amaechler opened a new pull request, #20671: URL: https://github.com/apache/druid/pull/20671
### Description The binary tarball's `README` ends with a "Licenses" section built from the hand-maintained `LABELS` file. It is the label the [ASF third-party license policy](https://www.apache.org/legal/resolved.html#category-b) asks for when a release bundles Category B (weak copyleft) binaries: each component, its license and its homepage. `LABELS` had drifted far from what ships. It listed Rhino 1.7R5 (1.9.1 ships), three Jersey 1.x versions that do not ship, Font Awesome, Aether and several other jars that are no longer in the tarball, and pointed at license files that do not exist. It also missed most of the CDDL, EPL and MPL components that do ship. This PR generates the label from `licenses.yaml` at dist time, so it follows the same registry as `LICENSE.BINARY`, and fixes the `licenses.yaml` entries that no longer matched the binary. <details> Luckily, the whole analysis and scripting update was a relative trivial change with the help of Claude. Details regarding the updates: #### Generate the README label from licenses.yaml - `generate-binary-license.py` takes a new `--labels-path` option and writes the label from the same filtered entries it uses for `LICENSE.BINARY`: every binary entry whose `license_name` is a CDDL, EPL, MPL or SIL OFL license, in any spelling `check-licenses.py` accepts. - Those entries need a new `homepage` field. The script fails if one is missing, so a new weak-copyleft dependency without a homepage fails the packaging check in CI. `LICENSE.BINARY` also shows the homepage for these entries. - The dist profile writes the label to `distribution/target/LABELS`, and `README.BINARY` is concatenated from `README` and that file. The root `LABELS` file is deleted. The `bundle-contrib-exts` override passes the option too, and the contrib entries have homepages. - The label follows the license recorded in `licenses.yaml`. A component that is also offered under a Category A license (Jetty, JTS, Javassist) stays labelled as long as its entry names the Category B license. Vert.x is recorded as Apache 2.0, so it is not. - Homepages come from each artifact's POM `url`. Where that site is gone (`jersey.java.net`, `jsr311.dev.java.net`, `java.net`), the project's GitHub repository is used instead. - `web-console/script/licenses` regenerates the web-console block of `licenses.yaml`. It now emits the `@fontsource/open-sans` homepage through its existing `extraLinesForLib` hook. - `dev/license.md` documents the new field. #### Fix licenses.yaml entries that do not match the binary Claude compared every CDDL, EPL and MPL entry with the jars in a `-Pdist` tarball, and every jar in the tarball with the licenses declared in its POM. - Removed entries for jars that ship nowhere: `javax.mail` and `javax.activation:activation` (druid-pac4j), `javax.ws.rs-api`, `jakarta.ws.rs-api` and `jaxb-impl` (druid-avro-extensions), `com.sun.activation:javax.activation` and `stax-ex`, the `com.sun.jersey:contribs` POM, Eclipse Aether, Tesla Aether and the OkHttp Aether connector, and JUnit 4. - Moved `osgi-resource-locator`, `jakarta.inject` and `jakarta.annotation-api` 1.3.5 to druid-kerberos, and `javax.annotation-api` 1.3.2 to druid-kubernetes-extensions, where they ship. - Excluded druid-testcontainers from `LICENSE.BINARY` and `NOTICE.BINARY`. It is published to Maven but not bundled in the binary, and its entries stay in `licenses.yaml` for `check-licenses.py`. - Added the missing `licenses/bin/graal.UPL` and removed the license files that no entry references any more. #### Remove the unused Aether dependency management `PullDependencies` uses Maven Resolver 2.x. The `io.tesla.aether` and `org.eclipse.aether` dependency management, the `aether.version` property and an `aether-api` exclusion in `services` no longer apply to any module. #### Keep POM-type dependencies out of lib/ `org.graalvm.js:js` is a POM-only aggregator declared with `<type>pom</type>`, and the `lib/` dependency set copied it, so `lib/js-25.3.4.1.pom` shipped next to the jars. The assembly now excludes all pom-type artifacts from `lib/`. Their transitive jars still ship. #### Verification - `-Pdist` builds before and after each change: the tarball's file list changes only by the removed `.pom` and license files. The shipped `README` label matches the generator output and lists 28 components. - `check-licenses.py` passes on fresh dependency reports. It reports 16 fewer registered-but-unused entries than on master, exactly the ones removed here. - A non-dist build still passes with no `distribution/target` or `README` present. </details> <hr> ##### Key changed/added files in this PR * `distribution/bin/generate-binary-license.py` * `distribution/pom.xml` * `distribution/src/assembly/assembly.xml` * `licenses.yaml` * `LABELS` (deleted) <hr> This PR has: - [x] been self-reviewed. - [x] added documentation for new or modified features or behaviors. - [x] added or updated version, license, or notice information in [licenses.yaml](https://github.com/apache/druid/blob/master/dev/license.md) - [x] added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
