I raised some Openwhisk issues related to this but there could be a lot more.
On 2026/09/30 19:11:49 Michele Sciabarra wrote: > Ok Thanks. We did the same checks on the sources but we we’re unable to > find them. Many are coming from relased OpenWhisk code though - but I guess > when they released there was no AI to help. > > On Wed, 30 Sep 2026 at 20:08, PJ Fanning <[email protected]> wrote: > > > Apologies the summaries of the issues have copy/paste issues but the links > > to the GitHub issues and PR should work. > > > > > > On 2026/09/30 19:04:29 PJ Fanning wrote: > > > -1 binding. > > > Still a lot of licensing problems. Issues that I raised before was not > > handled for RC7. > > > > > > Issues and pull requests raised in apache/openserverless while reviewing > > 0.9.0-incubating-RC7 > > > > > > Issues > > > > > > #259 - Unzip.scala contains Stack Overflow code, not allowed by ASF > > licensing policy > > > https://github.com/apache/openserverless/issues/259 > > > build/openwhisk/.../standalone/Unzip.scala (vendored from OpenWhisk) is > > based on a Stack Overflow answer. Stack Overflow content is CC BY-SA, and > > ASF policy does not allow it without the author's permission. Suggests a > > clean-room rewrite (and guarding against zip-slip paths while doing so). > > > > > > #260 - Third-party files missing from LICENSE and carrying ASF heade > > > https://github.com/apache/openserverless/issues/260 > > > Lists vendored third-party content not in the top-level LICENSE: mvdd > > into cli/tools/sh.go, and the Milvus, milvus-operator and Locustmanifests. > > Also reports that vendored third-party files carry the ASF header instead > > of their upstream notices, which ASF policy does not allow. A follow-up > > > comment cross-references the more specific issues below and notes > > thsince been removed. > > > > > > #262 - Apache Kvrocks kvrocks.conf is bundled but not attributed in > > > https://github.com/apache/openserverless/issues/262 > > > oplugins-op/openserverless/templates/kvrocks-cm.yaml embeds the Apaconf, > > with 8 settings changed. Suggests a LICENSE entry and theKvrocks > > attribution in NOTICE. > > > > > > #263 - cert-manager.yaml: upstream copyright header replaced with ASF > > header, and not in LICENSE > > > https://github.com/apache/openserverless/issues/263 > > > oplugins-op/deploy/cert-manager/cert-manager.yaml is the cert-manager > > v1.10.1 manifest with its "Copyright 2022 The cert-manager Authors" header > > replaced by the > > > ASF header. Suggests downloading it at install time, as oplugins alre > > header and adding a LICENSE entry. > > > > > > #264 - Main.scala (OpenWhisk admin tool) contains MIT-licensed code > > bution > > > https://github.com/apache/openserverless/issues/264 > > > printErr() is Scallop 3.3.2's default error handler (MIT). Suggests ry. > > > > > > #265 - DockerToActivationFileLogStore.scala contains code derived frut > > attribution > > > https://github.com/apache/openserverless/issues/265 > > > OwSink.combine is adapted from Akka 2.6.12 (Apache-2.0, Lightbend). r a > > rewrite, possibly based on Apache Pekko instead. > > > > > > #266 - ExecManifest.scala copies the docker/distribution > > image-referbution > > > https://github.com/apache/openserverless/issues/266 > > > An 18-line grammar comment is copied verbatim from > > docker/distributiource link is broken. Suggests a LICENSE entry and a > > pinned link, orrewording. > > > > > > #267 - Top-level LICENSE/NOTICE: bundled JavaScript copyright notices > > belong in LICENSE, and several are inaccurate > > > https://github.com/apache/openserverless/issues/267 > > > The copyright lines for the npm packages bundled in upload.js and > > usage.js are in the top-level NOTICE (lines 69-162), where ASF guidance > > says they do not belong. > > > Eight of them do not match the upstream