
> > a NOTICE file check whenever a pom.xml file was modified. What do you
> > think?
> >
> > – Ufuk
> >
> > On Tue, Mar 19, 2019 at 6:43 PM Chesnay Schepler 
> > wrote:
> > >
> > > Realistically you can't automatically infer from changes to any pom
> > whether and what we have to change in the notice files.
> > > Doing this on the XML level requires a view over the entire project to
> > detect dependency changes in parent modules / dependency management and
> > packaging changes in downstream modules (like flink-dist); this would be
> > ridiculously complex check.
> > >
> > > Whether you have to change something can be inferred from the
> > shade-plugin output, but not 100% reliably (for example, if a dependency
> is
> > declared to be included but everything is filtered out (yeah, that
> > happened)).
> > > Theoretically it is even possible to generate the licensing files from
> > said output, but haven't had time yet to look into whether this is truly
> > possible.
> > >
> > > On 19.03.2019 07:15, Ufuk Celebi wrote:
> > >
> > > Hey Aljoscha,
> > >
> > > thanks for bringing this up. I think that we should either integrate
> > > checks for this into our CI/CD environment (using existing tools) or
> > > add a conditional check for this into flink-bot in case a pom.xml was
> > > modified. Otherwise it will be easy to forget in the future.
> > >
> > > – Ufuk
> > >
> > > On Mon, Mar 18, 2019 at 12:03 PM Aljoscha Krettek  >
> > wrote:
> > >
> > > Hi All,
> > >
> > > Please remember to add newly added dependencies to the NOTICE file of
> > flink-dist (which will then end up in NOTICE-binary and so on).
> Discovering
> > this late will cause delays in releases, as it is doing now.
> > >
> > > There is a handy guide that Chesnay and Till worked on that explains
> > licensing for Apache projects and Flink specifically:
> > https://cwiki.apache.org/confluence/display/FLINK/Licensing <
> > https://cwiki.apache.org/confluence/display/FLINK/Licensing>
> > >
> > > Best,
> > > Aljoscha
> > >
> > >
> >
>

Re: [REMINDER] Please add entries for newly added dependencies to NOTICE file

[jincheng sun]

Hi Aljoscha,
Thanks for bringing this up. The release-1.8 we have been prepared 4 times
RC, and in addition to one performance issue, all of the rest are NOTICE
issues. We really need to pay attention on this.

