amaechler opened a new pull request, #20690: URL: https://github.com/apache/druid/pull/20690
### Description Follow-up to #20671. 71 files under `licenses/bin` are not referenced by any `licenses.yaml` entry, `LICENSE.BINARY` line or script. The assembly copies `licenses/**` wholesale, so they still ship in the binary tarball. This PR deletes them and changes nothing else. #### How the files were found For each file in `licenses/bin`, `git grep -F <basename> -- . ':!licenses/bin'` returned nothing. I also checked the places that could reference a file by pattern rather than by name: - `web-console/script/licenses` writes `licenses/bin/<name>.<ext>` only for production dependencies (`production: true`) and records the path in the web-console block of `licenses.yaml`. Of the deleted files, 19 belong to packages that are now dev-only, 8 are `d3-*.BSD3` files whose packages are ISC now and already have `d3-*.ISC` files, and the remaining 44 match no package in `package-lock.json` (Java-side files such as `old-jaxb.CDDL11` and `leveldbjni.BSD3`, plus old web-console packages such as `font-awesome.MIT`). - `distribution/src/assembly/assembly.xml` includes `licenses/**` with no per-file references. - `generate-binary-license.py` reads `license_file_path` from `licenses.yaml` only. #### Where the files came from Most of these files were added in #7026 and #7998 when the binary license files were first assembled, or by `web-console/script/licenses` as web-console dependencies came and went. That script rewrites the web-console block of `licenses.yaml` but never deletes a license file, so each dependency bump that dropped a package (for example #16756, the Blueprint 5 upgrade) left its file behind. On the Java side, #8306, #8078 and #15446 removed the `licenses.yaml` entries for Jersey JSON, old JAXB, Scala, JLine, jopt-simple and xmlenc but kept their files. Five files (`font-awesome.SIL-OFL`, `leveldbjni.BSD3`, `javax-el.CDDL11`, `javax.el-api.CDDL11`, `javax.servlet-api.CDDL11`) were never referenced, because `LICENSE.BINARY` pointed at other names from the start. The only one of these dependencies that still ships is Servlet API 4.0.1, and its entry points at `licenses/bin/javax.CDDL11`, which has the same CDDL 1.1 text. #### Testing Built the `-Pdist` tarball before and after: the file lists differ only by the 71 removed files. `distribution/bin/check-licenses.py` passes. #### Release note The binary distribution no longer ships 71 license files that no bundled dependency references. <hr> This PR has: - [x] been self-reviewed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