packages. Suggests moving thE. > > > > > > #268 - Source release: ship only the top-level LICENSE and NOTICE, n > > > https://github.com/apache/openserverless/issues/268 > > > The source release contains 85 LICENSE/NOTICE/DISCLAIMER files in suy > > contradict each other and the top-level files. Asks for them to beleft out > > of the source release. Notes that 26 Dockerfiles copy them into container > > images, so the images need another source for them. > > > > > > #269 - Top-level LICENSE says Gradle wrapper v5.5, but the gradlew > > scripts are from Gradle 6.9.1 > > > https://github.com/apache/openserverless/issues/269 > > > The vendored gradlew and gradlew.bat match OpenWhisk's Gradle 6.9.1 > > scripts, not Gradle 5.5. Suggests correcting the version in LICENSE. > > > > > > Pull requests > > > > > > #261 - LICENSE/NOTICE: list every vendored copy of the bundled > > Kubernetes components > > https://github.com/apache/openserverless/pull/261 > > > Targets the 0.9.0 branch. Extends the existing LICENSE entries for > > ingress-nginx, Kubegres, openshift-acme, Prometheus / kube-state-metrics > > and the OpenWhisk Helm chart to also list the copies under oplugins-op/ and > > testing/. Updatf #260. > > > > > > > > > On 2026-09-29 08:03 UTC Michele Sciabarra wrote: > > > > Hi all, > > > > > > > > RC6 included a javascript that while being apparently a source, should > > > > be considered a binary. > > > > I omitted the source for that, which was a mistake. I corrected this > > > > error by moving it to a separate repository and excluding it from the > > > > distribution as it is not currenly used. I also updated the licenses > > > > and distribution files and the location of the KEYS file. > > > > > > > > There are no code changes aside from that but we need to revote the > > > > distribution for submission to the IPMC. > > > > > > > > I propose the following RC to be released as the official > > > > Apache OpenServerless 0.9.0-incubating release. > > > > > > > > The artifacts for this release candidate can be found at: > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC7 > > > > > > > > The Git tag to be voted upon is: > > > > > > > > v0.9.0-incubating-RC7 > > > > > > > > > > https://github.com/apache/openserverless/releases/tag/v0.9.0-incubating-RC7 > > > > > > > > Release artifacts are signed with the GPG key of the release manager. > > > > > > > > The KEYS file is available at: > > > > > > > > https://downloads.apache.org/incubator/openserverless/KEYS > > > > > > > > Please download, verify, and test the release candidate. > > > > > > > > For detailed step-by-step instructions on how to verify this > > > > release, please see the file VERIFY.md within the source > > > > archive, or check: > > > > > > > > https://github.com/apache/openserverless/blob/0.9.0/VERIFY.md > > > > > > > > The vote will run for a minimum of 72 hours and close no earlier > > > > than: > > > > > > > > 2026-10-02 07:55 UTC > > > > > > > > Please vote: > > > > > > > > [ ] +1 Release this package as Apache OpenServerless 0.9.0-incubating > > > > [ ] +0 > > > > [ ] -1 Do not release this package because... (reason required) > > > > > > > > Only PPMC members have binding votes, but community votes are > > > > encouraged. > > > > > > > > Checklist for reference: > > > > [ ] Download links are valid > > > > [ ] Checksums and signatures are valid > > > > [ ] LICENSE/NOTICE files exist > > > > [ ] No unexpected binary files in source > > > > [ ] All source files have ASF headers > > > > [ ] Can compile from source > > > > > > > > On behalf of the Apache OpenServerless Podling PMC (PPMC), > > > > > > > > Michele Sciabarra | CTO > > > > m: +44 747 984 8388 > > > > e: [email protected] > > > > l: https://linkedin.com/in/msciab > > > > Nuvolaris Inc | 1209 Orange Street, 19801Wilmington DE - US > > > > > > > > > >