I think improve the `flink-bot

Bowen Li  于2019年3月24日周日 下午2:04写道：

> Hi,
>
> I agree with Ufuk that we can start with something simple, achievable, yet
> effective, like using flink-bot. The wiki that explains licensing of Flink
> is very good but hard to be found and noticed by new contributors, do we
> have plan to move it to a more discoverable place like flink.apache.org?
> Well, even with that, it may not be so directly effective as flinkt-bot
> IMO. We will of course also continue evaluating more automated ways to
> solve this problem.
>
> Besides, there's another proposal from Jark [1] to use flink-bot to help
> community keep docs in English and Chinese in sync. Looks like we have
> general desires for flink-bot to remind contributors of different
> requirements according to modules they modify, and we may want to develop
> and adapt flink-bot to fulfill that need. I personally believe flink-bot
> has proven to be handy, productive and user-friendly since it's created,
> and we may increase investment on flink-bot for helping devs with
> miscellaneous issues like LICENSING and NOTICE.
>
> [1]
>
> http://apache-flink-mailing-list-archive.1008284.n3.nabble.com/DISCUSS-Improve-the-flinkbot-tp26965p27863.html
>
> On Tue, Mar 19, 2019 at 10:50 AM Ufuk Celebi  wrote:
>
> > There are definitely license checking tools around that can generate
> > NOTICE files etc. I don't have the details, but Robert should have
> > some input here. I don't know whether they would fit our setup and how
> > we would integrate them or whether INFRA can get them for is.
> >
> > Note that simple things can already improve the experience going
> > forward. A simple thing for the flink-bot could be to require/propose
> > a NOTICE file check whenever a pom.xml file was modified. What do you
> > think?
> >
> > – Ufuk
> >
> > On Tue, Mar 19, 2019 at 6:43 PM Chesnay Schepler 
> > wrote:
> > >
> > > Realistically you can't automatically infer from changes to any pom
> > whether and what we have to change in the notice files.
> > > Doing this on the XML level requires a view over the entire project to
> > detect dependency changes in parent modules / dependency management and
> > packaging changes in downstream modules (like flink-dist); this would be
> > ridiculously complex check.
> > >
> > > Whether you have to change something can be inferred from the
> > shade-plugin output, but not 100% reliably (for example, if a dependency
> is
> > declared to be included but everything is filtered out (yeah, that
> > happened)).
> > > Theoretically it is even possible to generate the licensing files from
> > said output, but haven't had time yet to look into whether this is truly
> > possible.
> > >
> > > On 19.03.2019 07:15, Ufuk Celebi wrote:
> > >
> > > Hey Aljoscha,
> > >
> > > thanks for bringing this up. I think that we should either integrate
> > > checks for this into our CI/CD environment (using existing tools) or
> > > add a conditional check for this into flink-bot in case a pom.xml was
> > > modified. Otherwise it will be easy to forget in the future.
> > >
> > > – Ufuk
> > >
> > > On Mon, Mar 18, 2019 at 12:03 PM Aljoscha Krettek  >
> > wrote:
> > >
> > > Hi All,
> > >
> > > Please remember to add newly added dependencies to the NOTICE file of
> > flink-dist (which will then end up in NOTICE-binary and so on).
> Discovering
> > this late will cause delays in releases, as it is doing now.
> > >
> > > There is a handy guide that Chesnay and Till worked on that explains
> > licensing for Apache projects and Flink specifically:
> > https://cwiki.apache.org/confluence/display/FLINK/Licensing <
> > https://cwiki.apache.org/confluence/display/FLINK/Licensing>
> > >
> > > Best,
> > > Aljoscha
> > >
> > >
> >
>

Re: [REMINDER] Please add entries for newly added dependencies to NOTICE file

[Bowen Li]

Hi,

I agree with Ufuk that we can start with something simple, achievable, yet
effective, like using flink-bot. The wiki that explains licensing of Flink
is very good but hard to be found and noticed by new contributors, do we
have plan to move it to a more discoverable place like flink.apache.org?
Well, even with that, it may not be so directly effective as flinkt-bot
IMO. We will of course also continue evaluating more automated ways to
solve this problem.

Besides, there's another proposal from Jark [1] to use flink-bot to help
community keep docs in English and Chinese in sync. Looks like we have
general desires for flink-bot to remind contributors of different
requirements according to modules they modify, and we may want to develop
and adapt flink-bot to fulfill that need. I personally believe flink-bot
has proven to be handy, productive and user-friendly since it's created,
and we may increase investment on flink-bot for helping devs with
miscellaneous issues like LICENSING and NOTICE.

[1]
http://apache-flink-mailing-list-archive.1008284.n3.nabble.com/DISCUSS-Improve-the-flinkbot-tp26965p27863.html

On Tue, Mar 19, 2019 at 10:50 AM Ufuk Celebi  wrote:

