You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@toree.apache.org by Luciano Resende <lu...@gmail.com> on 2026/01/29 04:30:27 UTC
License and Notice location, was Re: [VOTE] Apache Toree 0.6.0 RC3
On Wed, Dec 3, 2025 at 3:27 PM PJ Fanning <fa...@apache.org> wrote:
> I think we're still missing NOTICE details for Apache licensed 3rd party
> libs in the bin tar.gz.
>
> For instance, scala-xml has this NOTICE file:
> https://github.com/scala/scala-xml/blob/main/NOTICE
>
> We don't seem to have this in the bin tar.gz.
>
> This is just one example. I think most of the Scala libs have NOTICE files
> and there is a good chance that other ASL jars have them too.
>
> The Pekko NOTICE files are worth checking too because the document some
> third party source in their jars.
> For the pekko-actor jar, you have:
> https://github.com/apache/pekko/blob/main/legal/pekko-actor-jar-notice.txt
>
>
Hi PJ, sorry for the late reply...
After looking into this further, I’ve identified a few key issues with how
our licenses and notices are being handled:
- Missing license/notices: The distribution isn't currently displaying all
required license and notice files in its root.
- Split sources: A large portion of these are currently linked in
etc/legal/LICENSE_extras and NOTICE_extras and then appended to the main
distribution files.
- Jar-level license/notices: The remaining files are being concatenated
into the META-INF folder of the Toree assembly jar, which sits in the lib/
directory of the bin.tar.gz.
```
LICENSE_commons-exec-1.3.txt
LICENSE_coursier-util_2.12-2.0.0
LICENSE_jackson-annotations-2.14.2
LICENSE_jackson-core-2.14.2
LICENSE_jackson-databind-2.14.2
LICENSE_jackson-datatype-jsr310-2.9.8
LICENSE_joda-time-2.10.1.txt
LICENSE_pekko-actor_2.12-1.1.5
LICENSE_pekko-slf4j_2.12-1.1.5
LICENSE_slf4j-api-2.0.16.txt
license_spring-core-5.2.2.RELEASE.txt
license_spring-jcl-5.2.2.RELEASE.txt
...
NOTICE_commons-exec-1.3.txt
NOTICE_jackson-annotations-2.14.2
NOTICE_jackson-core-2.14.2
NOTICE_jackson-databind-2.14.2
NOTICE_joda-time-2.10.1.txt
NOTICE_pekko-actor_2.12-1.1.5
NOTICE_pekko-slf4j_2.12-1.1.5
notice_spring-core-5.2.2.RELEASE.txt
notice_spring-jcl-5.2.2.RELEASE.txt
```
Before we make further changes, I’d like to align on a strategy for how
these should appear in our distributions. Specifically:
- Top-level visibility: Is it mandatory to include all these details in
the top-level LICENSE and NOTICE files?
- Current assembly approach: Is our existing method—where the assembly
plugin concatenates these into the META-INF folder of the assembly
jar—sufficient for compliance?
I’ve already addressed a few missing items in PR #239
<https://github.com/apache/incubator-toree/pull/239>, but I want to ensure
we have a consistent approach moving forward.
--
Luciano Resende
http://twitter.com/lresende1975
http://lresende.blogspot.com/
Re: License and Notice location, was Re: [VOTE] Apache Toree 0.6.0 RC3
Posted by Luciano Resende <lu...@gmail.com>.
On Fri, Jan 30, 2026 at 1:55 PM PJ Fanning <fa...@gmail.com> wrote:
> I wasn't talking about the pip files - I was talking about the source
> release.
> toree-0.6.0-incubating-src.tar.gz
> should be named
> apache-toree-0.6.0-incubating-src.tar.gz
>
>
ACK, let me review these over the weekend.
> On Fri, 30 Jan 2026 at 22:52, Luciano Resende <lu...@gmail.com>
> wrote:
> >
> > We are in a transition period and publishing two packages to provide
> > compatibility with the previous version,
> > See apache prefixed in
> >
> https://dist.apache.org/repos/dist/dev/incubator/toree/0.6.0-incubating-rc3/apache-toree-pip/
> >
> > On Fri, Jan 30, 2026 at 1:40 PM PJ Fanning <fa...@apache.org> wrote:
> >
> > > Hi Luciano,
> > >
> > > For the next RC, can you change the src release tar file to prefix the
> > > name with 'apache-toree' instead of 'toree'? This is more standard.
> > >
> > >
> > >
> https://dist.apache.org/repos/dist/dev/incubator/toree/0.6.0-incubating-rc3/toree/
> > >
> > > The bin tar in that dir, it would nice to make an equivalent change.
> > >
> > > The PR with the license changes looks good but I'm still reviewing if
> we
> > > are missing anything else.
> > >
> > > Thanks,
> > > PJ
> > >
> > > On 2026/01/29 11:18:00 PJ Fanning wrote:
> > > > Usually the 3rd party license and notices (if applicable) are bundled
> > > > but I'm not against providing links. I would suggest that if we
> > > > already bundle some licenses and notices to keep those bundled. The
> > > > missing ones - maybe links are ok. It's certainly better than not
> > > > having any indication of their licensing.
> > > >
> > > > On Thu, 29 Jan 2026 at 12:15, PJ Fanning <fa...@gmail.com>
> wrote:
> > > > >
> > > > > The issue under discussion is a fat jar - one bundles Toree classes
> > > > > with lots of classes from 3rd party libs.
