dannycjones commented on code in PR #3414:
URL: https://github.com/apache/iceberg-rust/pull/3414#discussion_r4293430239
##########
deny.toml:
##########
@@ -43,3 +47,33 @@ exceptions = [
{ allow = ["MPL-2.0"], crate = "colored" },
{ allow = ["MPL-2.0"], crate = "option-ext" },
]
+
+# Clarifications use a hash to verify if the license file bytes changed.
+# To recompute: uv run dev/release/licenses.py dependencies clarification-hash
<file>
+
+# TODO: zstd-sys 2.1 relicensed the wrapper and bindings to BSD-3-Clause.
+# Transient dependency, drop when we upgrade (likely when we upgrade to Arrow
60).
+# https://github.com/apache/iceberg-rust/issues/3307
+[[licenses.clarify]]
+crate = "zstd-sys"
+expression = "(MIT OR Apache-2.0) AND BSD-3-Clause AND (GPL-2.0-only OR
BSD-3-Clause)"
Review Comment:
Nice catch - wow this complicates things :)
I've found a way to do the attribution in the later PR, not too complicated.
I'll update this expression now.
I will need to hash the C file itself.
The C file's content does change from time to time (twice last year:
https://github.com/facebook/zstd/commits/dev/lib/legacy/zstd_v05.c) - I think
it will be a necessary cost to revalidate when we update zstd unfortunately.
Note, I will include only the one file for now. I think its important that
we understand where we can remove clarifications when the license no longer
applies. New licenses appearing is a moving target which we can't reliably
verify when they're not declared.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
