Thanks Justin, fair point — I over-applied it. The PR is trimmed back to the actual gap: the jcasbin chain in the iceberg-rest-server LICENSE and the Commons CSV NOTICE, plus three Apache-2.0 deps whose NOTICE carries a non-ASF copyright (Micrometer, Guice, Jackson). Everything else is reverted.
When you have a moment, would you mind reviewing directly on the PR? https://github.com/apache/gravitino/pull/11769 On 2026/06/23 07:21:58 Justin Mclean wrote: > Hi, > > > Thanks Justin. Fixed in https://github.com/apache/gravitino/pull/11769: > > > > * iceberg-rest-server LICENSE: added Aviator, IPAddress, JCasbin, OGNL and > > Apache Commons CSV — the jars the jcasbin 1.99.0 bump brought in. > > > > * Added the Apache Commons CSV NOTICE to the main and iceberg-rest-server > > binaries. > > While there, I audited every bundled jar in all binary distributions (main, > > iceberg-rest-server, lance-rest-server and trino-connector) against their > > NOTICE and reproduced the ones that were missing — several pre-existing > > (Commons Text, ORC, Paimon, Apache Kerby, Micrometer, Guice, Jackson, > > Jetty, Eclipse Jersey/GlassFish, Jakarta APIs). The binary NOTICE files > > should now match what's actually shipped.\ > > That would not be correct, as a lot of those are not Apache licensed, but > because something has a NOTICE file don’t mean it needs to be included, it is > only if Apache 2.0 licensed and has a NOTICE files, but even then sometime it > doesn;t need to be included e.g the NOTICE file for Apache Ranger and there a > couepl of other cases as well as they don;t add any information that isn’t > already there. > > Kind Regards, > Justin
