pjfanning opened a new issue, #263: URL: https://github.com/apache/openserverless/issues/263
The 0.9.0-incubating-RC7 source release (`apache-openserverless-0.9.0-incubating-src.tar.gz`) ships a vendored copy of the cert-manager installation manifest whose upstream copyright notice has been replaced with the ASF header, and which is not attributed in `LICENSE` or `NOTICE`. ## The file `oplugins-op/deploy/cert-manager/cert-manager.yaml` (5,520 lines, from the `openserverless-operator` submodule) is the [cert-manager v1.10.1 release manifest](https://github.com/cert-manager/cert-manager/releases/download/v1.10.1/cert-manager.yaml). Compared with the release asset, the body is identical (apart from one blank line changed to `---`); only the header differs. Upstream header: ```yaml # Copyright 2022 The cert-manager Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # ... ``` Shipped header: ```yaml # # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # ... ``` The file has been in the operator repo since its first commit (`da9cf86`). It is still used: `openserverless/certmanager.py` applies it, the operator `Dockerfile` copies `deploy/cert-manager` into the image, and `clusters/eks.yml` and `clusters/lks.yml` apply it. ## Why it matters - cert-manager is Apache-2.0, so there is no licence conflict, but ยง4(c) of the Apache License requires retaining the copyright notices of the source: removing `Copyright 2022 The cert-manager Authors.` is not allowed. - ASF policy is not to put the ASF header on third-party files: https://www.apache.org/legal/src-headers.html#3party - Neither the top-level `LICENSE`/`NOTICE` nor `oplugins-op/LICENSE`/`NOTICE` mention cert-manager. ## Suggested fix Either: 1. **Stop vendoring it.** `oplugins/util/opsfile.yml` already downloads cert-manager from the upstream release at install time (`CERTMANAGER: https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml`), as does `clusters/k3s.yml`. The operator could do the same (or fetch it at image build time), and `deploy/cert-manager/cert-manager.yaml` could be deleted from the source tree. This fits the planned clean-up of vendored dependencies. 2. **Or keep it and fix the attribution:** - restore the upstream `# Copyright 2022 The cert-manager Authors.` header and remove the ASF header; - exclude the file in `.licenserc.yaml` / `.rat-excludes` so the header checks do not add the ASF header back; - add an entry to the top-level `LICENSE` (and `oplugins-op/LICENSE`), e.g.: ``` cert-manager The file oplugins-op/deploy/cert-manager/cert-manager.yaml is the cert-manager v1.10.1 installation manifest. Licensed under the Apache License, Version 2.0. Copyright 2022 The cert-manager Authors. ``` This was first reported in #250 (while verifying RC5), where 5 copies existed; the 4 under `oplugins/` have since been removed (`c6482cc`), leaving this one. Related: #260. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