> There are definitely license checking tools around that can generate
> NOTICE files etc. I don't have the details, but Robert should have
> some input here. I don't know whether they would fit our setup and how
> we would integrate them or whether INFRA can get them for is.
>
> Note that simple things can already improve the experience going
> forward. A simple thing for the flink-bot could be to require/propose
> a NOTICE file check whenever a pom.xml file was modified. What do you
> think?
>
> – Ufuk
>
> On Tue, Mar 19, 2019 at 6:43 PM Chesnay Schepler 
> wrote:
> >
> > Realistically you can't automatically infer from changes to any pom
> whether and what we have to change in the notice files.
> > Doing this on the XML level requires a view over the entire project to
> detect dependency changes in parent modules / dependency management and
> packaging changes in downstream modules (like flink-dist); this would be
> ridiculously complex check.
> >
> > Whether you have to change something can be inferred from the
> shade-plugin output, but not 100% reliably (for example, if a dependency is
> declared to be included but everything is filtered out (yeah, that
> happened)).
> > Theoretically it is even possible to generate the licensing files from
> said output, but haven't had time yet to look into whether this is truly
> possible.
> >
> > On 19.03.2019 07:15, Ufuk Celebi wrote:
> >
> > Hey Aljoscha,
> >
> > thanks for bringing this up. I think that we should either integrate
> > checks for this into our CI/CD environment (using existing tools) or
> > add a conditional check for this into flink-bot in case a pom.xml was
> > modified. Otherwise it will be easy to forget in the future.
> >
> > – Ufuk
> >
> > On Mon, Mar 18, 2019 at 12:03 PM Aljoscha Krettek 
> wrote:
> >
> > Hi All,
> >
> > Please remember to add newly added dependencies to the NOTICE file of
> flink-dist (which will then end up in NOTICE-binary and so on). Discovering
> this late will cause delays in releases, as it is doing now.
> >
> > There is a handy guide that Chesnay and Till worked on that explains
> licensing for Apache projects and Flink specifically:
> https://cwiki.apache.org/confluence/display/FLINK/Licensing <
> https://cwiki.apache.org/confluence/display/FLINK/Licensing>
> >
> > Best,
> > Aljoscha
> >
> >
>

Re: [REMINDER] Please add entries for newly added dependencies to NOTICE file

[Ufuk Celebi]

There are definitely license checking tools around that can generate
NOTICE files etc. I don't have the details, but Robert should have
some input here. I don't know whether they would fit our setup and how
we would integrate them or whether INFRA can get them for is.

Note that simple things can already improve the experience going
forward. A simple thing for the flink-bot could be to require/propose
a NOTICE file check whenever a pom.xml file was modified. What do you
think?

– Ufuk

On Tue, Mar 19, 2019 at 6:43 PM Chesnay Schepler  wrote:
>
> Realistically you can't automatically infer from changes to any pom whether 
> and what we have to change in the notice files.
> Doing this on the XML level requires a view over the entire project to detect 
> dependency changes in parent modules / dependency management and packaging 
> changes in downstream modules (like flink-dist); this would be ridiculously 
> complex check.
>
> Whether you have to change something can be inferred from the shade-plugin 
> output, but not 100% reliably (for example, if a dependency is declared to be 
> included but everything is filtered out (yeah, that happened)).
> Theoretically it is even possible to generate the licensing files from said 
> output, but haven't had time yet to look into whether this is truly possible.
>
> On 19.03.2019 07:15, Ufuk Celebi wrote:
>
> Hey Aljoscha,
>
> thanks for bringing this up. I think that we should either integrate
> checks for this into our CI/CD environment (using existing tools) or
> add a conditional check for this into flink-bot in case a pom.xml was
> modified. Otherwise it will be easy to forget in the future.
>
> – Ufuk
>
> On Mon, Mar 18, 2019 at 12:03 PM Aljoscha Krettek  wrote:
>
> Hi All,
>
> Please remember to add newly added dependencies to the NOTICE file of 
> flink-dist (which will then end up in NOTICE-binary and so on). Discovering 
> this late will cause delays in releases, as it is doing now.
>
> There is a handy guide that Chesnay and Till worked on that explains 
> licensing for Apache projects and Flink specifically: 
> https://cwiki.apache.org/confluence/display/FLINK/Licensing 
> 
>
> Best,
> Aljoscha
>
>

Re: [REMINDER] Please add entries for newly added dependencies to NOTICE file

[Chesnay Schepler]

Realistically you can't automatically infer from changes to any pom 
/whether /and /what /we have to change in the notice files.
Doing this on the XML level requires a view over the entire project to 
detect dependency changes in parent modules / dependency management and 
packaging changes in downstream modules (like flink-dist); this would be 
ridiculously complex check.


