[jira] [Created] (LEGAL-597) Questions about third-party LICENSE/NOTICE in the binary release

["Heping Wang (Jira)" <ji...@apache.org>]

Heping Wang created LEGAL-597:
---------------------------------

             Summary: Questions about third-party LICENSE/NOTICE in the binary release
                 Key: LEGAL-597
                 URL: https://issues.apache.org/jira/browse/LEGAL-597
             Project: Legal Discuss
          Issue Type: Question
            Reporter: Heping Wang


The list of NOTICE/LICENSE files for binary release files is as follows:
{code:java}
|-- LICENSE 
|-- NOITCE   
|-- licenses  //this directory include the full text of the licenses  in LICENSE
|        |-- LICENSE-FastInfoset.txt
|        |-- LICENSE-activation.txt
|        |-- LICENSE-ant.txt
|        |-- .....
|--.....{code}

   
When doing the Incubator Release Checklist[1], there is a third-party dependent license item about the binary release, which confuses me:

 

1. For dependent third-party jars, we should use the latest or the LICENSE/NOTICE file corresponding to the dependent jar package version. For example: the old version jersey-client-2.0.jar[1] and the latest version jersey-client-3.0.3.jar[2] have different licenses.

2. Is there any tool to easily obtain the corresponding LICENSE/NOTICE file, because once the project dependencies change, the corresponding LICENSE/NOTICE needs to be added or removed. One way I can think of is to get it from its jar package, but not all jar packages are released with a LICENSE/NOTICE file. However, relying on manual inspection is easy to miss.


[1] https://cwiki.apache.org/confluence/display/INCUBATOR/Incubator+Release+Checklist
[2] https://mvnrepository.com/artifact/org.glassfish.jersey.core/jersey-client/2.0
[3] https://mvnrepository.com/artifact/org.glassfish.jersey.core/jersey-client/3.0.0



--
This message was sent by Atlassian Jira
(v8.20.1#820001)

---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org