On Wed, Apr 6, 2016 at 6:26 PM, Colin McCabe <cmcc...@apache.org> wrote: > In general, the only bundled native component I can see is lz4. I guess > debatably we should add tree.h to the NOTICE file as well, since it came > from BSD and is licensed under that license. > > Please keep in mind bundling means "included in the source tree", NOT > "downloaded during the build process." "mvn package" dumps a ton of > jars in the build directory, but these dependencies aren't considered > bundled since their source does not appear in our git repo. Similarly, > linking against a library doesn't make it "bundled", nor does dlopening > symbols in that library. > > The big omission is that we have a lot of Javascript source files in our > source tree that do not appear in LICENSE or NOTICE. I agree that we > should address those before making a new release. > > best, > >
Each artifact that the PMC publishes must abide by the ASF licensing policy. That includes * Source release artifact * any convenience binary artifacts places on dist.apache * any convenience jars put into the ASF Nexus repository That likely means that we bundle much more than just what's in the source tree. (Though this sounds like we're getting off topic for the 2.7.3 release plan.) -- busbey
