Yes, +1000 to what PJ said. I would propose that a process something like this should be tried first to audit the license situation: - Check out to before the header change - Run RAT and look at the report. Make careful note of any dependencies that already have a license. It wasn't the case that Texera files had a header before adding the Apache one, correct? - For source dependencies, first ensure the license is a compatible one (https://www.apache.org/legal/resolved.html). If not, it needs to be excised somehow. - If it is, add those dependencies into the NOTICE file manually.
For library dependencies, I'm not sure what was being done. Were those also being added manually to the NOTICE or does sbt have a mechanism for handling this automatically? If not I would look into attempting to do it in some automated way. The first few AsterixDB releases I attempted to do it by hand, and it was a major pain. Mike Blow ended up writing a Maven plugin that uses Freemarker templates and information from the POM and supplemental-models.xml file to construct the NOTICE, and that's worked amazingly since. On Wed, Dec 10, 2025 at 11:50 PM PJ Fanning <[email protected]> wrote: > > Hi Jiadong. There are problems with the license headers and license > file. Please don't rush a release. The license headers and license are > very important. Just about the most important things to have right in > the release. > > On Thu, 11 Dec 2025 at 03:40, Jiadong Bai <[email protected]> wrote: > > > > PJ and Ian, > > > > Thanks for all the great suggestions. I have raised the issue and PR > > https://github.com/apache/texera/pull/4128 based on the suggestion. Once > > the PR is merged, I plan to create RC2 and start a new voting email thread. > > > > Best regards, > > Jiadong bai > > > > On Wed, Dec 10, 2025 at 6:26 AM PJ Fanning <[email protected]> wrote: > > > > > https://github.com/apache/texera/blob/main/LICENSE must mention every > > > source file that is borrowed from 3rd party projects, including all > > > those MIT licensed files in pyright-language-server. > > > > > > And as Ian highlights, there are possibly other instances that need to > > > be checked. > > > > > > On Tue, 9 Dec 2025 at 19:00, Ian Maxon <[email protected]> wrote: > > > > > > > > I support all of PJ's points, they are great guidance. However I also > > > > want to say I was very excited to see this email, and it is great > > > > progress to even have an attempt. Whatever comments emerge via this > > > > aren't a negative reflection on the effort, rather they are one more > > > > step on the path toward a release. > > > > > > > > I noticed something during inspecting the release candidate that I > > > > think may have gotten caught up in the ASF header change from earlier. > > > > It looks like there is a source dependency that got mistakenly marked > > > > as ASL 2.0 under pyright-language-service. For example, we can see > > > > that pyright-language-service/src/language-service-runner.ts is > > > > actually a MIT-licensed source dependency > > > > > > > https://github.com/apache/texera/blob/2b3e779f2af1c3d4dcf7eecafbae5b9a2e63f0eb/core/pyright-language-server/src/language-server-runner.ts > > > > > > > > I think a thorough inspection needs to be made to make sure there > > > > aren't other instances of this. Source dependencies with compatible > > > > licenses are perfectly fine, and we want to be sure we are honoring > > > > their license and not mistakenly attempting to release their work as > > > > ours under a different license. > > > > > > > > > > > > On Tue, Dec 9, 2025 at 8:59 AM Chen Li <[email protected]> wrote: > > > > > > > > > > PJ, thanks for the great suggestions. > > > > > > > > > > Jiadong: I suggest we first do a discussion on the dev list before a > > > vote. > > > > > Please also take care of these comments. Thank you. > > > > > > > > > > Chen > > > > > > > > > > On Tue, Dec 9, 2025 at 1:23 AM PJ Fanning <[email protected]> > > > wrote: > > > > > > > > > > > * The vote should be preceded by a discussion thread on dev list. > > > It's > > > > > > ok this time but please use the dev lists to discuss releases before > > > > > > creating RCs. > > > > > > * The KEYS file should be in > > > > > > https://dist.apache.org/repos/dist/release/incubator/texera/KEYS > > > > > > (release not dev) - this gets automatically synched to > > > > > > https://downloads.apache.org/incubator/texera/KEYS > > > > > > * So please update the 'release' KEYS file (ir required) and delete > > > the > > > > > > 'dev one > > > > > > * Future vote emails should use > > > > > > https://downloads.apache.org/incubator/texera/KEYS as the official > > > > > > KEYS address > > > > > > * Can you remove the 'rc1' from the tar file name? It's