Sure. We will continue this discussion on HADOOP-12893. It now appears that binary tarballs may need their own license and notice files-- see the jira for details.
Best, C. On Thu, Apr 7, 2016, at 09:28, Vinod Kumar Vavilapalli wrote: > Colin / Sean, appreciate moving your feedback (and copy-pasting your > current comments) on this issue to the JIRA: HADOOP-12893 > > Thanks > +Vinod > > > On Apr 7, 2016, at 7:43 AM, Sean Busbey <bus...@cloudera.com> wrote: > > > > On Wed, Apr 6, 2016 at 6:26 PM, Colin McCabe <cmcc...@apache.org > > <mailto:cmcc...@apache.org>> wrote: > >> In general, the only bundled native component I can see is lz4. I guess > >> debatably we should add tree.h to the NOTICE file as well, since it came > >> from BSD and is licensed under that license. > >> > >> Please keep in mind bundling means "included in the source tree", NOT > >> "downloaded during the build process." "mvn package" dumps a ton of > >> jars in the build directory, but these dependencies aren't considered > >> bundled since their source does not appear in our git repo. Similarly, > >> linking against a library doesn't make it "bundled", nor does dlopening > >> symbols in that library. > >> > >> The big omission is that we have a lot of Javascript source files in our > >> source tree that do not appear in LICENSE or NOTICE. I agree that we > >> should address those before making a new release. > >> > >> best, > >> > >> > > > > Each artifact that the PMC publishes must abide by the ASF licensing > > policy. That includes > > > > * Source release artifact > > * any convenience binary artifacts places on dist.apache > > * any convenience jars put into the ASF Nexus repository > > > > That likely means that we bundle much more than just what's in the source > > tree. > > > > (Though this sounds like we're getting off topic for the 2.7.3 release > > plan.) > > > > -- > > busbey >
