andygrove opened a new issue, #7383: URL: https://github.com/apache/datafusion-comet/issues/7383
## What is the problem? While verifying 1.2.0-rc1, two omissions were found in the license text shipped inside the JARs: lz4_flex (MIT) and Zstandard (BSD-3-Clause). #7382 adds those two. It does not audit the rest of what `libcomet` statically includes. ## What needs to be done? Audit the Rust dependency tree that ends up in `libcomet` and make sure every bundled component's license and copyright text reaches `META-INF/LICENSE` (and NOTICE where the license requires it) in the main and sources JARs. Known candidates beyond lz4_flex and Zstandard: - the Rust `zstd`, `zstd-safe` and `zstd-sys` crates (MIT/Apache) - the other MIT/BSD/zlib-licensed crates pulled in by `parquet` and the rest of the native workspace Prefer generating the text from `native/Cargo.lock` with a tool such as `cargo-about` rather than maintaining it by hand, so the versions named in the license cannot drift from the lock file. `dev/ensure-jars-have-correct-contents.sh` could then verify the result. Follow-up to #7382. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
