blackmwk commented on PR #3414: URL: https://github.com/apache/iceberg-rust/pull/3414#issuecomment-6211157485
Reviewed at 683d60c194d243ccc3cf61946e877d2196212c62. I found one omission in the license clarification and one provenance question: 1. **Include the embedded BSD-2-Clause code in the zstd clarification** ([deny.toml:59](https://github.com/apache/iceberg-rust/blob/683d60c194d243ccc3cf61946e877d2196212c62/deny.toml#L59)). The packaged legacy decoders contain BSD-2-Clause licenses and Yann Collet copyright notices, for example [zstd_v05.c](https://github.com/facebook/zstd/blob/v1.5.7/lib/legacy/zstd_v05.c#L17). I checked that the packaged source matches upstream v1.5.7 and that the dependency graph enables `zstd-sys/legacy`. Please account for these embedded licenses in the expression and supporting evidence, and preserve the corresponding notices in the planned binary attribution output. ASF requires that every third-party work include its associated license; checking the crate's top-level license files alone misses these notices. See [ASF's third-party source policy](https://www.apache.org/legal/src-headers.html) and [binary distribution guidance](https://infra.apache.org/licensing-howto.html#binary-distributio ns). 2. **Clarify the hashing helper's provenance** ([licenses.py:323](https://github.com/apache/iceberg-rust/blob/683d60c194d243ccc3cf61946e877d2196212c62/dev/release/licenses.py#L323)). The docstring says it is "based on the cargo-deny source code." Does that mean independently implementing the algorithm, or copying/translating upstream code? If code was copied or adapted, please document its origin and selected upstream license and preserve applicable notices. This is a provenance question, not a confirmed license violation. ASF's policy says: "Do not modify or remove any copyright notices or licenses within third-party works." The `GPL-2.0-only OR BSD-3-Clause` alternative is compatible with selecting BSD under [ASF's license-choice policy](https://www.apache.org/legal/resolved.html). Likewise, the Brotli `BSD-3-Clause AND MIT` expression correctly represents cumulative obligations; the planned attribution follow-up still needs to provide the required texts and notices in distributed wheels. Validation: the dependency check passes with CI-pinned `cargo-deny 0.19.9`, and all six configured hashes match the crate sources. Additional probes correctly rejected mismatching hashes, stale clarifications, disallowed license expressions, version pins, and a clarification missing from only one evaluated version. --- AI-assisted review, posted at the maintainer's request. Please challenge any finding that appears incorrect. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
