Dejan Stojadinović created KAFKA-21287:
------------------------------------------
Summary: Fix 'licenses' folder contents and 'LICENSE-binary' file
references
Key: KAFKA-21287
URL: https://issues.apache.org/jira/browse/KAFKA-21287
Project: Kafka
Issue Type: Bug
Components: build
Reporter: Dejan Stojadinović
h1. Kafka licenses/ folder audit
The {{licenses/}} folder shipped in the Kafka binary distribution has drifted
from the dependencies it covers: one referenced file is missing, one has the
wrong license text, four ship for nothing, and several copyright lines are
stale. CI only compares versions in {{{}LICENSE-binary{}}}, never the contents
of {{{}licenses/{}}}.
h2. Findings
16 files in {{licenses/}} were compared with the {{LICENSE-binary}} references
and with the license each dependency ships at its current version
({{{}gradle/dependencies.gradle{}}}).
||#||File / entry||Problem||Fix||
|1|{{jakarta.activation-2.0.1}} → {{licenses/jakarta-BSD-3-clause}}|Referenced
file does not exist. The jar's own {{META-INF/LICENSE.md}} is EDL 1.0 (BSD-3,
Copyright 2018 Oracle).|Point to {{licenses/eclipse-distribution-license-1.0}}|
|2|{{protobuf-java-BSD-3-clause}}|Wrong text: "Copyright 2023, the original
author or authors" (jline's wording). Upstream v25.5 is "Copyright 2008 Google
Inc."|Replace with upstream v25.5 {{LICENSE}}|
|3|{{mock-oauth2-server-MIT}}|Test-only dependency
({{{}testImplementation{}}}), not bundled|Delete|
|3|{{jsr305-BSD-3-clause}}|Dependency dropped from {{LICENSE-binary}} in 2025,
file left behind|Delete|
|3|{{paranamer-BSD-3-clause}}|Same as jsr305|Delete|
|3|{{eclipse-distribution-license-1.0}}|Not referenced, although it is the
right file for #1 and #4|Reference it|
|4|{{{}jakarta.activation-api-2.1.0{}}}, {{jakarta.xml.bind-api-3.0.1}}|Listed
as CDDL 1.1 + GPLv2; POM and jar say EDL 1.0|Move to an EDL 1.0 section|
|4|{{jakarta.servlet-api-6.0.0}}|Listed as CDDL 1.1 + GPLv2; POM says EPL 2.0 /
GPL2 w/ CPE|Move to the EPL 2.0 section|
|4|{{CDDL+GPL-1.1}}|Unreferenced once the three jars above move|Delete|
|5|{{classgraph-MIT}} (4.8.196)|2019 vs upstream 2026|Upstream text|
|5|{{slf4j-MIT}} (1.7.36)|2004-2017 QOS.ch vs 2004-2022 QOS.ch Sarl
(Switzerland)|Upstream text|
|5|{{jline-BSD-3-clause}} (3.30.17)|2002-2018 vs 2002-2023|Upstream text|
|5|{{jopt-simple-MIT}} (5.0.4)|2004-2016 vs 2004-2015 at the tag|Upstream text|
|5|{{argparse-MIT}} (0.7.0)|2011-2017 vs 2011, 2014, 2015 at the tag|Upstream
text|
|5|{{zstd-jni-BSD-2-clause}} (1.5.7-17)|Extra title line; "BSD License" vs
"BSD-2-Clause License" + URL|Upstream text|
|–|{{{}pcollections-MIT{}}}, {{{}hdrHistogram-BSD-2-clause{}}},
{{{}re2j-GO{}}}, {{eclipse-public-license-2.0}}|Match upstream|None|
h2. Proposed change
One {{MINOR}} PR, branch {{{}MINOR-fix-licenses-folder{}}}, touches only
{{LICENSE-binary}} and {{{}licenses/{}}}.
* {{{}LICENSE-binary{}}}: replace the "CDDL 1.1 + GPLv2" section with an
"Eclipse Distribution License - v 1.0" section
({{{}jakarta.activation-2.0.1{}}}, {{{}jakarta.activation-api-2.1.0{}}},
{{{}jakarta.xml.bind-api-3.0.1{}}}); add {{jakarta.servlet-api-6.0.0}} to the
EPL 2.0 section; drop the broken {{jakarta-BSD-3-clause}} line.
* Replaced with upstream text at the current version:
{{{}protobuf-java-BSD-3-clause{}}}, {{{}classgraph-MIT{}}}, {{{}slf4j-MIT{}}},
{{{}jline-BSD-3-clause{}}}, {{{}jopt-simple-MIT{}}}, {{{}argparse-MIT{}}},
{{{}zstd-jni-BSD-2-clause{}}}.
* Deleted: {{{}mock-oauth2-server-MIT{}}}, {{{}jsr305-BSD-3-clause{}}},
{{{}paranamer-BSD-3-clause{}}}, {{{}CDDL+GPL-1.1{}}}.
h2. Verification
A fresh {{./gradlew clean releaseTarGz}} on the fix branch confirms the change.
* The third-party jars in {{libs/}} match the entries in {{LICENSE-binary}}
exactly. Nothing is missing on either side.
* Every {{licenses/...}} path in {{LICENSE-binary}} exists, and every file in
{{licenses/}} is referenced.
* {{jakarta.servlet-api}} is bundled at 6.0.0, as {{LICENSE-binary}} says,
even though {{dependencies.gradle}} declares 6.1.0. The 6.1.0 declaration does
not reach the runtime classpath.
* The tarball's {{licenses/}} now holds 12 files, down from 16.
h2. How it drifted
Each problem traces back to one commit. The CI step
{{committer-tools/verify_license.py}} (KAFKA-17607) only matches jar names in
{{libs/}} against {{{}LICENSE-binary{}}}, so none of these failed a build.
||Date||Commit||What happened||
|2026-05-07|KAFKA-20555 (#22232)|Removed the EDL 1.0 section and moved
{{jakarta.activation-api}} and {{jakarta.xml.bind-api}} under CDDL|
|2025-06-12|KAFKA-19153 (#19938)|Added {{mock-oauth2-server-MIT}} for a
test-only dependency|
|2025-02-18/19|#18943, #18950|Removed paranamer and jsr305 from
{{{}LICENSE-binary{}}}, left their files|
|2025-01-01|KAFKA-18375 (#18359)|Added {{jakarta.activation-2.0.1}} pointing to
the non-existent {{{}licenses/jakarta-BSD-3-clause{}}}, and
{{jakarta.servlet-api-6.0.0}} under CDDL next to {{javax.servlet-api-3.1.0}}|
|2023-11-29|#14833|Added {{protobuf-java-BSD-3-clause}} with generic wording
instead of Google's text|
|2021-04-06|KAFKA-12602 (#10474)|Added argparse and jopt-simple texts copied
from newer upstream releases than the bundled jars. Later version bumps of
slf4j, jline and classgraph never refreshed their texts|
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
