On Jun 21, 2012, at 12:35 PM, Kevan Miller wrote: > I think Alan's (Kafka's) position is that dependencies don't matter since > they are not distributing binary artifacts.
Dependencies do matter and they need to be checked. IMO, that point is non-negotiable. The point that I'm trying to make is that the *documentation* of these dependencies in the LICENSE and NOTICE is what is vague in the "rules". The previous Kafka release did no such documentation and I'm certain other projects have done this as well. With that said, I am of the same opinion as you, Kevan, and think that they should be documented in LICENSE and NOTICE. However, I don't think that it should hold up this release. > I would agree with Alan, if Kafka source was simply intended to be used in > source form. That's not the case. The Kafka project is designed to be > built/compiled into a distribution. So, IMO, Kafka must document their > dependencies. Note that if Kafka only had compile-time/test-time dependencies > and simply built .jar files (and someone else was responsible for bundling > everything together into a "distribution"), then I'd have a different > opinion. > > In this case, the Kafka source release contains AL v2 licensed source code > along with some binary artifacts under several licenses (you're welcome to > comment on this, also). The Kafka LICENSE/NOTICE files only contain the > licenses for this source code and the binary artifacts contained within the > source release. They don't document the dependencies that they will bundle > into a distribution.
