Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Please include LICENSE file under META-INF/ in the release jars #6468

Closed
vlsi opened this issue May 2, 2023 · 1 comment
Closed

Please include LICENSE file under META-INF/ in the release jars #6468

vlsi opened this issue May 2, 2023 · 1 comment
Assignees
Labels
P2 status=in-progress type=other Miscellaneous activities not covered by other type= labels

Comments

@vlsi
Copy link

vlsi commented May 2, 2023

The current release jars miss META-INF/LICENSE.
For instance, see https://repo1.maven.org/maven2/com/google/guava/guava/31.1-jre/ -> guava-31.1-jre.jar

% unzip -l guava-31.1-jre.jar  | grep META-INF
     2578  02-28-2022 16:18   META-INF/MANIFEST.MF
        0  02-28-2022 16:18   META-INF/
        0  02-28-2022 16:18   META-INF/maven/
        0  02-28-2022 16:18   META-INF/maven/com.google.guava/
        0  02-28-2022 16:18   META-INF/maven/com.google.guava/guava/
      133  02-28-2022 16:18   META-INF/maven/com.google.guava/guava/pom.properties
    10981  02-28-2022 16:06   META-INF/maven/com.google.guava/guava/pom.xml

The license requires to give a copy of the license when redistributing the software:

See https://www.apache.org/licenses/LICENSE-2.0
4.a You must give any other recipients of the Work or Derivative Works a copy of this License; and

Even though the jar file includes a link to http://www.apache.org/licenses/LICENSE-2.0.txt, the link is not a copy as the link might become inaccessible, so the recipients might fail to receive "a copy of the License".

I suggest including the license file as META-INF/LICENSE.

By the way, Google Guice does include the license (Apache-2.0) as META-INF/LICENSE: https://repo1.maven.org/maven2/com/google/inject/guice/5.1.0/

Just in case, here's the opinion of the Apache Software Foundation: https://issues.apache.org/jira/browse/LEGAL-642

@eamonnmcmanus eamonnmcmanus added status=triaged type=other Miscellaneous activities not covered by other type= labels P3 labels May 2, 2023
@cpovirk
Copy link
Member

cpovirk commented May 3, 2023

Thanks, especially for the Guice reference. I haven't found any docs inside Google that speak directly to this, but I'll get this in place for Guava and some of the other libraries we're involved with.

copybara-service bot pushed a commit that referenced this issue May 8, 2023
Fixes #6468

I'd looked at [how Guice does this](https://github.com/google/guice/blob/40a5bcfab5cfe45c3b6c5ffc9309b310df82775b/pom.xml#L255-L273), which pulls the Apache license from a remote server (and also generates additional `DEPENDENCIES` and `NOTICE` files). But I figured it was simplest to just point `maven-resources-plugin` at our local `LICENSE` file: `maven-resources-plugin` can work with any license, whereas I'm not sure if Guice's `apache-jar-resource-bundle` approach can. Plus, I want to figure `maven-resources-plugin` out, anyway, for [Proguard purposes](#2117).

Conveniently, I'm pretty confident that our existing `resources` configuration isn't necessary: Maybe it was years ago, but nowadays, we have no results for `find */src android/*/src -type f -not -name '*.java'` (except under `guava-gwt`, which overrides `resources` and which I verified builds an identical jar after this change).

RELNOTES=n/a
PiperOrigin-RevId: 530338363
copybara-service bot pushed a commit to google/escapevelocity that referenced this issue May 8, 2023
copybara-service bot pushed a commit to google/guava-beta-checker that referenced this issue May 8, 2023
copybara-service bot pushed a commit to google/compile-testing that referenced this issue May 8, 2023
copybara-service bot pushed a commit to google/jimfs that referenced this issue May 8, 2023
copybara-service bot pushed a commit to google/truth that referenced this issue May 8, 2023
copybara-service bot pushed a commit to google/compile-testing that referenced this issue May 9, 2023
See google/guava#6468 and google/guava#6477.

I cowardly did not look into Auto and its many pom.xml files. And I gave up on jimfs when its jar didn't end up containing the license... maybe somehow related to how it has other files autogenerated into `META-INF`??

RELNOTES=n/a
PiperOrigin-RevId: 530400894
copybara-service bot pushed a commit to google/guava-beta-checker that referenced this issue May 9, 2023
See google/guava#6468 and google/guava#6477.

I cowardly did not look into Auto and its many pom.xml files. And I gave up on jimfs when its jar didn't end up containing the license... maybe somehow related to how it has other files autogenerated into `META-INF`??

RELNOTES=n/a
PiperOrigin-RevId: 530400894
copybara-service bot pushed a commit to google/escapevelocity that referenced this issue May 9, 2023
See google/guava#6468 and google/guava#6477.

I cowardly did not look into Auto and its many pom.xml files. And I gave up on jimfs when its jar didn't end up containing the license... maybe somehow related to how it has other files autogenerated into `META-INF`??

RELNOTES=n/a
PiperOrigin-RevId: 530400894
copybara-service bot pushed a commit to google/truth that referenced this issue May 9, 2023
See google/guava#6468 and google/guava#6477.

I cowardly did not look into Auto and its many pom.xml files. And I gave up on jimfs when its jar didn't end up containing the license... maybe somehow related to how it has other files autogenerated into `META-INF`??

RELNOTES=n/a
PiperOrigin-RevId: 530400894
copybara-service bot pushed a commit to google/compile-testing that referenced this issue May 9, 2023
See google/guava#6468 and google/guava#6477.

I cowardly did not look into Auto and its many pom.xml files. And I gave up on jimfs when its jar didn't end up containing the license... maybe somehow related to how it has other files autogenerated into `META-INF`??

RELNOTES=n/a
PiperOrigin-RevId: 530613491
copybara-service bot pushed a commit to google/truth that referenced this issue May 9, 2023
See google/guava#6468 and google/guava#6477.

I cowardly did not look into Auto and its many pom.xml files. And I gave up on jimfs when its jar didn't end up containing the license... maybe somehow related to how it has other files autogenerated into `META-INF`??

RELNOTES=n/a
PiperOrigin-RevId: 530613491
copybara-service bot pushed a commit to google/guava-beta-checker that referenced this issue May 9, 2023
See google/guava#6468 and google/guava#6477.

I cowardly did not look into Auto and its many pom.xml files. And I gave up on jimfs when its jar didn't end up containing the license... maybe somehow related to how it has other files autogenerated into `META-INF`??

RELNOTES=n/a
PiperOrigin-RevId: 530613491
copybara-service bot pushed a commit to google/escapevelocity that referenced this issue May 9, 2023
See google/guava#6468 and google/guava#6477.

I cowardly did not look into Auto and its many pom.xml files. And I gave up on jimfs when its jar didn't end up containing the license... maybe somehow related to how it has other files autogenerated into `META-INF`??

RELNOTES=n/a
PiperOrigin-RevId: 530613491
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
P2 status=in-progress type=other Miscellaneous activities not covered by other type= labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants