This is a walk through for verifying and updating the LICENSE/NOTICE files for our project.
The top of the repository should have a LICENSE/NOTICE combination that covers the source of the project. It should not include any information for the binary artifacts.
Note that if some third party source code is included in our repository you should also ensure that whichever binary artifacts are generated from the source are also updated to include LICENSE/NOTICE changes.
Currently our only bundled third party sources are some test files for the SOLR sink. The files are covered under the 2-Clause BSD license, so they must be noted in our top level LICENSE and in the LICENSE file included in the flume-ng-morphline-solr-sink module's test-jar artifact.
Ensure our top level pom defines both a top level inceptionYear element and a project.build.outputTimestamp property that is set to the year for the creating the release. These two values are used by the build tooling to set an appropriate copyright notice on our generated artifacts in their respective NOTICE files. Note that during release candidate building the maven-release-plugin should take care of updating the project's build output timestamp.
Any generated jars that include third party dependencies via the build process will need to be checked for appropriately maintaining LICENSE/NOTICE files.
You can generate a current alphabetized list of the bundled dependencies with these steps for a given module:
% mvn -pl flume-ng-clients/flume-ng-log4jappender dependency:list -DincludeScope=runtime -DoutputFile=dep-list.out % cat flume-ng-clients/flume-ng-log4jappender/dep-list.out | tail -n +3 | sort -t: -k2 > flume-ng-clients/flume-ng-log4jappender/target/flume-ng-log4jappender-deplist.out
Use this list to compare to the following list of artifacts and make any needed changes to the LICENSE and NOTICE files in the module's directory src/main/appended-resources/META-INF/. These files do not need to include the ALv2 license nor the boilerplate module name and copyright statement because the build will fill them in.
You can generate a current alphabetized list of the bundled dependencies with these steps (be sure to substitute the project version for <version> below):
% ls -1 flume-ng-dist/target/apache-flume-<version>-bin/apache-flume-<version>-bin/lib/ \ flume-ng-dist/target/apache-flume-<version>-bin/apache-flume-<version>-bin/tools \ | sort > flume-ng-dist/target/flume-ng-dist-deplist.out
Use this list to compare to the following list of artifacts and make any needed changes to the NOTICE and LICENSE files in the module's directory src/main/appended-resources/META-INF/. This file do not need to include the ALv2 license because the build will fill it in.
Note that where appropriate this list says “same as jar-with-dependencies” for information that should be copied from a the jars with bundled dependencies above.
async-1.4.0.jar
3-Clause BSD. Entry in License.
asynchbase-1.8.2.jar
3-Clause BSD. Entry in License.
audience-annotations-0.5.0.jar
ALv2. Entry in NOTICE.
avro-1.11.0.jar avro-ipc-1.11.0.jar avro-ipc-jetty-1.11.0.jar avro-ipc-netty-1.11.0.jar
same as jar-with-dependencies
commons-cli-1.5.0.jar
ALv2. Entry in NOTICE.
commons-codec-1.15.jar
same as jar-with-dependencies
commons-collections-3.2.2.jar
ALv2. Entry in NOTICE.
commons-compress-1.21.jar
same as jar-with-dependencies
commons-dbcp-1.4.jar
ALv2. Entry in NOTICE.
commons-io-2.11.0.jar
ALv2. Entry in NOTICE.
commons-lang-2.6.jar
same as jar-with-dependencies
commons-lang3-3.11.jar
same as jar-with-dependencies
commons-logging-1.2.jar
same as jar-with-dependencies
commons-pool-1.5.4.jar
ALv2. Entry in NOTICE.
commons-text-1.9.jar
ALv2. Entry in NOTICE.
curator-client-5.1.0.jar curator-framework-5.1.0.jar curator-recipes-5.1.0.jar
ALv2. Entry in NOTICE
derby-10.14.1.0.jar
ALv2. Entry in NOTICE. Additional entry for IBM copyrights. Remainder of the derby NOTICE is not relevant.
flume-avro-source-<version>.jar flume-file-channel-<version>.jar flume-hdfs-sink-<version>.jar flume-hive-sink-<version>.jar flume-http-sink-<version>.jar flume-irc-sink-<version>.jar flume-jdbc-channel-<version>.jar flume-jms-source-<version>.jar flume-kafka-channel-<version>.jar flume-kafka-source-<version>.jar flume-ng-auth-<version>.jar flume-ng-config-filter-api-<version>.jar flume-ng-configuration-<version>.jar flume-ng-core-<version>.jar flume-ng-embedded-agent-<version>.jar flume-ng-environment-variable-config-filter-<version>.jar flume-ng-external-process-config-filter-<version>.jar flume-ng-hadoop-credential-store-config-filter-<version>.jar flume-ng-hbase-sink-<version>.jar flume-ng-hbase2-sink-<version>.jar flume-ng-kafka-sink-<version>.jar flume-ng-log4jappender-<version>-jar-with-dependencies.jar flume-ng-log4jappender-<version>.jar flume-ng-morphline-solr-sink-<version>.jar flume-ng-node-<version>.jar flume-ng-sdk-<version>.jar flume-scribe-source-<version>.jar flume-shared-kafka-<version>.jar flume-spillable-memory-channel-<version>.jar flume-taildir-source-<version>.jar flume-thrift-source-<version>.jar flume-tools-<version>.jar flume-twitter-source-<version>.jar
ALv2. Entry in NOTICE.
gson-2.2.2.jar
ALv2. No NOTICE.
guava-11.0.2.jar
ALv2. No NOTICE.
httpclient-4.5.13.jar
same as jar-with-dependencies
httpcore-4.4.15.jar
same as jar-with-dependencies
irclib-1.10.jar
ALv2. No NOTICE.
jackson-annotations-2.13.2.jar jackson-core-2.13.2.jar jackson-databind-2.13.2.1.jar jackson-dataformat-csv-2.10.5.jar jackson-datatype-jdk8-2.10.5.jar
same as jar-with-dependencies
javax.annotation-api-1.3.2.jar
same as jar-with-dependencies
javax.servlet-api-3.1.0.jar
CDDL v1.0. Entry in LICENSE and NOTICE.
