Thanks Justin. Fixed in https://github.com/apache/gravitino/pull/11769:
* iceberg-rest-server LICENSE: added Aviator, IPAddress, JCasbin, OGNL and Apache Commons CSV — the jars the jcasbin 1.99.0 bump brought in. * Added the Apache Commons CSV NOTICE to the main and iceberg-rest-server binaries. While there, I audited every bundled jar in all binary distributions (main, iceberg-rest-server, lance-rest-server and trino-connector) against their NOTICE and reproduced the ones that were missing — several pre-existing (Commons Text, ORC, Paimon, Apache Kerby, Micrometer, Guice, Jackson, Jetty, Eclipse Jersey/GlassFish, Jakarta APIs). The binary NOTICE files should now match what's actually shipped. I won't cut the next RC until you've had a chance to review the PR. On 2026/06/23 02:06:36 Justin Mclean wrote: > Hi, > > Sorry, but again it -1 (binding) from me. > > First, thanks for the RC5 work. I confirmed the two main issues from the > earlier RCs are resolved: the LGPL Aviator is gone (jCasbin 1.99.0 now pulls > the relicensed Apache-2.0 Aviator 5.9.0), and Bouncy Castle has been removed > in favour of JDK SHA3-512, which clears the export-control concern. > > Signatures and checksums all verify. > > The -1 is due to the dependency change not being fully accounted for in the > LICENSE and NOTICE files. > > The jCasbin upgrade (1.81.0 to 1.99.0) changed the bundled jars, adding > Aviator and the rest of the jCasbin chain (OGNL, IPAddress, Commons CSV). > Those were added to the main binary LICENSE but not to the > iceberg-rest-server LICENSE, which also bundles the same jars. So the > iceberg-rest-server LICENSE is missing Aviator, JCasbin, OGNL, IPAddress, and > Apache Commons CSV. > > Also Apache Commons CSV has a NOTICE file and that is missing from the NOTICE > in both the main and iceberg-rest-server binaries. > > On process: it would help to leave the votes open a little longer between > when asking for things to be reviewed. Not everyone works on this full-time > or is in the same timezone, and fast turnarounds make it hard to review > properly, which is exactly how things like the LICENSE updates above get > missed. > > Kind regards, > > Justin
