kevinjqliu commented on code in PR #3694: URL: https://github.com/apache/parquet-java/pull/3694#discussion_r3668692513
########## parquet-cli/src/main/resources/META-INF/LICENSE: ########## Review Comment: verified that all 22 dependencies are present (according to https://github.com/apache/parquet-java/issues/3690#issuecomment-5085686385) com.beust:jcommander:1.82 com.fasterxml.jackson.core:jackson-annotations:2.22 com.fasterxml.jackson.core:jackson-core:2.22.1 com.fasterxml.jackson.core:jackson-databind:2.22.1 com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.22.1 **com.github.luben:zstd-jni:1.5.7-11** **commons-codec:commons-codec:1.11** commons-pool:commons-pool:1.6 **io.airlift:aircompressor:2.0.3** it.unimi.dsi:fastutil:8.5.18 **javax.annotation:javax.annotation-api:1.3.2** net.openhft:zero-allocation-hashing:0.27ea1 net.sf.opencsv:opencsv:2.3 org.apache.avro:avro:1.11.5 org.apache.commons:commons-compress:1.26.2 org.apache.commons:commons-lang3:3.20.0 org.apache.commons:commons-text:1.15.0 org.apache.thrift:libthrift:0.23.0 **org.locationtech.jts:jts-core:1.20.0** org.slf4j:slf4j-api:1.7.33 **org.tukaani:xz:1.12** **org.xerial.snappy:snappy-java:1.1.10.8** the 7 highlighted ones needs attention | Dependency | Required `LICENSE` change | Reason | |---|---|---| | `javax.annotation:javax.annotation-api:1.3.2` | Select and include CDDL-1.0; provide the source location and identify it as ASF Category B, binary-only. | It is dual-licensed under CDDL-1.0 or GPLv2 with Classpath Exception. CDDL-1.0 is the preferable option for the shaded binary. | | `org.locationtech.jts:jts-core:1.20.0` | Select and include EDL-1.0. | It is dual-licensed under EPL-2.0 or EDL-1.0. EDL-1.0 is the ASF Category-A option. | | `org.xerial.snappy:snappy-java:1.1.10.8` | Include Google Snappy BSD-3, Bitshuffle MIT, and Intel PureJavaCrc32C BSD terms and copyrights. | The Apache-2.0 dependency bundles native and copied code under these additional licenses. | | `io.airlift:aircompressor:2.0.3` | Include Google Snappy BSD-3 terms and copyright. | Its upstream `notice.md` identifies bundled Google Snappy code under BSD-3. | | `commons-codec:commons-codec:1.11` | Include the Intel PureJavaCrc32C BSD terms and copyright. | Its `PureJavaCrc32C` implementation contains Intel-owned BSD-licensed portions. One shared Intel section can also cover snappy-java. | | `org.tukaani:xz:1.12` | Replace the public-domain statement with the 0BSD terms and author attribution. | Version 1.12 source files explicitly use `SPDX-License-Identifier: 0BSD`. | | `com.github.luben:zstd-jni:1.5.7-11` | Include the wrapper BSD-2, native Zstandard BSD-3, `libdivsufsort-lite` MIT, and legacy Zstandard BSD-2 coverage. | The JAR physically embeds the JNI wrapper and native code governed by these different licenses. Shared MIT and BSD-2 terms can avoid duplication. | ########## parquet-column/src/main/resources/META-INF/NOTICE: ########## Review Comment: nit: Maven’s default generated NOTICE already uses `Apache Parquet <module’s name>`. Since these NOTICE file doesnt contain any other entries, we dont necessary need to add them. This applies to both - parquet-column/src/main/resources/META-INF/NOTICE - parquet-hadoop/src/main/resources/META-INF/NOTICE Furthermore the opposite problem occurs in [parquet-protobuf/src/main/resources/META-INF/NOTICE](https://github.com/apache/parquet-java/blob/master/parquet-protobuf/src/main/resources/META-INF/NOTICE). We should not use "Apache Parquet Java" but use the module name instead. ########## parquet-cli/src/main/resources/META-INF/NOTICE: ########## @@ -43,3 +43,82 @@ notice: | See the License for the specific language governing permissions and | limitations under the License. +-------------------------------------------------------------------------------- + +This product bundles Apache Avro, which includes the following in its NOTICE +file: + + Apache Avro + Copyright 2009-2025 The Apache Software Foundation + + This product includes software developed at + The Apache Software Foundation (http://www.apache.org/). + +-------------------------------------------------------------------------------- + +This product bundles Apache Thrift, which includes the following in its NOTICE +file: + + Apache Thrift + Copyright (C) 2006 - 2019, The Apache Software Foundation + + This product includes software