pjfanning opened a new issue, #8799: URL: https://github.com/apache/texera/issues/8799
### What happened? The docker-compose convenience tarball bundles two third-party datasets, but its `LICENSE` does not mention them. `apache-texera-<version>-docker-compose.tar.gz` contains: - `examples/datasets/iris-species/Iris.csv` (source: https://www.kaggle.com/datasets/uciml/iris) - `examples/datasets/popular-movies-of-imdb/TMDb_updated.csv` (source: https://www.kaggle.com/datasets/sankha1998/tmdb-top-10000-popular-movies-dataset) Kaggle lists both as CC0. The bundle's `LICENSE` is a copy of `bin/single-node/LICENSE`, which contains only the Apache-2.0 text with no third-party section. No licence texts are shipped in the bundle either. ASF policy requires `LICENSE` to point to every bundled third-party work and its licence. That includes Category A licences such as CC0. Being Category A means the work may be bundled; it does not exempt it from `LICENSE`. Seen while verifying 1.2.1-incubating-RC1. The 1.2.0-incubating release has the same problem. **Expected:** the bundle's `LICENSE` has a third-party section listing both datasets with their source and licence, and the referenced licence text is included in the bundle. **Suggested fix:** 1. Add a third-party section to `bin/single-node/LICENSE` covering both datasets (CC0 1.0), using the in-bundle paths `examples/datasets/...`. 2. Add a CC0 1.0 licence text (e.g. `licenses/LICENSE-CC0-1.0.txt`) and copy it into the bundle in the "Create Docker Compose deployment bundle" step of `.github/workflows/create-release-candidate.yml`. That step currently copies only `LICENSE`, `NOTICE` and `DISCLAIMER`. 3. Make the same change in the root `LICENSE`, because the source tarball ships the same datasets under `bin/single-node/examples/datasets/` and doesn't list them either. **Also worth checking:** Kaggle lists the TMDb dataset as CC0, but it was gathered from TMDb and includes the movie overview text. TMDb's API terms limit redistribution, so the uploader's CC0 claim may not be valid. It's worth confirming that this dataset can be redistributed at all, or replacing it with a dataset whose provenance is clear. ### How to reproduce? ```bash B=https://dist.apache.org/repos/dist/dev/incubator/texera/1.2.1-incubating-RC1 curl -sO $B/apache-texera-1.2.1-incubating-docker-compose.tar.gz tar xzf apache-texera-1.2.1-incubating-docker-compose.tar.gz cd apache-texera-1.2.1-incubating-docker-compose ls examples/datasets/*/ # bundled datasets grep -niE 'cc0|dataset|kaggle' LICENSE # no matches ``` ### Version/Branch 1.2.1-incubating-RC1 (also present in 1.2.0-incubating) ### Commit Hash 3f760c837086efa569b5820dacd60f292d6d4c3a -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
