Hi Justin, Thank you for your thorough review. We appreciate the detailed feedback and have investigated each point carefully:
Bouncy Castle: you're right, it's the MIT-style license but LICENSE lists it under AL2.0. Already being fixed in #11744 <https://github.com/apache/gravitino/pull/11744>. FederatedCatalogWrapper: it's derived code, but from Iceberg's CatalogHandlers, not Polaris (Polaris copied it from Iceberg as well). Added it to the Apache Iceberg section in LICENSE and left a note in the file. PaimonViewTestCatalogHelper: agreed, the view-change handling follows Paimon's. Added to the Apache Paimon section. PageUtil: agreed, it's adapted from lance-namespace's hive2/hive3 PageUtil. Added a new Lance Namespace entry to LICENSE. The other two I'm not convinced about: JsonArrowSchemaConverter: I couldn't find a matching source anywhere in lance-namespace. The org.lance.namespace.model classes it uses are the generated client POJOs we already depend on; the converter itself is ours, mapping an Arrow schema to the Lance JSON-Arrow format. Happy to point to the spec, or attribute it if you can show me the original. GravitinoGlueCredentialsProvider: this is just a minimal AwsCredentialsProvider implementation. The closest Doris match is itself AWS's vendored class with different property keys. Feels too generic to need attribution, but tell me if you see it differently. I have already submitted a PR <https://github.com/apache/gravitino/pull/11747> to address the aforementioned issues. I would greatly appreciate your assistance in reviewing it. I will create a new RC with the LICENSE fixes once the PR is merged into the branch-1.3. Best regards, Minghuang Li On 2026/06/20 00:13:39 Justin Mclean wrote: > Hi, > > -1 (binding) from me. > > I checked: > - signatures and hashes are fine > - LICENSE is missing some 3rd party code (see below) and may have incorrect > headers > - all files have ASF headers where needed > - no unexpected binary files > > A spot check of files added since the last release shows that several have > incorrect ASF headers and seem to be be 3rd party code: > - FederatedCatalogWrapper.java [1] seems to contain code from Apache Polaris > - JsonArrowSchemaConverter.java [2] seems to contain code from lancedb > lance-namespace > - PaimonViewTestCatalogHelper.java[3] seems to contain code from Apache > Paimon > > These may also be an issue, but the code is fairly generic: > - PageUtil.java[4] seems to contain code from lance-namespace-hive2 > - GravitinoGlueCredentialsProvider.java[5] seems to contain code from Apache > Doris > > I did not perform an exhaustive check, so there may be other 3rd-party files > incorrectly labeled in the release. > > Also, I think the license of "Bouncy Castle” may also be incorrect. (As an > aside, I met the creator of Bouncy Castle a couple of days ago), it has an > MIT-style license. > > Kind Regards, > Justin > > 1. > iceberg/iceberg-rest-server/src/main/java/org/apache/gravitino/iceberg/service/FederatedCatalogWrapper.java > 2. > lance/lance-common/src/main/java/org/apache/gravitino/lance/common/ops/gravitino/JsonArrowSchemaConverter.java > 3. > catalogs/catalog-lakehouse-paimon/src/test/java/org/apache/gravitino/catalog/lakehouse/paimon/utils/PaimonViewTestCatalogHelper.java > 4. > lance/lance-common/src/main/java/org/apache/gravitino/lance/common/ops/gravitino/PageUtil.java > 5. > catalogs/catalog-glue/src/main/java/org/apache/gravitino/catalog/glue/GravitinoGlueCredentialsProvider.java > >
