pjfanning opened a new issue, #260: URL: https://github.com/apache/openserverless/issues/260
While reviewing the 0.9.0-incubating-RC7 source release (`apache-openserverless-0.9.0-incubating-src.tar.gz`), I found third-party files that the top-level `LICENSE` does not mention, and vendored third-party files that carry the ASF source header instead of their upstream notices. All the licences involved are permissive (Apache-2.0, BSD-3-Clause), so this is about documenting them correctly, not about incompatible licences. ## 1. Third-party code missing from the top-level LICENSE | File(s) | Origin | Licence | |---|---|---| | `cli/tools/sh.go` | Lightly modified copy of mvdan/sh `cmd/gosh/main.go` (only the package name and entry point differ from v3.8.0) | BSD-3-Clause, Copyright (c) 2017 Daniel Martà | | `oplugins-op/deploy/cert-manager/cert-manager.yaml` | cert-manager v1.10.1, rendered from its Helm chart (CRDs included) | Apache-2.0, The cert-manager Authors | | `oplugins-op/deploy/milvus/*`, `oplugins-op/deploy/milvus-slim/*`, `oplugins-op/openserverless/templates/milvus-cfg-*.yaml` | Milvus Helm chart (Milvus v2.5.2) | Apache-2.0, Copyright Zilliz | | `oplugins-op/deploy/milvus-operator/*`, `oplugins-op/deploy/openserverless-permissions/openserverless-milvus-operator-crd.yaml`, `openserverless-milvus-operator-roles.yaml` | milvus-operator Helm chart 1.1.3 | Apache-2.0, Copyright Zilliz | | `testing/stress-test/locust-manifest.yaml` | Locust Helm chart (Locust 2.15.1) | Apache-2.0 | Components that LICENSE already lists also appear at paths it does not mention: - Kubegres CRD: `oplugins-op/deploy/openserverless-permissions/kubegres-crd.yaml`, `testing/stress-test/oplugins-stress/setup/kubernetes/crds/kubegres-crd.yaml` - ingress-nginx: `oplugins-op/deploy/ingress-nginx/*.yaml` (controller 1.5.1 and 1.8.1, versions LICENSE does not mention), `testing/stress-test/oplugins-stress/setup/docker/ingress-deploy.yaml` - openshift-acme: `oplugins-op/deploy/acme-openshift/*` - OpenWhisk Helm chart renderings (`# Source: openwhisk/templates/...`) under `oplugins-op/` and `testing/` The LICENSE files inside the submodules do not cover these: they describe the container images and state that the source is entirely Apache-2.0. `cli/LICENSE` includes the BSD-3-Clause text for `sciabarracom/sh`, but as a dependency of the CLI binary, not as source copied into the release. ## 2. ASF headers on third-party files ASF policy says the ASF header should not be added to third-party files, and their original copyright and licence notices should be kept: https://www.apache.org/legal/src-headers.html#3party In the RC7 tarball, the vendored files carry the ASF header: - ASF header added above the upstream notice: `cli/tools/sh.go` (its "See LICENSE for licensing information" line now points at the wrong LICENSE), and the Milvus config files. - ASF header only, with no upstream attribution: all the manifests in section 1, plus the files LICENSE already lists (ingress-nginx, Kubegres, openshift-acme, the Prometheus and kube-state-metrics descriptors), and `oplugins/ide/mime.types` (public domain, as the file itself says). - `oplugins/util/upload.js` and `oplugins/admin/usage/usage.js` are `bun build` bundles with an ASF header over embedded MIT, ISC and BSD code. LICENSE lists those packages, but the header claims the whole file. Handled correctly, for reference: `build/openwhisk/gradlew` and `gradlew.bat` keep Gradle's own header. Because every third-party file has an Apache header, Apache RAT reports 0 unapproved files and cannot flag any of this. ## Suggested fixes 1. Add LICENSE entries for mvdan/sh (with the BSD-3-Clause text), cert-manager, Milvus, milvus-operator and Locust, and extend the existing Kubegres, ingress-nginx, openshift-acme and OpenWhisk-chart entries to the `oplugins-op/` and `testing/` paths. 2. Remove the ASF header from vendored files, restore their upstream notices, and exclude those paths in `.rat-excludes` and `.licenserc.yaml` so the header checks do not add it back. 3. For `cli/tools/sh.go`: restore the BSD-3-Clause notice as its header, or depend on the `sh` module directly instead of copying the file. Related: #259 (Stack Overflow code in `Unzip.scala`). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
