HADOOP-16895. [thirdparty] Revisit LICENSEs and NOTICEs

[vinayakumarb]

No description provided.

[vinayakumarb]

@aajisaka Could you please review this?

[aajisaka]

Source release

We don't have to include the dependencies in LICENSE and NOTICE files.

Binary release

LICENSE-binary and NOTICE-binary should contain protobuf, jaegartracing, and all their dependencies (such as gson). In addition, we should include LICENSE-binary and NOTICE-binary files in the jar files.

Details: http://www.apache.org/dev/licensing-howto.html

[aajisaka]

FYI: apache/hbase-thirdparty@0a39137

[vinayakumarb]

Thanks @aajisaka, I will update accordingly.

[vinayakumarb]

@aajisaka Updated the PR to include License-binary and NOTICE-binary as LICENCE.txt and NOTICE.txt and all other Non-ALV2 licenses under /META-INF/licences-binary inside shaded jars.

Please review.

[aajisaka]

+1
Hi @elek, would you check this?

[elek]

Thank you very much to create this patch @vinayakumarb.

TLDR; Overall it looks good to me, but I would do a cp NOTICE.txt NOTICE-binary.

In more details:

I learned all of my knowledge about licensing from the workshops from Justin Mclean. I might be wrong (If I misunderstood something), but here is what is my understanding.

1. source package: we don't package any external code here (ideally Yetus is excluded), so the current LICENSE/NOTICE looks good.

2. binary packages: we don't have the traditional tar binary package, just maven artifacts.

As a main rule, we need separated LICENSE.txt and mention the LICENSE of all the included files

Current approach seems to be fine:

unzip -l hadoop-shaded-jaeger/target/hadoop-shaded-jaeger-1.1.0-SNAPSHOT.jar

unzip -p hadoop-shaded-jaeger/target/hadoop-shaded-jaeger-1.1.0-SNAPSHOT.jar META-INF/LICENSE.txt

unzip -l hadoop-shaded-protobuf_3_7/target/hadoop-shaded-protobuf_3_7-1.1.0-SNAPSHOT.jar

unzip -p hadoop-shaded-protobuf_3_7/target/hadoop-shaded-protobuf_3_7-1.1.0-SNAPSHOT.jar META-INF/LICENSE.txt

They seems to be in sync, I can see only packages which are mentioned in the LICENSE.

binary licenses are also included:

unzip -l hadoop-shaded-protobuf_3_7/target/hadoop-shaded-protobuf_3_7-1.1.0-SNAPSHOT.jar | grep lice

Strictly speaking we have no protobuf in the jaeger jar and no jaeger in the protobuf file but I don't think it's a big problem.

3. NOTICE file

We maintain NOTICE file only because it should be done according to the ASF license:

4.d If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear

1. We don't need to do anything with an external NOTICE file if we use something which is not under Apache license. (BSD, MIT licenses don't ask us to do anything. We don't need to add any content).
2. If the used library is Apache AND it contains a NOTICE, we should copy the content of the external NOTICE to our NOTICE.

As I see we use multiple Apache dependencies, but I can't see a NOTICE in any of them. Therefore we can keep NOTICE-binary as empty as the NOTICE of the src.

(Strictly speaking there is one other usage of NOTICE. During the donation of the code to Apache, some notices from the sources can be moved to the NOTICE file, but it almost never happens...)

[vinayakumarb]

Thanks @elek
I have made NOTICE-binary 'lightweight' by removing 'non-mandatory' mentions of all 3rd-party dependencies.

• Apache Thrift and Kotlin do provide NOTICE files. So copied kept those contents alone in NOTICE-binary.
• jetbrains' java-annotation alone have copyright mention in their ALv2 txt, so copied entire licence under licences-binary.
• keeping both NOTICE.txt and NOTICE-binary in jars.

Hope I have addressed all your concerns. Please review.

[elek]

+1 LGTM

Thanks the update @vinayakumarb You were more precious than me.

Will commit this tomorrow morning if nobody else.

[vinayakumarb]

Thanks @elek and @aajisaka for reviews. Merged this to trunk and will cherry-pick to branch-1.0 for another RC

[elek]

Thank you very much the work @vinayakumarb (And sorry for the occasionally delayed answer...)