developed at + The Apache Software Foundation (http://www.apache.org/). + +-------------------------------------------------------------------------------- + +This product bundles Jackson, which includes the following in its NOTICE file: + + # Jackson JSON processor + + Jackson is a high-performance, Free/Open Source JSON processing library. + It was originally written by Tatu Saloranta ([email protected]), and has + been in development since 2007. + It is currently developed by a community of developers. + + Copyright 2007-, Tatu Saloranta ([email protected]) + + jackson-core bundles a shaded copy of FastDoubleParser + <https://github.com/wrandelshofer/FastDoubleParser> and a copy of the + Schubfach number-writing code <https://github.com/c4f7fcce9cb06515/Schubfach>, + both available under the MIT license. + +-------------------------------------------------------------------------------- + +This product bundles several Apache Commons libraries, which include the +following in their NOTICE files: + + Apache Commons Codec + Copyright 2002-2017 The Apache Software Foundation + + This product includes software developed at + The Apache Software Foundation (http://www.apache.org/). + + src/test/org/apache/commons/codec/language/DoubleMetaphoneTest.java + contains test data from http://aspell.net/test/orig/batch0.tab. + Copyright (C) 2002 Kevin Atkinson ([email protected]) + + The content of package org.apache.commons.codec.language.bm has been + translated from the original php source code available at + http://stevemorse.org/phoneticinfo.htm with permission from the original + authors. Original source copyright: Copyright (c) 2008 Alexander Beider & + Stephen P. Morse. + + Apache Commons Compress + Copyright 2002-2024 The Apache Software Foundation + + This product includes software developed at + The Apache Software Foundation (https://www.apache.org/). + + Apache Commons Lang + Copyright 2001-2025 The Apache Software Foundation + + Apache Commons Text + Copyright 2014-2025 The Apache Software Foundation + + Apache Commons Pool + Copyright 2001-2012 The Apache Software Foundation + + This product includes software developed by + The Apache Software Foundation (http://www.apache.org/). + Review Comment: Paired with codex, these 13 (out of 22) dependencies should propagate NOTICE. we captured all except 2 (highlighted) | Dependency | Required NOTICE content | |---|---| | `org.apache.thrift:libthrift:0.23.0` | Apache Thrift copyright notice | | `org.apache.avro:avro:1.11.5` | Apache Avro copyright notice | | `com.fasterxml.jackson.core:jackson-annotations:2.22` | Shared Jackson notice | | `com.fasterxml.jackson.core:jackson-core:2.22.1` | Shared Jackson notice, including FastDoubleParser and Schubfach | | `com.fasterxml.jackson.core:jackson-databind:2.22.1` | Shared Jackson notice | | `com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.22.1` | Covered by the shared Jackson notice; no separate text | | `commons-codec:commons-codec:1.11` | Commons Codec copyright and Beider–Morse attribution; exclude the test-only `DoubleMetaphoneTest` notice | | `org.apache.commons:commons-compress:1.26.2` | Commons Compress copyright notice | | `org.apache.commons:commons-lang3:3.20.0` | Commons Lang copyright notice | | `commons-pool:commons-pool:1.6` | Commons Pool copyright notice | | `org.apache.commons:commons-text:1.15.0` | Commons Text copyright notice | | **`io.airlift:aircompressor:2.0.3`** | Dain Sundstrom and Google Snappy copyrights | | **`org.xerial.snappy:snappy-java:1.1.10.8`** | Google Snappy, Apache `PureJavaCrc32C`, static `libstdc++`/GCC Runtime Library Exception, and contributor notices | ########## parquet-cli/src/main/resources/META-INF/NOTICE: ########## @@ -43,3 +43,82 @@ notice: | See the License for the specific language governing permissions and | limitations under the License. +-------------------------------------------------------------------------------- + +This product bundles Apache Avro, which includes the following in its NOTICE Review Comment: > I don't think it is an issue of having a somewhat bigger LICENSE and NOTICE. Big is relative 😆 I've seen wayyy longer LICENSE and NOTICE files BTW these are the specific 3rd party dependencies bundled: https://github.com/apache/parquet-java/issues/3690#issuecomment-5085686385 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
