Skip to content

Build: Clean up shaded-jar LICENSE/NOTICE and add missing third-party notices#16543

Open
wombatu-kun wants to merge 1 commit into
apache:mainfrom
wombatu-kun:issue/16396-shaded-jar-license-notice
Open

Build: Clean up shaded-jar LICENSE/NOTICE and add missing third-party notices#16543
wombatu-kun wants to merge 1 commit into
apache:mainfrom
wombatu-kun:issue/16396-shaded-jar-license-notice

Conversation

@wombatu-kun
Copy link
Copy Markdown
Contributor

Closes #16396

Follow-up to the LICENSE/NOTICE findings from the 1.11.0 RC4 vote thread: https://lists.apache.org/thread/ddw8cvyrvypoolmzhd673s5wglhdpd5f

Strip duplicate license metadata from shaded jars

The shaded bundle/runtime jars add Iceberg's own LICENSE/NOTICE at the jar root via from(projectDir), but the shadow plugin also merges the META-INF/LICENSE* / META-INF/NOTICE* files carried by the shaded dependencies, duplicating the metadata. This excludes those dependency-provided files from the shadowJar of the modules flagged in the thread — iceberg-aws-bundle, iceberg-azure-bundle, iceberg-gcp-bundle, and iceberg-flink-runtime (1.20/2.0/2.1) — keeping only the Iceberg LICENSE/NOTICE at the jar root.

Add missing third-party NOTICE attributions

Per Apache License 2.0 §4(d), redistributed/derived works carry the attribution notices from a bundled dependency's own NOTICE file:

  • Root NOTICE: add Presto and Delta Lake attributions for the code already listed under those projects in the root LICENSE.
  • aws-bundle/NOTICE: add AWS Common Runtime (CRT) for Java and AWS EventStream for Java, whose notices differ from the regular AWS SDK notice already present.
  • azure-bundle/NOTICE: add the Project Reactor (reactor-core, reactor-netty) copyright.

Notes

  • reactor-core/reactor-netty ship no NOTICE file (neither in their jars nor their repos), so a copyright line is added rather than copied NOTICE text.
  • Presto's only notice file covers its t-digest module, which Iceberg does not include, so only a minimal copyright attribution is added.
  • Out of scope: a few dependencies (e.g. analyticsaccelerator-s3) bundle their own root-level LICENSE/NOTICE that the shadow plugin merges through a path that bypasses Gradle's duplicate handling; their content is already aggregated into the bundle NOTICE.

Tests

Built the four shaded jars with the build cache disabled and confirmed via unzip that no META-INF/LICENSE* / META-INF/NOTICE* entries remain and that the new NOTICE content is present in the jar root. checkRuntimeDeps remains green for all four modules. No Java sources changed.

… notices

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

follow up LICENSE/NOTICE fixes from the 1.11.0 RC4 thread

1 participant