Thanks all for the test and vote. The issues have been resolved via PR #11769 <https://github.com/apache/gravitino/pull/11769>, so I would like to cancel this vote. The RC6 vote has been initiated. See <https://lists.apache.org/thread/1wlg656sp4ycsw0cw7dvwzt4l3v93jfb> for more details.
Bests, Minghuang Li On 2026/06/23 22:23:19 Bharath Krishna wrote: > Thanks Minghuang for the RC, and thanks Justin for catching the > LICENSE/NOTICE gap. > > Verified on RC5: > - GPG signatures + SHA-512 checksums (source + binary): good > - Built the Java modules and web bundles from the source tarball (JDK 17) > - Exercised OAuth group-based authorization end-to-end on the 1.3.0 binary > (authorization enabled, Iceberg REST): JWT groups-claim extraction, > ALLOW/DENY > enforcement, DENY-override, dynamic grant/revoke, and multi-group union > all > behaved as expected. > > Given the binding -1, I can re-verify same on the next RC. > > (Non-binding) > > On Tue, Jun 23, 2026 at 1:06 AM Minghuang Li <[email protected]> wrote: > > > Thanks Justin, fair point — I over-applied it. The PR is trimmed back to > > the actual gap: the jcasbin chain in the iceberg-rest-server LICENSE and > > the Commons CSV NOTICE, plus three Apache-2.0 deps whose NOTICE carries a > > non-ASF copyright (Micrometer, Guice, Jackson). Everything else is reverted. > > > > When you have a moment, would you mind reviewing directly on the PR? > > https://github.com/apache/gravitino/pull/11769 > > > > On 2026/06/23 07:21:58 Justin Mclean wrote: > > > Hi, > > > > > > > Thanks Justin. Fixed in https://github.com/apache/gravitino/pull/11769 > > : > > > > > > > > * iceberg-rest-server LICENSE: added Aviator, IPAddress, JCasbin, OGNL > > and Apache Commons CSV — the jars the jcasbin 1.99.0 bump brought in. > > > > > > > > * Added the Apache Commons CSV NOTICE to the main and > > iceberg-rest-server binaries. > > > > While there, I audited every bundled jar in all binary distributions > > (main, iceberg-rest-server, lance-rest-server and trino-connector) against > > their NOTICE and reproduced the ones that were missing — several > > pre-existing (Commons Text, ORC, Paimon, Apache Kerby, Micrometer, Guice, > > Jackson, Jetty, Eclipse Jersey/GlassFish, Jakarta APIs). The binary NOTICE > > files should now match what's actually shipped.\ > > > > > > That would not be correct, as a lot of those are not Apache licensed, > > but because something has a NOTICE file don’t mean it needs to be included, > > it is only if Apache 2.0 licensed and has a NOTICE files, but even then > > sometime it doesn;t need to be included e.g the NOTICE file for Apache > > Ranger and there a couepl of other cases as well as they don;t add any > > information that isn’t already there. > > > > > > Kind Regards, > > > Justin > > >
