You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@burr.apache.org by "elijahbenizzy (via GitHub)" <gi...@apache.org> on 2026/05/04 16:21:33 UTC

[I] License: surface bundled JS dependencies in wheel's LICENSE rather than only the webpack-generated LICENSE.txt [burr]

elijahbenizzy opened a new issue, #756:
URL: https://github.com/apache/burr/issues/756

Raised by Jarek Potiuk during the 0.42.0-incubating RC3 PPMC review. Non-blocking for the release.

## Issue

The wheel ships the built React UI under `burr/tracking/server/build/`. That bundle (~1.7 MB total) embeds many third-party npm packages (React, react-router, lodash, the Magic UI runtime deps, etc.). Their license terms are documented in `burr/tracking/server/build/static/js/main.<hash>.js.LICENSE.txt` — which is webpack's auto-generated comment-banner aggregation.

That file is technically present and machine-readable, but it's not surfaced anywhere a typical license auditor would look: the wheel's top-level `LICENSE-wheel` does not reference it, and there's no `dist-info/licenses/` entry for the bundled deps.

## What's expected for ASF wheels

Apache release policy expects all bundled dependencies to be enumerated in the project's LICENSE / NOTICE in some form, even if the underlying license file is shipped separately. The current state passes RAT (we exclude `*.js`), but is fragile to a strict licensing review.

## Suggested fix

One of:
1. Have the release script copy `burr/tracking/server/build/static/js/main.*.js.LICENSE.txt` into `dist-info/licenses/LICENSE-bundled-js.txt` during wheel build, AND add a one-line pointer in `LICENSE-wheel` pointing readers to that file.
2. Pre-process the webpack output to extract a deduplicated, sorted, top-level `LICENSE-bundled-js.txt` that's appended to `LICENSE-wheel` directly.
3. Vendor a static `LICENSE-bundled-js.txt` listing the npm deps + their licenses, and verify it stays in sync via CI.

Option 1 is the lowest-effort and survives webpack hash changes automatically.

## References

- PPMC vote thread: https://www.mail-archive.com/dev@burr.apache.org/msg00127.html
- The auto-generated file in question: `burr/tracking/server/build/static/js/main.<hash>.js.LICENSE.txt` (present in every wheel build)

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@burr.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] License: surface bundled JS dependencies in wheel's LICENSE rather than only the webpack-generated LICENSE.txt [burr]

Posted by "jernejfrank (via GitHub)" <gi...@apache.org>.

jernejfrank commented on issue #756:
URL: https://github.com/apache/burr/issues/756#issuecomment-5469471578

   Resolved in #868 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@burr.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] License: surface bundled JS dependencies in wheel's LICENSE rather than only the webpack-generated LICENSE.txt [burr]

Posted by "hussain-s (via GitHub)" <gi...@apache.org>.

hussain-s commented on issue #756:
URL: https://github.com/apache/burr/issues/756#issuecomment-4624605371

   Please assign it to me


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@burr.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] License: surface bundled JS dependencies in wheel's LICENSE rather than only the webpack-generated LICENSE.txt [burr]

Posted by "jernejfrank (via GitHub)" <gi...@apache.org>.

jernejfrank closed issue #756: License: surface bundled JS dependencies in wheel's LICENSE rather than only the webpack-generated LICENSE.txt
URL: https://github.com/apache/burr/issues/756


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@burr.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] License: surface bundled JS dependencies in wheel's LICENSE rather than only the webpack-generated LICENSE.txt [burr]

Posted by "hussain-s (via GitHub)" <gi...@apache.org>.

hussain-s commented on issue #756:
URL: https://github.com/apache/burr/issues/756#issuecomment-5087745950

   I am working on it


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@burr.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] License: surface bundled JS dependencies in wheel's LICENSE rather than only the webpack-generated LICENSE.txt [burr]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.

github-actions[bot] commented on issue #756:
URL: https://github.com/apache/burr/issues/756#issuecomment-5044699982

   Removing assignment from @hussain-s after 38 days of inactivity
   (per the [assignment policy](../blob/main/CONTRIBUTING.rst#issue-assignment-policy)).
   
   Feel free to comment if you want to pick this back up or if someone else wants to take it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@burr.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] License: surface bundled JS dependencies in wheel's LICENSE rather than only the webpack-generated LICENSE.txt [burr]

Posted by "bm1016bm-svg (via GitHub)" <gi...@apache.org>.

bm1016bm-svg commented on issue #756:
URL: https://github.com/apache/burr/issues/756#issuecomment-5082113503

   I’m taking this over after the previous assignment expired. I’ll surface the generated webpack license notices through the standard wheel license directory and add release-verification coverage.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@burr.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] License: surface bundled JS dependencies in wheel's LICENSE rather than only the webpack-generated LICENSE.txt [burr]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.

github-actions[bot] commented on issue #756:
URL: https://github.com/apache/burr/issues/756#issuecomment-4853311769

   @hussain-s, this issue has been inactive for 17 days.
   Are you still working on it? Drop a comment to let us know.
   
   If there is no update within 7 days, the assignment will be removed
   so someone else can pick it up
   (per the [assignment policy](../blob/main/CONTRIBUTING.rst#issue-assignment-policy)).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@burr.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org