slachiewicz commented on issue #701: URL: https://github.com/apache/incubator-xtable/issues/701#issuecomment-5369958824
I went back to [licensing-howto](https://infra.apache.org/licensing-howto.html) to work out how much of this XTable actually has to carry, and the answer is less than any of the open PRs assume, mine included. Putting the reading here rather than in a PR, since it bears on #743, #875, #876 and #895 equally. Three things policy says: - **A bundled Apache-2.0 dependency needs no LICENSE entry at all** when the licence applies uniformly. Listing it is *"useful for completeness"*, not required. 715 of this reactor's 860 third-party artifacts are Apache-2.0 — under about 30 different spellings, which is its own problem. - **NOTICE must carry nothing that is not legally required.** *"It is important to keep NOTICE as brief and simple as possible, as each addition places a burden on downstream consumers."* The current `NOTICE-bundled` files run from 248 to 1175 lines. This is the one place policy actively requires a change rather than permitting one. - **For LICENSE, a pointer to the licence text within the distribution plus a short note is sufficient.** Inlining the full text is allowed but *"best reserved for short licenses"*. `META-INF/licenses/` is not mentioned by policy at all — it is a convention, so it is not something anyone needs to win an argument about. What that leaves as genuinely required is about 30 licence texts across the released bundles, and a short pointer list. Not an inventory of everything bundled. So the proposal in #898 is: generate the LICENSE from each module's own resolved dependencies, listing only the non-Apache-2.0 components; let `ApacheNoticeResourceTransformer` produce NOTICE; delete the generator, the coverage script and the six hand-maintained files. For `xtable-aws` the NOTICE comes out at 110 lines against 248 maintained by hand. Two things I would rather have settled here than in a PR: 1. **`javolution`.** Its POM says BSD; the text bundled in its jar is MIT, carrying a 2017 copyright for a 2010 artifact. #898 records it as MIT per the bundled text, which is a statement about provenance rather than a conclusion. If someone knows which is right, that is worth fixing at the source. 2. **Which direction to take.** #895 fixes the hand-maintained model; #898 removes it. They are alternatives, not increments — both touch `generate_shaded_license_metadata.py` and `validate_shaded_license_coverage.sh` in incompatible ways. I am not asking for #898 over #895; I am asking that the direction gets decided before either merges, so the loser is not rebased onto a different world. Two findings from #895 hold whichever way that goes: the `[772]` regeneration of the hive-metastore shade includes, and that `validate_shaded_license_coverage.sh` has been a no-op since June because it discovers modules with `rg`, which is absent on `ubuntu-latest`. Separately, `xtable-utilities` is still excluded from the release, per the 2024 [DISCUSS] thread. Its bundle needs 33 further licence texts and I have deliberately left it out of scope; #896 tracks shrinking it first, which would make the licence question much smaller. *This comment was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
