You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by wu...@apache.org on 2026/09/06 10:44:16 UTC
(skywalking-ai-sessionizer) branch main updated: Carry the notices of the bundled modules in the packaged NOTICE
This is an automated email from the ASF dual-hosted git repository.
wu-sheng pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/skywalking-ai-sessionizer.git
The following commit(s) were added to refs/heads/main by this push:
new c13d6af Carry the notices of the bundled modules in the packaged NOTICE
c13d6af is described below
commit c13d6afe51e23c51f8aa956ecbcc377cd215fea6
Author: Wu Sheng <wu...@foxmail.com>
AuthorDate: Sun Sep 6 18:44:09 2026 +0800
Carry the notices of the bundled modules in the packaged NOTICE
license-eye copies license texts and nothing else. Two modules built into
the binary ship a NOTICE of their own, gRPC-Go and the YAML parser, and
the Apache License asks a distribution that bundles such a work to carry
its notice. The CLI repository does this in its packaged NOTICE, and this
follows it.
tools/dep-notices.sh writes dist-material/NOTICE: the project's own
NOTICE, then a section per module built into the binary that ships one,
named with its version. The modules come from the build, not from go.mod,
so a module needed only by the tests does not appear. make dep-licenses
runs it, make dep-licenses-check regenerates and compares it with the
rest of dist-material, and every binary package and the image carry the
generated NOTICE in place of the root one.
---
Dockerfile | 7 ++++---
Makefile | 8 +++++---
dist-material/NOTICE | 43 ++++++++++++++++++++++++++++++++++++++++
docs/en/changes/changes-0.2.0.md | 8 +++++---
docs/en/guides/contributing.md | 5 +++--
tools/dep-notices.sh | 40 +++++++++++++++++++++++++++++++++++++
6 files changed, 100 insertions(+), 11 deletions(-)
diff --git a/Dockerfile b/Dockerfile
index df42f12..af1538d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,9 +40,10 @@ LABEL org.opencontainers.image.title="SkyWalking AI Sessionizer" \
org.opencontainers.image.source="https://github.com/apache/skywalking-ai-sessionizer" \
org.opencontainers.image.licenses="Apache-2.0"
COPY --from=build /out/asz /usr/local/bin/asz
-# The project's license and notice, and the license of every dependency
-# built into the binary, as a binary distribution must carry them.
-COPY dist-material/LICENSE NOTICE /licenses/
+# The project's license and notice, the notices of the dependencies that
+# ship one, and the license of every dependency built into the binary, as
+# a binary distribution must carry them.
+COPY dist-material/LICENSE dist-material/NOTICE /licenses/
COPY dist-material/licenses /licenses/licenses
WORKDIR /asz
VOLUME ["/asz/data"]
diff --git a/Makefile b/Makefile
index 172b667..b43b989 100644
--- a/Makefile
+++ b/Makefile
@@ -123,18 +123,20 @@ license-fix: $(BIN_DIR)/license-eye
dep-check: $(BIN_DIR)/license-eye
$(BIN_DIR)/license-eye dependency check
-## dep-licenses: regenerate dist-material/LICENSE and dist-material/licenses from go.mod; every binary package carries them
+## dep-licenses: regenerate dist-material/LICENSE, dist-material/NOTICE and dist-material/licenses from the dependencies; every binary package carries them
.PHONY: dep-licenses
dep-licenses: $(BIN_DIR)/license-eye
@rm -rf dist-material/licenses
$(BIN_DIR)/license-eye dependency resolve --summary dist-material/LICENSE.tpl --output dist-material/licenses
+ tools/dep-notices.sh dist-material/NOTICE
## dep-licenses-check: fail when dist-material is not what go.mod resolves to, so a changed dependency cannot ship without its license
.PHONY: dep-licenses-check
dep-licenses-check: $(BIN_DIR)/license-eye
@tmp=$$(mktemp -d) && cp dist-material/LICENSE.tpl $$tmp/ && \
$(BIN_DIR)/license-eye -v warn dependency resolve --summary $$tmp/LICENSE.tpl --output $$tmp/licenses >/dev/null && \
- if diff -r $$tmp dist-material; then rm -rf $$tmp; echo "dist-material matches go.mod"; \
+ tools/dep-notices.sh $$tmp/NOTICE && \
+ if diff -r $$tmp dist-material; then rm -rf $$tmp; echo "dist-material matches the dependencies"; \
else rm -rf $$tmp; echo "dist-material is out of date: run 'make dep-licenses' and commit the result"; exit 1; fi
## tidy: verify go.mod and go.sum are current
@@ -155,7 +157,7 @@ binaries:
@for t in $(PLATFORMS); do \
os=$${t%/*}; arch=$${t#*/}; out=$(DIST)/build/$$os-$$arch; ext=""; \
if [ "$$os" = windows ]; then ext=.exe; fi; \
- mkdir -p $$out && cp dist-material/LICENSE NOTICE $$out/ && rm -rf $$out/licenses && cp -R dist-material/licenses $$out/licenses && \
