pjfanning opened a new pull request, #251: URL: https://github.com/apache/openserverless/pull/251
## What Lists, in the top-level `LICENSE`, the npm packages statically embedded in the three pre-built JavaScript bundles that the source release ships, and reproduces the MIT, ISC and BSD-3-Clause licence texts they require. Found while verifying the 0.9.0-incubating RC5 source tarball. The bundles are `bun build` outputs checked into the `oplugins` submodule; they were attributed only in `oplugins/NOTICE`, while the top-level `LICENSE` stated that every bundled component is Apache-2.0. ASF policy puts pointers to permissive third-party licences in `LICENSE`, not `NOTICE`. ## Bundles covered | Bundle | Embedded packages | Licences | |---|---|---| | `oplugins/util/upload.js` (1.0 MB) | minio 8.0.1 + 27 dependencies | Apache-2.0, MIT ×24, ISC ×2, BSD-3-Clause ×1 | | `oplugins/util/config/configurator.js` | @clack/core, @clack/prompts, sisteransi, picocolors | MIT ×3, ISC ×1 | | `oplugins/admin/usage/usage.js` | yaml 2.8.3 | ISC | Every package's licence was checked against the npm registry for the exact version pinned in the shipped lockfiles (`oplugins/util/upload/bun.lock`, `oplugins/admin/usage/usagechecker/package-lock.json`) and, for the configurator, the lockfile at the tagged `oplugins` commit (its source directory is excluded from the tarball by `no-release.txt`). All are ASF Category A. Two corrections relative to the list in `oplugins/NOTICE`: - `@clack/core` is pinned at 0.3.4, not 0.3.5. - `stream-chain` is not embedded in `upload.js` (only `stream-json/jsonl` and `stream-json/utils` are); it is omitted here. The intro sentence of the "Bundled components" section no longer claims that every component is Apache-2.0. ## Stacked on #250 This branch is based on the branch of #250 because both PRs append to the end of `LICENSE`. Once #250 merges, this PR's diff reduces to the single commit `LICENSE: attribute npm packages embedded in the pre-built JavaScript bundles`. ## Follow-ups outside this repo - The bundles themselves carry a plain ASF licence header above a megabyte of MIT/ISC/BSD code. A separate PR against `apache/openserverless-task` should make those headers state that the file embeds third-party code. - `oplugins/NOTICE` should be trimmed to required attributions only; the per-package list belongs in `oplugins/LICENSE`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
