papegaaij opened a new issue, #1723: URL: https://github.com/apache/wicket/issues/1723
While verifying the 10.12.0 and 11.0.0 release candidates I found that the top-level `LICENSE` contains only the Apache License text and says nothing about the third-party code the releases bundle. The ASF guide on [assembling LICENSE and NOTICE](https://infra.apache.org/licensing-howto.html) asks for permissively licensed bundled code to be listed in `LICENSE`, either with its license text or with a pointer to it. MIT imposes no NOTICE requirement, so it should not be in `NOTICE`. This is not new: it has been like this for a long time. It doesn't block the current releases, but it should be fixed for the next ones. ## What is bundled In the binary release (inside `wicket-core-<version>.jar`), and in the source release: - jQuery 3.7.1 and 4.0.0, in `wicket-core/src/main/java/org/apache/wicket/resource/jquery/` - jQuery Migrate 4.0.2, in the same directory In the source release only: - jQuery UI, in `wicket-examples/src/main/webapp/`: `jquery-ui-1.10.3.custom.js` on 10.x and `jquery-ui-v1.14.2.custom.js` on master - QUnit and jquery.mockjax, in `wicket-core/src/test/js/qunit/` - a copy of jQuery and QUnit in `wicket-examples/src/main/webapp/js-test/lib/` All of these are MIT licensed and keep their license headers, which is allowed in an ASF release. ## What LICENSE and NOTICE say now - The top-level `LICENSE` is the plain Apache License 2.0. - The top-level `NOTICE` mentions jQuery and QUnit ("released under a MIT style license"). That is the wrong place: NOTICE is only for notices a license requires. - `wicket-core`'s `META-INF/LICENSE` is plain ALv2 and its `META-INF/NOTICE` does not mention jQuery. The jar is what users redistribute, and it says nothing about the jQuery inside it. - `licenses/` contains `asm-license.txt`, `junit-license.txt`, `slf4j-license.txt` and `yahoo-license.txt`, but `LICENSE` does not refer to any of them. `yahoo-license.txt` looks like a leftover from the removed `wicket-datetime` module. ## Suggested fix 1. Add a section to the top-level `LICENSE` naming each bundled component, its version, its location and its license, and add the MIT texts to `licenses/`. 2. Do the same in `wicket-core`'s `META-INF/LICENSE` for jQuery and jQuery Migrate. 3. Remove the MIT entries from `NOTICE`. 4. Check each file in `licenses/` against what is still bundled, and remove or reference it. Affects `wicket-10.x` and `master`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
