Hi everyone, I must admit that the correctness of the LICENSE/NOTICE files in our releases has never been my highest priority. My assumption was that the files were already up to date.
In the last few months, I've been involved with getting Apache Pekko ramped up as an Incubator podling and a lot of the requirements coming our way relate to getting the licenses correct. >From what I've seen there, I'm starting to wonder if we might need to look >again at the licenses/notices in some of the POI and XMLBeans artifacts. I've just downloaded xmlbeans-bin-5.1.1-20220819.zip and its NOTICE lists a few dependencies but not everything. The LICENSE makes no mention of other jars. There are over 10 non-XMLBeans jars shipped in this zip. Most are Apache licensed and there is an argument not to list them but one example of a non-Apache licensed jar is slf4j-api (MIT licensed). Does anyone have any expertise or confidence that they understand the LICENSE/NOTICE requirements well enough to review what we have in XMLBeans and POI? A lot of other ASF projects have LICENSE-binary (spark example [1]) and NOTICE-binary files that list long lists of transitive dependencies and their licenses. Should we follow suit? Regards, PJ [1] https://github.com/apache/spark/blob/master/LICENSE-binary --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
