Thanks Minghuang for the RC, and thanks Justin for catching the LICENSE/NOTICE gap.
Verified on RC5: - GPG signatures + SHA-512 checksums (source + binary): good - Built the Java modules and web bundles from the source tarball (JDK 17) - Exercised OAuth group-based authorization end-to-end on the 1.3.0 binary (authorization enabled, Iceberg REST): JWT groups-claim extraction, ALLOW/DENY enforcement, DENY-override, dynamic grant/revoke, and multi-group union all behaved as expected. Given the binding -1, I can re-verify same on the next RC. (Non-binding) On Tue, Jun 23, 2026 at 1:06 AM Minghuang Li <[email protected]> wrote: > Thanks Justin, fair point — I over-applied it. The PR is trimmed back to > the actual gap: the jcasbin chain in the iceberg-rest-server LICENSE and > the Commons CSV NOTICE, plus three Apache-2.0 deps whose NOTICE carries a > non-ASF copyright (Micrometer, Guice, Jackson). Everything else is reverted. > > When you have a moment, would you mind reviewing directly on the PR? > https://github.com/apache/gravitino/pull/11769 > > On 2026/06/23 07:21:58 Justin Mclean wrote: > > Hi, > > > > > Thanks Justin. Fixed in https://github.com/apache/gravitino/pull/11769 > : > > > > > > * iceberg-rest-server LICENSE: added Aviator, IPAddress, JCasbin, OGNL > and Apache Commons CSV — the jars the jcasbin 1.99.0 bump brought in. > > > > > > * Added the Apache Commons CSV NOTICE to the main and > iceberg-rest-server binaries. > > > While there, I audited every bundled jar in all binary distributions > (main, iceberg-rest-server, lance-rest-server and trino-connector) against > their NOTICE and reproduced the ones that were missing — several > pre-existing (Commons Text, ORC, Paimon, Apache Kerby, Micrometer, Guice, > Jackson, Jetty, Eclipse Jersey/GlassFish, Jakarta APIs). The binary NOTICE > files should now match what's actually shipped.\ > > > > That would not be correct, as a lot of those are not Apache licensed, > but because something has a NOTICE file don’t mean it needs to be included, > it is only if Apache 2.0 licensed and has a NOTICE files, but even then > sometime it doesn;t need to be included e.g the NOTICE file for Apache > Ranger and there a couepl of other cases as well as they don;t add any > information that isn’t already there. > > > > Kind Regards, > > Justin >
