You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@tooling.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2025/06/16 12:32:12 UTC

[I] Looking for NOTICE file only in the top-level folder ? (tooling-trusted-release)

potiuk opened a new issue, #173:
URL: https://github.com/apache/tooling-trusted-release/issues/173

   Do we have expectation that NOTICE file is always at the top of the source package, even if it comes from a sub-folder? in our package https://release-test.apache.org/file/airflow/3.0.2/apache-airflow-3.0.2-source.tar.gz. we have NOTICE as a sub-directory:
   
   ```
   apache-airflow-3.0.2/airflow-core/NOTICE
   ```
   
   And it's being flagged as missing. 
   
   There is a bit of a problem with this package because it contains "whole" airflow source - because you need the whole source to build it, but in fact this is a source package to build "airflow-core" product, which lives mostly in that subdirectory. So the NOTICE makes sense in a subdirectory in this case - because then when you build "pypi" package - NOTICE is placed in the LICENCES section of the metadata of the .whl file.
   
   Maybe we should have a way to specify where NOTICE file is ? 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Looking for NOTICE file only in the top-level folder ? (tooling-trusted-release)

Posted by "sbp (via GitHub)" <gi...@apache.org>.

sbp commented on issue #173:
URL: https://github.com/apache/tooling-trusted-release/issues/173#issuecomment-2976682845

   [According to the ASF release policy](https://www.apache.org/legal/release-policy.html#notice-file), there must be a `NOTICE` file at the top level of any source distribution:
   
   > For source packages, `LICENSE` and `NOTICE` MUST be located at the root of the distribution.
   
   If you need `airflow-core/NOTICE` to be present as well, I assume that's okay, because the release policy does not say that multiple `NOTICE` files are forbidden. Perhaps we should have that clarified by those who set ASF policy.
   
   By the way, `airflow-core/NOTICE` contains messages for Hue and Chakra UI. The Chakra UI message is, I think, unnecessary, [according to the `LICENSE` and `NOTICE` guide](https://infra.apache.org/licensing-howto.html#mod-notice), since Chakra UI is MIT licensed:
   
   > elements such as the copyright notifications embedded within BSD and MIT licenses [do not need to be duplicated](https://issues.apache.org/jira/browse/LEGAL-59) in `NOTICE`
   
   Whereas, the case of Hue looks more complicated because it is Apache 2.0 licensed and has [an enormous NOTICE file at a non-standard `NOTICE.txt` location](https://github.com/cloudera/hue/blob/master/NOTICE.txt). I think that if you're using Hue then you'd potentially need to duplicate all of `NOTICE.txt` in your own `NOTICE`, in the root at least and perhaps in the `airflow-core` subdirectory too.
   
   In ATR we're probably not going to go past the file existence and simple content checking, at least for alpha. Please do keep the feedback about checks coming, because we'd certainly like to get them as accurate and _developer friendly_ as possible. We can't set policy, though! We can certainly start discussion if policy needs to be changed or clarified, and I'd like to do that even if this case regarding multiple `NOTICE` files.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Looking for NOTICE file only in the top-level folder ? (tooling-trusted-release)

Posted by "potiuk (via GitHub)" <gi...@apache.org>.

potiuk commented on issue #173:
URL: https://github.com/apache/tooling-trusted-release/issues/173#issuecomment-2978106116

   Cool


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Looking for NOTICE file only in the top-level folder ? (tooling-trusted-release)

Posted by "potiuk (via GitHub)" <gi...@apache.org>.

potiuk commented on issue #173:
URL: https://github.com/apache/tooling-trusted-release/issues/173#issuecomment-2977082884

   We could add a regexp (or list of regexp) that users could add to product definition to match "release" or "convenience" packages.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Looking for NOTICE file only in the top-level folder ? (tooling-trusted-release)

Posted by "potiuk (via GitHub)" <gi...@apache.org>.

potiuk commented on issue #173:
URL: https://github.com/apache/tooling-trusted-release/issues/173#issuecomment-2978057141

   Note - that it should be per "project"  - not repo. In our case, naming rules are going to be different for each "distribution" coming from the same repo (we have ~ 100 of those from one monorepo in total, but "project" allows to group it nicely - we have "airflow", "task-sdk". "python client" , "helm chart", "providers" as projects  - and each project will have different set of naming rules describing the artifacts "type" - whether it's a "source" or "convenience" distribution (but they should be consistent within the project).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Looking for NOTICE file only in the top-level folder ? (tooling-trusted-release)

Posted by "potiuk (via GitHub)" <gi...@apache.org>.

potiuk commented on issue #173:
URL: https://github.com/apache/tooling-trusted-release/issues/173#issuecomment-2976735169

   Sure thing. That makes sense. I thought that in source files, what we can do is to just have a symbolic link to the NOTICE file at the top-level and it will solve the problem.
   
   But there is another, spin-off question - how about convenience packages? We **still** want to submit and release several convenience packages via ATR even if technically we are not required to (we have reproducible builds for those, so recording them in ATR / SVN with checksums and signatures is actually a good idea, because users might also verify their provenience even if they are released in PyPI.
   
   But in those packages, NOTICE and LICENCE files are usually placed elsewhere:
   
   * for .whl packages, it is placed in METADATA in package-info - after marking it as part of LICENCES
   * for java .jars - similarly - NOTICE files are placed in META-INF
   
   Two questions:
   
   * Should ATR be checking in different places (at least for those known file types)
   * Or maybe we should be able to specify that (say) NOTICE and LICENCE requirements should be relaxed ?
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org