slachiewicz opened a new pull request, #898: URL: https://github.com/apache/incubator-xtable/pull/898
Addresses #701, and #865 and #717 by construction. Part of #536. ## What is the purpose of the pull request ASF policy ([licensing-howto](https://infra.apache.org/licensing-howto.html)) asks for less than XTable currently maintains: - a bundled Apache-2.0 dependency needs **no** LICENSE entry when the licence applies uniformly. 715 of this reactor's 860 third-party artifacts are Apache-2.0. - NOTICE must carry nothing that is not legally required: *"each addition places a burden on downstream consumers"*. - for LICENSE, a pointer to the licence text within the distribution plus a short note is sufficient. So this generates the bundled LICENSE instead of maintaining it, and lets the Apache shade transformers own NOTICE. ## Brief change log - Deleted `generate_shaded_license_metadata.py`, `validate_shaded_license_coverage.sh`, and the six hand-maintained `LICENSE-bundled` / `NOTICE-bundled` files (248 to 1175 lines each). - LICENSE is rendered per module by `maven-remote-resources-plugin` from `release/license/bundled/META-INF/LICENSE.vm`, listing only the non-Apache-2.0 components with a pointer to their text. `supplemental-models.xml` carries the components whose POM declares nothing. - NOTICE comes from `ApacheNoticeResourceTransformer`. For `xtable-aws` it is 110 lines against the 248 maintained by hand. - Stopped shading `junit:junit` and `hamcrest-core` into `xtable-hive-metastore`. `hbase-protocol:2.0.0-alpha4` declares JUnit at compile scope, so it reached the bundle as a normal dependency; it was the module's only EPL 1.0 obligation. - Licence spellings are normalised in the template: 23 declared names collapse to 8 families. Net 424 insertions, 776 deletions. `validate_bundled_license_texts.py` from #857 is kept and unchanged. It decides what is bundled from class membership in the built jar rather than from the shade include list, which makes it immune to that list being stale. ## Relationship to the other open PRs #895 addresses the same issue by repairing the hand-maintained model — keeping the generator, `LICENSE-bundled` and `META-INF/licenses/`, and fixing the coverage script. This PR deletes that model instead. The two are alternatives, not increments, and both touch `generate_shaded_license_metadata.py` and `validate_shaded_license_coverage.sh` in incompatible ways. I am not proposing that either supersedes the other; that is for the PMC to weigh. Two things from #895 hold regardless of which direction wins, and are not duplicated here: - its `[772]` regeneration of the `xtable-hive-metastore` shade includes for Hive 3.1.3. This PR assumes that lands and rebases onto it. - its finding that `validate_shaded_license_coverage.sh` has been a no-op since June, because it discovered modules with `rg`, which is absent on `ubuntu-latest`. Deleting the script removes the bug but not the fact that release-time conclusions drawn from a green License Check since then are unsupported. #876 and #875 target the same issue on `main` and `branch-0.4`; #743 is an earlier attempt at the same generation problem. ## Verify this pull request `validate_bundled_license_texts.py` exits 0 on all three released bundles: `xtable-aws` 5 of 5, `xtable-hive-metastore` 20 of 20, `xtable-hudi-support-extensions` 3 of 3. `apache-rat:check` passes. Built on Temurin 11 from a clean target. Checked by hand on the `xtable-aws` bundle: one `META-INF/LICENSE`, one `META-INF/NOTICE`, its five licence texts under `META-INF/licenses/`, no dependency LICENSE or NOTICE left behind, and `META-INF/DISCLAIMER` still present. Licence texts are still taken from the artifacts themselves rather than generated. `license-maven-plugin`'s `download-licenses` was tried for that and rejected: of 24 files it fetched, 18 were HTML web pages — `checker-qual` resolved to the OSI WordPress page — one dependency fetched nothing at all, and the build still passed. Filed upstream as mojohaus/license-maven-plugin#723 and #724. ### Two open questions for reviewers - `javolution` is recorded as MIT per the text bundled with the artifact. Its POM says BSD, and the bundled text is MIT carrying a 2017 copyright for a 2010 artifact. Left as a question rather than settled here. - `xtable-utilities` is not covered. It is not deployed and not in the source release, and its bundle needs 33 further licence texts; #896 tracks shrinking it first. *This change was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
