Hi Incubator PMC, Here is an overall update on the third-party licensing issues identified during the Apache Asyncband 0.7.0 RC1 vote.
We cancelled RC1 and completed a file-by-file review of the current source tree and repository history. The review identified incorporated source from Tokio, oneshot, futures-rs, Pollster, futures-lite, parking, and Fastpool. We treated code conservatively as derived, adapted, or ported where applicable. For the third-party source that remains, we made the following changes: - LICENSE now records the exact local-to-upstream file mappings and commit-pinned upstream sources. - Tokio-derived portions retain the Tokio copyright and MIT license. - Where an upstream project offers an Apache-2.0 or MIT choice, Asyncband uses the Apache-2.0 option. - Fastpool-derived source and tests retain the original "Copyright 2025 FastLabs Developers" attribution and Apache-2.0 header. - Each affected source or test file contains an explicit provenance note and a stable upstream source link. - Files treated as third-party sources retain the applicable upstream license treatment. - For files containing substantial Asyncband modifications, the scope of the ASF-authored work and the retained third-party portions is documented explicitly. After reviewing the result against the ASF LICENSE and NOTICE guidance, we also removed design and API provenance that does not represent incorporated third-party source from the LICENSE. Such "inspired by" history may remain in source comments, issues, or pull requests where useful, but it does not affect the distribution's licensing. Normal Cargo dependencies whose source is not bundled are not listed in LICENSE. We also checked the incorporated upstream projects for NOTICE requirements and found no additional notices that need to be propagated, so the project NOTICE remains intentionally brief. The remediation is covered by the following pull requests: https://github.com/apache/asyncband/pull/275 https://github.com/apache/asyncband/pull/279 https://github.com/apache/asyncband/pull/281 https://github.com/apache/asyncband/pull/283 The resulting license inventory is available at: https://github.com/apache/asyncband/blob/main/LICENSE The 0.7.0 ASF release candidate remains canceled, and I yanked the incorrectly published 0.7.0 crate. Version 0.7.1 was published as an explicitly marked interim non-ASF release. We will prepare 0.7.2 as a fresh ASF release candidate and restart the PPMC and IPMC votes. >From the project side, we consider the third-party provenance and licensing remediation complete, subject to any further PMC feedback. Thanks again to Justin and everyone who reviewed RC1 and helped us correct both the release contents and our review process. Best, tison
