vinishjail97 opened a new pull request, #885: URL: https://github.com/apache/incubator-xtable/pull/885
## What Every bundled non-Apache-2.0 dependency now ships its license text, and a check enforces that against the **built jar** rather than the poms. Closes #700. Also closes #865, since the check fails in both directions. ## Why the jar `LICENSE-bundled` opens with *"See licenses/ for text of these licenses"*, and today that is not true. The published artifact is the only thing that settles what is actually bundled — a shade `<includes>` list can name dependencies that no longer resolve, and a module with `<filters>` ships a subset of what the dependency tree describes. It is also what a release reviewer inspects, which is how #700 was found in the first place. Before this change, measured on jars built from `main`: - `xtable-aws` carried texts for **3 of 5** bundled non-Apache-2.0 dependencies - `xtable-hive-metastore` for **3 of 22** - `xtable-hudi-support-extensions` for 3 of 3, plus two texts for dependencies it does not bundle ## The check `release/scripts/validate_bundled_license_texts.py` (152 lines) reads each `*-bundled.jar`, takes the coordinate listing from its `META-INF/LICENSE`, confirms each non-Apache-2.0 coordinate's classes are genuinely present by matching against that artifact's own jar, and requires `META-INF/licenses/LICENSE-<artifactId>`. A text with no bundled dependency behind it fails too. An empty run — no jars found — is a failure rather than a pass. Wired into `mvn-license-check.yml` as two steps: build the shaded modules, then run the check. ``` OK xtable-aws-0.5.0-SNAPSHOT-bundled.jar: 5 bundled non-Apache-2.0 dependencies, all with license texts. OK xtable-hive-metastore-0.5.0-SNAPSHOT-bundled.jar: 22 bundled non-Apache-2.0 dependencies, all with license texts. OK xtable-hudi-support-extensions_2.12-0.5.0-SNAPSHOT-bundled.jar: 3 bundled non-Apache-2.0 dependencies, all with license texts. ``` ## Changes - **21 license texts added.** All taken from #857, where @rangareddy had already curated and verified them — that curation is the part of #857 that has to happen regardless of which mechanism produces the metadata, and it is reused here rather than redone. - **Texts renamed to `LICENSE-<artifactId>`** so the mapping is mechanical rather than by eye: `LICENSE-jruby-jcodings` to `LICENSE-jcodings`, `LICENSE-leveldbjni` to `LICENSE-leveldbjni-all`, `LICENSE-javax-annotation-api` to `LICENSE-javax.annotation-api`, and the single `LICENSE-jersey-core` split into `LICENSE-jersey-client`, `LICENSE-jersey-json` and `LICENSE-jersey-guice`. - **Texts removed for dependencies that are not bundled** — `antlr4-runtime` and `slf4j-api` across modules, `glassfish-java-servlet-jsp`, `glasshfish-javax-servlet`. - **Shade filter** on `xtable-hive-metastore` for `META-INF/license/**` and `META-INF/licenses/*.txt`. Five third-party files (`antlr2-license.txt`, `asm-license.txt`, `jline2-license.txt`, `jsr223-license.txt`, `normalize-stylesheet-license.txt`) were landing alongside the curated set. Ours carry no file extension, so they are unaffected. ## One licensing correction worth review `junit` was listed as **4.11 under Common Public License 1.0**. The runtime tree resolves **4.12**, which is **EPL 1.0**. The bundled artifact was therefore declared under the wrong license. Corrected in `LICENSE-bundled`, and the text is the EPL 1.0 one from #857. Two things I would like a second opinion on: 1. **`xml-apis:1.3.04`** — its POM declares no license and its jar's `license/LICENSE` is the Apache text, but the same jar also ships the W3C DOM and SAX licenses for the interfaces it redistributes. `LICENSE-bundled` currently files it under `Apache Software License 1.1`. I have kept a text for it rather than treating it as Apache-2.0-and-therefore-covered, which seemed the conservative reading, but the family heading may still be wrong. 2. **`junit` and `hamcrest-core` are bundled at all.** They arrive transitively at compile scope. Shipping test libraries in a production bundle is arguably the real defect, and excluding them would be better than licensing them. ## Scope The coordinate listings are otherwise untouched, so this does not depend on #880. Nothing in `generate_shaded_license_metadata.py` or `validate_shaded_license_coverage.sh` is modified. ## Testing - `./mvnw apache-rat:check -B` — pass - `python3 -m py_compile` on the new script — pass - Built `xtable-aws`, `xtable-hive-metastore`, `xtable-hudi-support-extensions` and ran the check — exit 0, output above - Verified the check fails as expected before the texts were added, and that removing any single text reintroduces a failure -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