+ mkdir -p $$out && cp dist-material/LICENSE dist-material/NOTICE $$out/ && rm -rf $$out/licenses && cp -R dist-material/licenses $$out/licenses && \
echo "building $$os/$$arch" && \
CGO_ENABLED=0 GOOS=$$os GOARCH=$$arch $(GO) build -trimpath -ldflags "-s -w $(LDFLAGS)" -o $$out/$(BINARY)$$ext ./cmd/$(BINARY) || exit 1; \
if [ "$$os" = windows ]; then \
diff --git a/dist-material/NOTICE b/dist-material/NOTICE
new file mode 100644
index 0000000..6d9756c
--- /dev/null
+++ b/dist-material/NOTICE
@@ -0,0 +1,43 @@
+Apache SkyWalking AI Sessionizer
+Copyright 2026 The Apache Software Foundation
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+========================================================================
+
+google.golang.org/grpc v1.83.2 NOTICE
+
+========================================================================
+Copyright 2014 gRPC authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+========================================================================
+
+gopkg.in/yaml.v3 v3.0.1 NOTICE
+
+========================================================================
+Copyright 2011-2016 Canonical Ltd.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/docs/en/changes/changes-0.2.0.md b/docs/en/changes/changes-0.2.0.md
index 60f5d01..088f477 100644
--- a/docs/en/changes/changes-0.2.0.md
+++ b/docs/en/changes/changes-0.2.0.md
@@ -134,6 +134,8 @@
## Packaging
- Every binary package and the container image carry the license of every dependency built into
- the binary, under `licenses/`, with a LICENSE that lists each module under its license. They are
- generated from `go.mod` by `license-eye` into `dist-material/`, the way the other SkyWalking
- repositories do it, and CI fails when the committed copy is not what `go.mod` resolves to.
+ the binary, under `licenses/`, a LICENSE that lists each module under its license, and a NOTICE
+ that carries the notice of every bundled module that ships one, gRPC-Go and the YAML parser
+ today. They are generated into `dist-material/` by `license-eye` and a small script over the
+ build, the way the other SkyWalking repositories do it, and CI fails when the committed copy is
+ not what the dependencies resolve to.
diff --git a/docs/en/guides/contributing.md b/docs/en/guides/contributing.md
index afd6b4b..5111744 100644
--- a/docs/en/guides/contributing.md
+++ b/docs/en/guides/contributing.md
@@ -31,8 +31,9 @@ side.
- `make check` passes. CI runs the same targets and one required check fans them in.
- Every source file carries the Apache license header. `make license-fix` inserts missing ones.
- A changed dependency changes `dist-material/`: `make dep-licenses` regenerates the LICENSE with
- a section per license and one text per module, from `go.mod`, and every binary package and the
- container image carry them. `make check` fails when the committed copy is out of date.
+ a section per license and one text per module, from `go.mod`, and the NOTICE with the notice of
+ every module built into the binary that ships one. Every binary package and the container image
+ carry them. `make check` fails when the committed copy is out of date.
- Comments, docs and commit messages are plain English. Someone reading this project is often not
a native English speaker, and the code is the hard part. No abbreviations, no slang, no figurative
words where a common one works. Short sentences, one idea each.
diff --git a/tools/dep-notices.sh b/tools/dep-notices.sh
new file mode 100755
index 0000000..ac5b3aa
--- /dev/null
+++ b/tools/dep-notices.sh
@@ -0,0 +1,40 @@
+#!/bin/sh
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Writes the NOTICE a binary distribution carries: the project's own, then
+# the NOTICE of every module built into the binary that ships one, as the
+# Apache License asks of a distribution that bundles such a work. The
+# modules come from the build itself, not from go.mod, so a module that is
+# only needed by the tests does not appear. Used by make dep-licenses and
+# make dep-licenses-check.
+set -eu
+cd "$(dirname "$0")/.."
+out="${1:-dist-material/NOTICE}"
+{
+ cat NOTICE
+ go list -deps -f '{{if and (not .Standard) .Module}}{{if not .Module.Main}}{{.Module.Path}}@{{.Module.Version}}{{end}}{{end}}' ./cmd/asz \
+ | sort -u | while read -r mod; do
+ [ -n "$mod" ] || continue
+ dir=$(go list -m -f '{{.Dir}}' "$mod")
+ for n in "$dir/NOTICE" "$dir/NOTICE.txt" "$dir/NOTICE.md"; do
+ [ -f "$n" ] || continue
+ printf '\n========================================================================\n\n%s %s NOTICE\n\n========================================================================\n' "${mod%@*}" "${mod#*@}"
+ cat "$n"
+ done
+ done
+} > "$out"