In general, the only bundled native component I can see is lz4. I guess debatably we should add tree.h to the NOTICE file as well, since it came from BSD and is licensed under that license.
Please keep in mind bundling means "included in the source tree", NOT "downloaded during the build process." "mvn package" dumps a ton of jars in the build directory, but these dependencies aren't considered bundled since their source does not appear in our git repo. Similarly, linking against a library doesn't make it "bundled", nor does dlopening symbols in that library. The big omission is that we have a lot of Javascript source files in our source tree that do not appear in LICENSE or NOTICE. I agree that we should address those before making a new release. best, On Wed, Apr 6, 2016, at 14:13, Allen Wittenauer wrote: > > This is probably a good time to remind/point folks to HADOOP-12893. > Apache Hadoop's binary artifacts (with or without native code) and source > artifacts are not complying with the licenses of bundled components. I > fairly confident this means releases are off the table until someone audits > the entire codebase given how many have been added without any thought to > actually following the terms of the license…. > >
