Hi Justin, Thanks, the line ranges made verification easy.
JsonArrowSchemaConverter: you're right, and I was wrong to wave it off earlier. It's adapted from lance-namespace's util class of the same name (com.lancedb:lance-namespace-core). Confirmed via your SCANOSS regions plus a local SCANOSS run of my own. Added to LICENSE with a provenance note in the file. GravitinoGlueCredentialsProvider: the match is to Doris's provider, not AWS's sample, so I've left it as-is per your note - happy to credit it if you prefer. On process: I ran SCANOSS over everything added or changed since the last release (~1500 files) (A whole-tree run got rate-limited before finishing). Apart from JsonArrowSchemaConverter, the only hits were ASF-header collisions, empty files, and forced interface skeletons - nothing else adapted. Fixes are in PR #11747 <https://github.com/apache/gravitino/pull/11747>. Kind regards, Minghuang Li On 2026/06/20 06:17:45 Justin Mclean wrote: > Hi, > > Thanks for the quick turnaround and the PR. The Bouncy Castle, Iceberg > (agreed, CatalogHandlers is the right origin rather than Polaris), Paimon, > and PageUtil fixes all look right. > > On the other two: > > JsonArrowSchemaConverter. The match is not to the org.lance.namespace.model > POJOs, it is to a converter of the same name and package in lance-namespace. > The pointer is: > • component pkg:maven/com.lancedb/lance-namespace-core (0.0.21 or later) > • file com/lancedb/lance/namespace/util/JsonArrowSchemaConverter.java > • matching regions: local lines 25-54, 79-134, 151-165 against upstream > 22-51, 264-319, 253-267 > > Please diff your class against that file, in particular the Arrow type to > type name mapping, and confirm whether it was adapted, or perhaps someone who > checked in that code can confirm that? Alternatively, perhaps AI has copied > code from other projects here, and if AI is used, the project needs to take > steps to prevent this. > > Re GravitinoGlueCredentialsProvider, as I said, this is largely the standard > AwsCredentialsProvider shape, so that’s fine, unless it was derived from > AWS's sample provider, in which case AWS should be credited. > > On process: I ran the files through SCANOSS, which is what surfaced these, > but my check was not exhaustive, so it would be worth running it over the > whole tree before the next RC. > > More importantly, checking license compliance is a responsibility of the PMC > as a whole, and identifying and attributing third-party or adapted code rests > with the committer who adds it. A clean pass before the next RC saves > everyone teh need to create extra RCs. > > Kind regards, > Justin > >
