Repository navigation
Conversation
The source release bundles no third-party code: there is no vendor/ directory, so LICENSE and NOTICE describe the source tree correctly. The convenience binary packages are a different artifact. They are statically linked Go binaries and therefore physically contain the code of every module in the build graph, plus the Go runtime and standard library and, because CGO is enabled for SQLite support, the SQLite amalgamation. Until now `make package` copied the source LICENSE and NOTICE verbatim into those packages, where the only third-party component listed is the Greenplum-derived code. That describes neither the 53 Go modules linked into the binaries nor the NOTICE files that eight of them ship, which the Apache License 2.0 requires us to propagate in section 4(d). Add the -binary variants, following the convention used by Apache Spark, Apache Kafka and apache/cloudberry#1994: LICENSE-binary -> installed as LICENSE NOTICE-binary -> installed as NOTICE licenses-binary/ -> installed as licenses/ They are generated by scripts/generate-binary-license.sh rather than maintained by hand. The script resolves the modules actually linked into each shipped binary on each released platform, so test-only dependencies such as Ginkgo and Gomega are left out, while platform-gated modules that appear only on Linux are included. A dependency bump that changes the inventory is caught by the new binary-license-check CI job, which runs the script with --check. The reproduced license texts carry their own upstream copyright notices and must not be given ASF headers, so they are excluded from the RAT scan. Verified against the actual artifacts: building the packages on Linux and reading the module list back out of the six shipped binaries with `go version -m` matches LICENSE-binary exactly, module for module and version for version. Backpatch-through: REL_2_STABLE
…files The inventory in LICENSE-binary is not a dependency list. What puts a component on it is that its compiled code is physically inside the shipped artifact, which for statically linked Go binaries means every module in the build graph, the Go runtime and, through cgo, the SQLite amalgamation. "Linked into the binaries" was a poor way to say that, because it reads just as naturally as "dynamically linked", which is the one case that does *not* belong on the list: the system C library is resolved from the host at run time, is not packaged with the binaries, and is correctly absent. Say "bundled" instead, and state the criterion and that exclusion outright, so a reviewer does not have to infer either. No change to which components are listed. Backpatch-through: REL_2_STABLE
NOTICE-binary is generated with NOTICE as its preamble, so dropping the license boilerplate from our own VMware attribution changes it too. The boilerplate that remains further down belongs to bundled third-party components and is reproduced from their own NOTICE files, which is what section 4(d) of the Apache License 2.0 asks for and what Apache Spark and Apache Kafka do with the one such case each of them carries. It is not ours to edit. Backpatch-through: REL_2_STABLE
cloudberry-go-libs carried the same VMware attribution that the Apache Incubator flagged on the Cloudberry 2.2.0-rc1 vote: a copyright notice followed by the full Apache License 2.0 boilerplate. Upstream has since dropped the boilerplate, in 0e762c9. We reproduce that NOTICE verbatim into NOTICE-binary under section 4(d), so the only way to fix our copy is to pick up theirs. Bump the dependency and regenerate. The range 3de23e2..0e762c9 changes no Go source: a release script, the NOTICE fix, and an x/net bump in go-libs' own go.mod that we already satisfy at v0.55.0. No other module moves in go.sum. The Apache boilerplate that remains in NOTICE-binary belongs to gopkg.in/yaml.v2 and go.yaml.in/yaml/v2, is written by Canonical in their own NOTICE, and is reproduced verbatim as section 4(d) requires. Apache Spark and Apache Kafka carry the equivalent scala-xml and Scala notices the same way. Backpatch-through: REL_2_STABLE
b345fb6 to
1498ae9
Compare
There was a problem hiding this comment.
Thanks for this compliance PR — overall it's high quality. The core approach is right: instead of listing dependencies from go.mod, it resolves the modules actually linked into each shipped binary from the real build graph (go list -tags -deps) and takes the union across release platforms. Docs, the CI --check job, and the RAT exclusions are all handled. I also verified that the script's PLATFORMS matches package-all and the release workflow (linux amd64/arm64 only, no darwin — the macOS mention in the description just illustrates why the union logic is needed).
One real script bug is flagged inline (the undefined variable in the UNKNOWN branch). Two more points for discussion:
scope: go.mod/go.sum also bumps cloudberry-go-libs (20260624… → 20260915…), which is unrelated to adding binary license files. Folding a dependency bump into a pure compliance PR makes it hard to tell intent from rebase noise, and it changes the LICENSE-binary inventory as well. Consider splitting it out or noting it in the description.
nits:
- In
has_multiple_licenses(),entryinlocal … entry patternis declared but unused. - The
sort -uonNOTICES:MODULESis already deduplicated and each module is iterated once, so there can be no duplicates here — harmless but redundant.
Nicely done: classify_license picks the primary license by the earliest-appearing marker line, which correctly handles cases like klauspost/compress (a BSD body with Apache/MIT appended for vendored parts); and non-module linked components (Go runtime, SQLite) are listed separately.
|
|
||
| if [[ "${primary}" == "UNKNOWN" ]]; then | ||
| echo "ERROR: could not classify the license of ${mod} ${ver}" >&2 | ||
| echo " inspect ${license_files[0]} and extend classify_license()" >&2 |
There was a problem hiding this comment.
${license_files[0]} is an undefined variable. The script uses license_list (a file path) and the loop variable lf throughout — license_files as an array is never defined.
Since the script starts with set -euo pipefail (including -u), as soon as a dependency's license can't be classified and this UNKNOWN branch is hit, ${license_files[0]} aborts with license_files[0]: unbound variable instead of printing the intended inspect <file> hint — a misleading error exactly when a clear diagnostic is most needed.
Suggest pointing at the actual license directory, e.g.:
echo " inspect the license files under ${dest_dir} and extend classify_license()" >&2(or ${license_list}.)
talmacschen-arch
left a comment
talmacschen-arch
left a comment
There was a problem hiding this comment.
Approving to signal support for this change — the approach is sound and the compliance files are generated from the real build graph rather than hand-maintained. See my earlier review for details; the only real issue is the undefined license_files variable in the UNKNOWN branch (minor, error-path only). Thanks for taking care of binary-package compliance.
The source release bundles no third-party code: there is no vendor/ directory, so LICENSE and NOTICE describe the source tree correctly. The convenience binary packages are a different artifact. They are statically linked Go binaries and therefore physically contain the code of every module in the build graph, plus the Go runtime and standard library and, because CGO is enabled for SQLite support, the SQLite amalgamation.
Until now
make packagecopied the source LICENSE and NOTICE verbatim into those packages, where the only third-party component listed is the Greenplum-derived code. That describes neither the 53 Go modules linked into the binaries nor the NOTICE files that eight of them ship, which the Apache License 2.0 requires us to propagate in section 4(d).Add the -binary variants, following the convention used by Apache Spark, Apache Kafka and apache/cloudberry#1994:
They are generated by scripts/generate-binary-license.sh rather than maintained by hand. The script resolves the modules actually linked into each shipped binary on each released platform, so test-only dependencies such as Ginkgo and Gomega are left out, while platform-gated modules that appear only on Linux are included. A dependency bump that changes the inventory is caught by the new binary-license-check CI job, which runs the script with --check.
The reproduced license texts carry their own upstream copyright notices and must not be given ASF headers, so they are excluded from the RAT scan.
Verified against the actual artifacts: building the packages on Linux and reading the module list back out of the six shipped binaries with
go version -mmatches LICENSE-binary exactly, module for module and version for version.Backpatch-through: REL_2_STABLE
closes: #ISSUE_Number
Change logs
Contributor's checklist
Here are some reminders before you submit your pull request: