czy006 opened a new pull request, #4456: URL: https://github.com/apache/amoro/pull/4456
## Why are the changes needed? The 0.9.x convenience binaries still omit license attribution for components embedded in dependencies, and several listed dependencies have no usable pointer to their full license text. In addition, jsr305 3.0.0 bundles CC BY source files and the inherited test-JAR execution creates empty artifacts without LICENSE/NOTICE. This PR targets **0.9.x**. It is a follow-up to #4381 and #4388 and includes the PostgreSQL/ongres attribution covered by #4449. ## Brief change log - Identify embedded ongres, fast_float, bigint, ASM, Flink Web UI, Spark/Hadoop Web UI resources and Public Suffix List data. Supply the applicable notices/texts and explicit in-distribution locations. - Add missing JSP/StAX, Microsoft JDBC, Reactive Streams and XZ attribution; provide license texts/pointers for the remaining listed Java dependencies. Correct swagger-ui-dist, JetBrains annotations and XNIO classification against the bundled versions. - Pin jsr305 to **3.0.2**, which contains compiled annotations without the Java source files. Include CC BY 2.5 attribution and a prominent `README-LICENSES` in both binary assemblies. - Add the same prominent labeling and source availability for CDDL, EPL and MPL components; repair four NOTICE paths into the shaded ZooKeeper JAR. - Set `skipIfEmpty` on the existing Maven JAR Plugin 3.0.2 test-JAR execution so empty parent/aggregator test artifacts are not produced. Most added lines are third-party license texts, not application code. ### Version-specific licensing evidence - The dependency JARs and their exact-version source artifacts are the primary evidence. New license documents retain source URLs. Spark uses **3.3.4 / 3.5.8** and Hadoop uses **2.10.2 / 3.4.3**. - Bootstrap **4.4.1** has MIT headers and an upstream MIT license even though Spark's summary still lists its Bootstrap files under Apache-2.0. Hadoop 2 DataTables **1.9.4** uses BSD-3-Clause; Hadoop 3 DataTables **1.11.5** uses MIT. - JSP's five legacy Sun schema/DTD resources have corresponding CDDL/GPL grants in the pinned GlassFish source files linked in `LICENSE.jsp-resources`. Their schema/DTD definitions match the bundled files; differences are licensing comments, formatting, version annotations and an unused namespace. This PR selects CDDL for those resources and preserves the dependency JAR bytes and original headers. - Public Suffix List snapshots remain in their original source form inside the dependency JARs, with MPL-2.0 text, explicit locations and source availability. Policy and build references: [ASF license-file guidance](https://www.apache.org/legal/release-policy.html#license-file), [ASF third-party license conditions](https://www.apache.org/legal/resolved.html), [Maven JAR Plugin 3.0.2 skipIfEmpty](https://maven.apache.org/plugins-archives/maven-jar-plugin-3.0.2/test-jar-mojo.html#skipIfEmpty). ## How was this patch tested? - `dev/reformat` and `./mvnw validate` passed with Temurin JDK 11. - `./mvnw validate org.apache.rat:apache-rat-plugin:0.15:check` passed on a clean source checkout before generating release files. - Both Hadoop profiles built successfully using `tools/releasing/create_binary_release.sh` with `RELEASE_VERSION=0.9.0-incubating` and `SKIP_GPG=true`. The script compiles tests but skips their execution. - jsr305 3.0.0 versus 3.0.2: the same 35 classes and identical public API descriptors; bundled Java sources decrease from 31 to 0. - Package checks verify all top-level license documents against the checkout, in-JAR legal pointers, unchanged JSP/PSL resource bytes, and the removal of 5 empty test JARs while retaining 15 useful test JARs with LICENSE/NOTICE. - **In progress:** final rebuilt-archive checks and a fresh complete ScanCode scan of both local binary archives. This PR remains a draft until that verification is finished. These checks concern local PR artifacts. They do not constitute approval of a new RC, a source release, or a Nexus staging repository. ## Documentation No new feature. Binary `LICENSE`, `NOTICE`, `README-LICENSES` and the bundled license texts document the changes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
