zeroshade opened a new pull request, #103: URL: https://github.com/apache/terraform-provider-iceberg/pull/103
Closes #101. `LICENSE-binary` / `NOTICE-binary` / `licenses-binary/` describe the third-party code statically linked into the convenience binaries. They were maintained entirely by hand, nothing verified them against what actually ships, and they had drifted. ## The script ``` dev/update_licenses.sh # rewrite LICENSE-binary and licenses-binary/ dev/update_licenses.sh --check # report drift, write nothing, exit 1 ``` Modeled on the equivalent tooling in `arrow-adbc` (`ci/scripts/go_license.sh`, `ci/licenses/README.md`), which uses `go-licenses` for the same reason — Go wheels there, registry binaries here. Design points worth a look during review: - **The inventory comes from `go list -deps` on the main package, not `go.mod`.** That excludes test-only and tooling dependencies that are never distributed, and includes indirect ones — which is exactly the class of change that produced the current drift. - **The set is unioned across all eight `.goreleaser.yml` GOOS/GOARCH pairs.** All eight yield distinct *package* sets (arch-specific assembly), so the matrix is not redundant even though the module set happens to be identical across them today. - **Only a marked region of `LICENSE-binary` is generated.** The Apache text and the trailing "code under a license other than its own module's" section stay hand-written, because that section records file-level provenance (`format.go, in github.com/cockroachdb/apd/v3`) that no tool can recover. For that section the script only insists every nested license file it finds is *mentioned*, and prints the exact line to add. `NOTICE` files are reported the same way, as an advisory. - **Stale-file pruning is scoped to what the script owns.** Ownership is derived from the module list in the previous generated region, so hand-curated files like `LICENSE-go-project.txt` are never touched. - **`dev/licenses/overrides.tsv` pins classifications the tooling gets wrong.** One entry today: `klauspost/compress` ships BSD-3-Clause with the Apache-2.0 text appended, and `go-licenses` only sees the Apache half. Without the override, regeneration would silently drop a license that has to be reproduced. An unmapped SPDX identifier is a hard failure rather than a guess. ## What regenerating found The four missing and six stale modules from the issue, plus three things it did not cover: - `LICENSE-hashicorp-terraform-plugin-log.txt` and `LICENSE-hashicorp-terraform-svchost.txt` had drifted in *content* — newer versions reattribute copyright from HashiCorp to IBM Corp. Byte-level drift like this is invisible to any review of the module list. - Four bundled sub-components under a license other than their own module's, none of them listed: `flate` in `andybalholm/brotli` and `simplelru/list.go` in `golang-lru/v2` (both Go-project BSD-3-Clause), and `s2` and `snappy` in `klauspost/compress` (Snappy-Go BSD-3-Clause). Added by hand to the trailing section, with `LICENSE-klauspost-compress-s2.txt` added because s2's text carries an extra Klaus Post copyright line; `snappy`'s is byte-identical to the existing snapref file. - The NOTICE advisory lists seven modules. I checked each against `NOTICE-binary` and it is accurate as-is — `iceberg-go` is the only one not called out separately, and its NOTICE is covered by the file's own Apache Iceberg header. `--check` is now clean and the script is idempotent. ## Not included The issue offers three options for wiring this up. This PR takes **option 3** — a bullet in `docs/releasing.md` under "Preparing for a Release". **Option 1** (a `go-ci.yml` step) is a separate call: `--check` is the entry point and takes roughly 100s for the full matrix, trimmable via `LICENSE_PLATFORMS`. Happy to add it here if reviewers would rather catch this per-PR. --- Written with Claude, reviewed by a human. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