BSD-like project specific. Entry in LICENSE and NOTICE.
jetty-http-9.4.51.v20230217.jar jetty-io-9.4.51.v20230217.jar jetty-jmx-9.4.51.v20230217.jar jetty-security-9.4.51.v20230217.jar jetty-server-9.4.51.v20230217.jar jetty-servlet-9.4.51.v20230217.jar jetty-util-9.4.51.v20230217.jar jetty-util-9.4.51.v20230217.jar
ALv2. Entry in NOTICE. Additional entry for UnixCrypt.
ALv2. Entry in NOTICE.
jopt-simple-5.0.4.jar
MIT. Entry in LICENSE.
jsr305-1.3.9.jar
BSD 3-Clause. Entry in LICENSE. Artifact is the JS305 RI published by Findbugs.
jzlib-1.1.3.jar
same as jar-with-dependencies
kafka-clients-3.3.1.jar kafka-raft-3.3.1.jar kafka_2.13-3.3.1.jar
ALv2. Entry in NOTICE. Additional entry in NOTICE and LICENSE for PureJavaCrc32C; portions 2-Clause BSD.
libthrift-0.14.2.jar
same as jar-with-dependencies
log4j-1.2-api-2.17.1.jar log4j-api-2.17.1.jar log4j-core-2.17.1.jar log4j-slf4j-impl-2.17.1.jar
ALv2. Entry in NOTICE. Additional entries for ResolverUtil, TypeUtil, PicoCLI.
lz4-java-1.7.1.jar
ALv2. No NOTICE.
mapdb-0.9.9.jar
ALv2. No NOTICE.
metrics-core-2.2.0.jar
ALv2. Entry in NOTICE. LICENSE entry for JSR-166 in Public Domain.
metrics-core-4.1.18.jar
ALv2. No NOTICE.
mina-core-2.1.5.jar
ALv2. Entry in NOTICE.
netty-3.9.4.Final.jar netty-all-4.1.72.Final.jar netty-buffer-4.1.68.Final.jar netty-codec-4.1.72.Final.jar netty-codec-dns-4.1.72.Final.jar netty-codec-haproxy-4.1.72.Final.jar netty-codec-http-4.1.72.Final.jar netty-codec-http2-4.1.72.Final.jar netty-codec-memcache-4.1.72.Final.jar netty-codec-mqtt-4.1.72.Final.jar netty-codec-redis-4.1.72.Final.jar netty-codec-smtp-4.1.72.Final.jar netty-codec-socks-4.1.72.Final.jar netty-codec-stomp-4.1.72.Final.jar netty-codec-xml-4.1.72.Final.jar netty-common-4.1.72.Final.jar netty-handler-4.1.68.Final.jar netty-handler-proxy-4.1.72.Final.jar netty-resolver-4.1.72.Final.jar netty-resolver-dns-4.1.72.Final.jar netty-resolver-dns-classes-macos-4.1.72.Final.jar netty-resolver-dns-native-macos-4.1.72.Final-osx-aarch_64.jar netty-resolver-dns-native-macos-4.1.72.Final-osx-x86_64.jar netty-tcnative-classes-2.0.46.Final.jar netty-transport-4.1.72.Final.jar netty-transport-classes-epoll-4.1.72.Final.jar netty-transport-classes-kqueue-4.1.72.Final.jar netty-transport-native-epoll-4.1.50.Final.jar netty-transport-native-epoll-4.1.72.Final-linux-aarch_64.jar netty-transport-native-epoll-4.1.72.Final-linux-x86_64.jar netty-transport-native-kqueue-4.1.72.Final-osx-aarch_64.jar netty-transport-native-kqueue-4.1.72.Final-osx-x86_64.jar netty-transport-native-unix-common-4.1.72.Final.jar netty-transport-rxtx-4.1.72.Final.jar netty-transport-sctp-4.1.72.Final.jar netty-transport-udt-4.1.72.Final.jar
same as jar-with-dependencies, additional copyright year for netty-3.9.4.
protobuf-java-2.5.0.jar
3-Clause BSD. Entry in LICENSE.
slf4j-api-1.7.32.jar
same as jar-with-dependencies
snappy-java-1.1.8.4.jar
same as jar-with-dependencies
tomcat-annotations-api-8.5.46.jar tomcat-embed-core-8.5.46.jar
same as jar-with-dependencies
velocity-engine-core-2.3.jar
same as jar-with-dependencies
xz-1.9.jar
same as jar-with-dependencies
zookeeper-3.6.2.jar zookeeper-jute-3.6.2.jar
ALv2. Entry in NOTICE. Additional entry for Airlift.
zstd-jni-1.4.5-6.jar
same as jar-with-dependencies