W/hether /you have to change something can be inferred from the 
shade-plugin output, but not 100% reliably (for example, if a dependency 
is declared to be included but everything is filtered out (yeah, that 
happened)).
Theoretically it is even possible to generate the licensing files from 
said output, but haven't had time yet to look into whether this is truly 
possible.


On 19.03.2019 07:15, Ufuk Celebi wrote:

Hey Aljoscha,

thanks for bringing this up. I think that we should either integrate
checks for this into our CI/CD environment (using existing tools) or
add a conditional check for this into flink-bot in case a pom.xml was
modified. Otherwise it will be easy to forget in the future.

– Ufuk

On Mon, Mar 18, 2019 at 12:03 PM Aljoscha Krettek  wrote:

Hi All,

Please remember to add newly added dependencies to the NOTICE file of 
flink-dist (which will then end up in NOTICE-binary and so on). Discovering 
this late will cause delays in releases, as it is doing now.

There is a handy guide that Chesnay and Till worked on that explains licensing for 
Apache projects and Flink specifically: 
https://cwiki.apache.org/confluence/display/FLINK/Licensing 


Best,
Aljoscha

Re: [REMINDER] Please add entries for newly added dependencies to NOTICE file

[Aljoscha Krettek]

That sounds good! Are there any tools for this, though?

> On 19. Mar 2019, at 07:15, Ufuk Celebi  wrote:
> 
> Hey Aljoscha,
> 
> thanks for bringing this up. I think that we should either integrate
> checks for this into our CI/CD environment (using existing tools) or
> add a conditional check for this into flink-bot in case a pom.xml was
> modified. Otherwise it will be easy to forget in the future.
> 
> – Ufuk
> 
> On Mon, Mar 18, 2019 at 12:03 PM Aljoscha Krettek  wrote:
>> 
>> Hi All,
>> 
>> Please remember to add newly added dependencies to the NOTICE file of 
>> flink-dist (which will then end up in NOTICE-binary and so on). Discovering 
>> this late will cause delays in releases, as it is doing now.
>> 
>> There is a handy guide that Chesnay and Till worked on that explains 
>> licensing for Apache projects and Flink specifically: 
>> https://cwiki.apache.org/confluence/display/FLINK/Licensing 
>> 
>> 
>> Best,
>> Aljoscha

Re: [REMINDER] Please add entries for newly added dependencies to NOTICE file

[Ufuk Celebi]

Hey Aljoscha,

thanks for bringing this up. I think that we should either integrate
checks for this into our CI/CD environment (using existing tools) or
add a conditional check for this into flink-bot in case a pom.xml was
modified. Otherwise it will be easy to forget in the future.

– Ufuk

On Mon, Mar 18, 2019 at 12:03 PM Aljoscha Krettek  wrote:
>
> Hi All,
>
> Please remember to add newly added dependencies to the NOTICE file of 
> flink-dist (which will then end up in NOTICE-binary and so on). Discovering 
> this late will cause delays in releases, as it is doing now.
>
> There is a handy guide that Chesnay and Till worked on that explains 
> licensing for Apache projects and Flink specifically: 
> https://cwiki.apache.org/confluence/display/FLINK/Licensing 
> 
>
> Best,
> Aljoscha

[REMINDER] Please add entries for newly added dependencies to NOTICE file

[Aljoscha Krettek]

Hi All,

Please remember to add newly added dependencies to the NOTICE file of 
flink-dist (which will then end up in NOTICE-binary and so on). Discovering 
this late will cause delays in releases, as it is doing now.

There is a handy guide that Chesnay and Till worked on that explains licensing 
for Apache projects and Flink specifically: 
https://cwiki.apache.org/confluence/display/FLINK/Licensing 


Best,
Aljoscha