[
https://issues.apache.org/jira/browse/KAFKA-21287?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18127850#comment-18127850
]
Dejan Stojadinović commented on KAFKA-21287:
--------------------------------------------
(!) *Note/update:* there is a related ticket and PR (pending for review since
May 2026) assigned to [~majialong] *that should be reviewed first:*
- KAFKA-20559
- [https://github.com/apache/kafka/pull/22266]
> Fix 'licenses' folder contents and 'LICENSE-binary' file references
> -------------------------------------------------------------------
>
> Key: KAFKA-21287
> URL: https://issues.apache.org/jira/browse/KAFKA-21287
> Project: Kafka
> Issue Type: Bug
> Components: build
> Reporter: Dejan Stojadinović
> Assignee: Dejan Stojadinović
> Priority: Minor
>
> h1. Kafka licenses/ folder audit
>
> The {{licenses/}} folder shipped in the Kafka binary distribution has drifted
> from the dependencies it covers: one referenced file is missing, one has the
> wrong license text, four ship for nothing, and several copyright lines are
> stale. CI only compares versions in {{{}LICENSE-binary{}}}, never the
> contents of {{{}licenses/{}}}.
> h2. Findings
> 16 files in {{licenses/}} were compared with the {{LICENSE-binary}}
> references and with the license each dependency ships at its current version
> ({{{}gradle/dependencies.gradle{}}}).
> ||#||File / entry||Problem||Fix||
> |1|{{jakarta.activation-2.0.1}} →
> {{licenses/jakarta-BSD-3-clause}}|Referenced file does not exist. The jar's
> own {{META-INF/LICENSE.md}} is EDL 1.0 (BSD-3, Copyright 2018 Oracle).|Point
> to {{licenses/eclipse-distribution-license-1.0}}|
> |2|{{protobuf-java-BSD-3-clause}}|Wrong text: "Copyright 2023, the original
> author or authors" (jline's wording). Upstream v25.5 is "Copyright 2008
> Google Inc."|Replace with upstream v25.5 {{LICENSE}}|
> |3|{{mock-oauth2-server-MIT}}|Test-only dependency
> ({{{}testImplementation{}}}), not bundled|Delete|
> |3|{{jsr305-BSD-3-clause}}|Dependency dropped from {{LICENSE-binary}} in
> 2025, file left behind|Delete|
> |3|{{paranamer-BSD-3-clause}}|Same as jsr305|Delete|
> |3|{{eclipse-distribution-license-1.0}}|Not referenced, although it is the
> right file for #1 and #4|Reference it|
> |4|{{{}jakarta.activation-api-2.1.0{}}},
> {{jakarta.xml.bind-api-3.0.1}}|Listed as CDDL 1.1 + GPLv2; POM and jar say
> EDL 1.0|Move to an EDL 1.0 section|
> |4|{{jakarta.servlet-api-6.0.0}}|Listed as CDDL 1.1 + GPLv2; POM says EPL 2.0
> / GPL2 w/ CPE|Move to the EPL 2.0 section|
> |4|{{CDDL+GPL-1.1}}|Unreferenced once the three jars above move|Delete|
> |5|{{classgraph-MIT}} (4.8.196)|2019 vs upstream 2026|Upstream text|
> |5|{{slf4j-MIT}} (1.7.36)|2004-2017 QOS.ch vs 2004-2022 QOS.ch Sarl
> (Switzerland)|Upstream text|
> |5|{{jline-BSD-3-clause}} (3.30.17)|2002-2018 vs 2002-2023|Upstream text|
> |5|{{jopt-simple-MIT}} (5.0.4)|2004-2016 vs 2004-2015 at the tag|Upstream
> text|
> |5|{{argparse-MIT}} (0.7.0)|2011-2017 vs 2011, 2014, 2015 at the tag|Upstream
> text|
> |5|{{zstd-jni-BSD-2-clause}} (1.5.7-17)|Extra title line; "BSD License" vs
> "BSD-2-Clause License" + URL|Upstream text|
> |–|{{{}pcollections-MIT{}}}, {{{}hdrHistogram-BSD-2-clause{}}},
> {{{}re2j-GO{}}}, {{eclipse-public-license-2.0}}|Match upstream|None|
> h2. Proposed change
> One {{MINOR}} PR, branch {{{}MINOR-fix-licenses-folder{}}}, touches only
> {{LICENSE-binary}} and {{{}licenses/{}}}.
> * {{{}LICENSE-binary{}}}: replace the "CDDL 1.1 + GPLv2" section with an
> "Eclipse Distribution License - v 1.0" section
> ({{{}jakarta.activation-2.0.1{}}}, {{{}jakarta.activation-api-2.1.0{}}},
> {{{}jakarta.xml.bind-api-3.0.1{}}}); add {{jakarta.servlet-api-6.0.0}} to the
> EPL 2.0 section; drop the broken {{jakarta-BSD-3-clause}} line.
> * Replaced with upstream text at the current version:
> {{{}protobuf-java-BSD-3-clause{}}}, {{{}classgraph-MIT{}}},
> {{{}slf4j-MIT{}}}, {{{}jline-BSD-3-clause{}}}, {{{}jopt-simple-MIT{}}},
> {{{}argparse-MIT{}}}, {{{}zstd-jni-BSD-2-clause{}}}.
> * Deleted: {{{}mock-oauth2-server-MIT{}}}, {{{}jsr305-BSD-3-clause{}}},
> {{{}paranamer-BSD-3-clause{}}}, {{{}CDDL+GPL-1.1{}}}.
> h2. Verification
> A fresh {{./gradlew clean releaseTarGz}} on the fix branch confirms the
> change.
> * The third-party jars in {{libs/}} match the entries in {{LICENSE-binary}}
> exactly. Nothing is missing on either side.
> * Every {{licenses/...}} path in {{LICENSE-binary}} exists, and every file
> in {{licenses/}} is referenced.
> * {{jakarta.servlet-api}} is bundled at 6.0.0, as {{LICENSE-binary}} says,
> even though {{dependencies.gradle}} declares 6.1.0. The 6.1.0 declaration
> does not reach the runtime classpath.
> * The tarball's {{licenses/}} now holds 12 files, down from 16.
> h2. How it drifted
> Each problem traces back to one commit. The CI step
> {{committer-tools/verify_license.py}} (KAFKA-17607) only matches jar names in
> {{libs/}} against {{{}LICENSE-binary{}}}, so none of these failed a build.
> ||Date||Commit||What happened||
> |2026-05-07|KAFKA-20555 (#22232)|Removed the EDL 1.0 section and moved
> {{jakarta.activation-api}} and {{jakarta.xml.bind-api}} under CDDL|
> |2025-06-12|KAFKA-19153 (#19938)|Added {{mock-oauth2-server-MIT}} for a
> test-only dependency|
> |2025-02-18/19|#18943, #18950|Removed paranamer and jsr305 from
> {{{}LICENSE-binary{}}}, left their files|
> |2025-01-01|KAFKA-18375 (#18359)|Added {{jakarta.activation-2.0.1}} pointing
> to the non-existent {{{}licenses/jakarta-BSD-3-clause{}}}, and
> {{jakarta.servlet-api-6.0.0}} under CDDL next to {{javax.servlet-api-3.1.0}}|
> |2023-11-29|#14833|Added {{protobuf-java-BSD-3-clause}} with generic wording
> instead of Google's text|
> |2021-04-06|KAFKA-12602 (#10474)|Added argparse and jopt-simple texts copied
> from newer upstream releases than the bundled jars. Later version bumps of
> slf4j, jline and classgraph never refreshed their texts|
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
