[
https://issues.apache.org/jira/browse/FLINK-41467?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Rui Fan updated FLINK-41467:
----------------------------
Description:
The {{apache-flink}} PyFlink package (sdist and wheels) has shipped without a
NOTICE file since 1.13: {{flink-python/MANIFEST.in}} has {{include NOTICE}},
but {{flink-python/NOTICE}} does not exist. ({{apache-flink-libraries}} is not
affected.)
ASF release policy requires every package to include a LICENSE and a NOTICE
file.
Evidence: the Apache Trusted Releases check on the 1.20.6 candidate reports
this as a blocker ("No NOTICE file found"):
https://releases.apache.org/result/data/flink/1.20.6/769641
Fix: add {{flink-python/NOTICE}} with the standard ASF header.
was:
The {{apache-flink}} Python package published to PyPI (both the sdist and the
wheels) has not contained a NOTICE file since 1.13.0.
{{flink-python/MANIFEST.in}} contains {{include NOTICE}}, but there is no
{{flink-python/NOTICE}} file and {{flink-python/setup.py}} only copies the root
LICENSE into the package. The logic that generated a NOTICE file for this
package was removed together with the bundled licenses in FLINK-22095, so
{{include NOTICE}} silently matches nothing. The {{apache-flink-libraries}}
package is not affected, its setup.py still generates a NOTICE file.
The ASF release policy requires every distributed package to ship a NOTICE file:
* https://www.apache.org/legal/release-policy.html#licensing-documentation :
"Each package MUST provide a LICENSE file and a NOTICE file which account for
the package's exact content."
* https://infra.apache.org/licensing-howto.html : a NOTICE file containing the
standard ASF attribution is required even for packages that only contain ASF
code.
The {{apache-flink}} package only contains Apache Flink code (the pyflink
Python sources plus the bin/conf scripts from flink-dist), so the fix is to add
a {{flink-python/NOTICE}} file with the standard ASF attribution (same header
as the root NOTICE):
{noformat}
Apache Flink
Copyright 2014-2026 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
{noformat}
The root NOTICE must not be copied as is, because it lists third-party material
that is not bundled in the Python package.
> PyFlink apache-flink package is missing the NOTICE file
> -------------------------------------------------------
>
> Key: FLINK-41467
> URL: https://issues.apache.org/jira/browse/FLINK-41467
> Project: Flink
> Issue Type: Bug
> Components: API / Python
> Affects Versions: 1.13.0, 2.3.0, 2.2.1, 1.20.5
> Reporter: Rui Fan
> Assignee: Rui Fan
> Priority: Blocker
> Labels: pull-request-available
> Fix For: 2.2.2, 1.20.6, 2.3.1, 2.4.0, 2.5.0
>
>
> The {{apache-flink}} PyFlink package (sdist and wheels) has shipped without a
> NOTICE file since 1.13: {{flink-python/MANIFEST.in}} has {{include NOTICE}},
> but {{flink-python/NOTICE}} does not exist. ({{apache-flink-libraries}} is
> not affected.)
> ASF release policy requires every package to include a LICENSE and a NOTICE
> file.
> Evidence: the Apache Trusted Releases check on the 1.20.6 candidate reports
> this as a blocker ("No NOTICE file found"):
> https://releases.apache.org/result/data/flink/1.20.6/769641
> Fix: add {{flink-python/NOTICE}} with the standard ASF header.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