correct to > > > > > > have it in the directory name but with the file, you are not > > > > > > supposed > > > > > > to rename the file after the vote and it looks strange to have rc1 > > > > > > in > > > > > > the file name if and when it becomes the official release. This is a > > > > > > norm as opposed to a rule but I think we should use the norm. > > > > > > * I would recommend not using wget in the instructions. Just tell us > > > > > > where the files are (the directory, we can work out the rest) > > > > > > * Are you releasing any convenience binaries? Jars to Maven Central? > > > > > > pypi.org? These need to be reviewed too. Can you provide details? > > > > > > > > > > > > > > > > > > On Tue, 9 Dec 2025 at 06:53, Jiadong Bai <[email protected]> > > > wrote: > > > > > > > > > > > > > > Hi Texera Community, > > > > > > > > > > > > > > This is a call for vote to release Apache Texera (incubating) > > > > > > > 1.1.0-incubating. > > > > > > > > > > > > > > == Release Candidate Artifacts == > > > > > > > > > > > > > > The release candidate artifacts can be found at: > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/texera/1.1.0-incubating-RC1/ > > > > > > > > > > > > > > The artifacts include: > > > > > > > - apache-texera-1.1.0-incubating-rc1-src.tar.gz (source tarball) > > > > > > > - apache-texera-1.1.0-incubating-rc1-src.tar.gz.asc (GPG > > > > > > > signature) > > > > > > > - apache-texera-1.1.0-incubating-rc1-src.tar.gz.sha512 (SHA512 > > > checksum) > > > > > > > > > > > > > > == Git Tag == > > > > > > > > > > > > > > The Git tag for this release candidate: > > > > > > > https://github.com/apache/texera/releases/tag/v1.1.0-incubating > > > > > > > > > > > > > > The commit hash for this tag: > > > > > > > 51fb0b8acb604867e3b786f293d447f88c50522d > > > > > > > > > > > > > > == Release Notes == > > > > > > > > > > > > > > Release notes can be found at: > > > > > > > https://github.com/apache/texera/releases/tag/v1.1.0-incubating > > > > > > > > > > > > > > == Keys == > > > > > > > > > > > > > > The artifacts have been signed with Key [EBEBFB7D888E0190], > > > corresponding > > > > > > > to [[email protected]]. > > > > > > > > > > > > > > The KEYS file containing the public keys can be found at: > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/texera/KEYS > > > > > > > > > > > > > > == How to Verify == > > > > > > > > > > > > > > 1. Download the release artifacts: > > > > > > > > > > > > > > wget > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/texera/1.1.0-incubating-RC1/apache-texera-1.1.0-incubating-rc1-src.tar.gz > > > > > > > wget > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/texera/1.1.0-incubating-RC1/apache-texera-1.1.0-incubating-rc1-src.tar.gz.asc > > > > > > > wget > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/texera/1.1.0-incubating-RC1/apache-texera-1.1.0-incubating-rc1-src.tar.gz.sha512 > > > > > > > > > > > > > > 2. Import the KEYS file and verify the GPG signature: > > > > > > > > > > > > > > wget > > > https://dist.apache.org/repos/dist/dev/incubator/texera/KEYS > > > > > > > gpg --import KEYS > > > > > > > gpg --verify apache-texera-1.1.0-incubating-rc1-src.tar.gz.asc > > > > > > > apache-texera-1.1.0-incubating-rc1-src.tar.gz > > > > > > > > > > > > > > 3. Verify the SHA512 checksum: > > > > > > > > > > > > > > sha512sum -c > > > apache-texera-1.1.0-incubating-rc1-src.tar.gz.sha512 > > > > > > > > > > > > > > 4. Extract and build from source: > > > > > > > > > > > > > > tar -xzf apache-texera-1.1.0-incubating-rc1-src.tar.gz > > > > > > > cd apache-texera-1.1.0-incubating-rc1-src > > > > > > > # Follow build instructions in README > > > > > > > > > > > > > > == How to Vote == > > > > > > > > > > > > > > The vote will be open for at least 72 hours. > > > > > > > > > > > > > > Please vote accordingly: > > > > > > > > > > > > > > [ ] +1 Approve the release > > > > > > > [ ] 0 No opinion > > > > > > > [ ] -1 Disapprove the release (please provide the reason) > > > > > > > > > > > > > > == Checklist for Reference == > > > > > > > > > > > > > > When reviewing, please check: > > > > > > > > > > > > > > [ ] Download links are valid > > > > > > > [ ] Checksums and PGP signatures are valid > > > > > > > [ ] LICENSE and NOTICE files are correct > > > > > > > [ ] All files have ASF license headers where appropriate > > > > > > > [ ] No unexpected binary files > > > > > > > [ ] Source tarball matches the Git tag > > > > > > > [ ] Can compile from source successfully > > > > > > > [ ] Can launch Texera by following > > > > > > > > > > https://github.com/apache/texera/wiki/Installing-Texera-on-a-Single-Node > > > > > > > > > > > > > > Thanks, > > > > > > > Jiadong Bai > > > > > > > Apache Texera(incubating) PPMC > > > > > > > > >