> > > > > That jar must contain the details of all the licenses and notices
> from
> > > > > the 3rd party classes - and also include our Apache license and
> > > > > notice.
> > > > >
> > > > > On Thu, 29 Jan 2026 at 05:31, Luciano Resende <
> luckbr1975@gmail.com>
> > > wrote:
> > > > > >
> > > > > > On Wed, Dec 3, 2025 at 3:27 PM PJ Fanning <fa...@apache.org>
> > > wrote:
> > > > > >
> > > > > > > I think we're still missing NOTICE details for Apache licensed
> 3rd
> > > party
> > > > > > > libs in the bin tar.gz.
> > > > > > >
> > > > > > > For instance, scala-xml has this NOTICE file:
> > > > > > > https://github.com/scala/scala-xml/blob/main/NOTICE
> > > > > > >
> > > > > > > We don't seem to have this in the bin tar.gz.
> > > > > > >
> > > > > > > This is just one example. I think most of the Scala libs have
> > > NOTICE files
> > > > > > > and there is a good chance that other ASL jars have them too.
> > > > > > >
> > > > > > > The Pekko NOTICE files are worth checking too because the
> document
> > > some
> > > > > > > third party source in their jars.
> > > > > > > For the pekko-actor jar, you have:
> > > > > > >
> > >
> https://github.com/apache/pekko/blob/main/legal/pekko-actor-jar-notice.txt
> > > > > > >
> > > > > > >
> > > > > > Hi PJ, sorry for the late reply...
> > > > > >
> > > > > > After looking into this further, I’ve identified a few key issues
> > > with how
> > > > > > our licenses and notices are being handled:
> > > > > > - Missing license/notices: The distribution isn't currently
> > > displaying all
> > > > > > required license and notice files in its root.
> > > > > > - Split sources: A large portion of these are currently linked in
> > > > > > etc/legal/LICENSE_extras and NOTICE_extras and then appended to
> the
> > > main
> > > > > > distribution files.
> > > > > > - Jar-level license/notices: The remaining files are being
> > > concatenated
> > > > > > into the META-INF folder of the Toree assembly jar, which sits in
> > > the lib/
> > > > > > directory of the bin.tar.gz.
> > > > > >
> > > > > > ```
> > > > > > LICENSE_commons-exec-1.3.txt
> > > > > > LICENSE_coursier-util_2.12-2.0.0
> > > > > > LICENSE_jackson-annotations-2.14.2
> > > > > > LICENSE_jackson-core-2.14.2
> > > > > > LICENSE_jackson-databind-2.14.2
> > > > > > LICENSE_jackson-datatype-jsr310-2.9.8
> > > > > > LICENSE_joda-time-2.10.1.txt
> > > > > > LICENSE_pekko-actor_2.12-1.1.5
> > > > > > LICENSE_pekko-slf4j_2.12-1.1.5
> > > > > > LICENSE_slf4j-api-2.0.16.txt
> > > > > > license_spring-core-5.2.2.RELEASE.txt
> > > > > > license_spring-jcl-5.2.2.RELEASE.txt
> > > > > > ...
> > > > > > NOTICE_commons-exec-1.3.txt
> > > > > > NOTICE_jackson-annotations-2.14.2
> > > > > > NOTICE_jackson-core-2.14.2
> > > > > > NOTICE_jackson-databind-2.14.2
> > > > > > NOTICE_joda-time-2.10.1.txt
> > > > > > NOTICE_pekko-actor_2.12-1.1.5
> > > > > > NOTICE_pekko-slf4j_2.12-1.1.5
> > > > > > notice_spring-core-5.2.2.RELEASE.txt
> > > > > > notice_spring-jcl-5.2.2.RELEASE.txt
> > > > > > ```
> > > > > >
> > > > > > Before we make further changes, I’d like to align on a strategy
> for
> > > how
> > > > > > these should appear in our distributions. Specifically:
> > > > > > - Top-level visibility: Is it mandatory to include all these
> > > details in
> > > > > > the top-level LICENSE and NOTICE files?
> > > > > > - Current assembly approach: Is our existing method—where the
> > > assembly
> > > > > > plugin concatenates these into the META-INF folder of the
> assembly
> > > > > > jar—sufficient for compliance?
> > > > > >
> > > > > > I’ve already addressed a few missing items in PR #239
> > > > > > <https://github.com/apache/incubator-toree/pull/239>, but I
> want to
> > > ensure
> > > > > > we have a consistent approach moving forward.
> > > > > >
> > > > > > --
> > > > > > Luciano Resende
> > > > > > http://twitter.com/lresende1975
> > > > > > http://lresende.blogspot.com/
> > > >
> > >
> >
> >
> > --
> > Luciano Resende
> > http://twitter.com/lresende1975
> > http://lresende.blogspot.com/
>
--
Luciano Resende
http://twitter.com/lresende1975
http://lresende.blogspot.com/
Re: License and Notice location, was Re: [VOTE] Apache Toree 0.6.0 RC3
Posted by PJ Fanning <fa...@gmail.com>.
I wasn't talking about the pip files - I was talking about the source release.
toree-0.6.0-incubating-src.tar.gz
should be named
apache-toree-0.6.0-incubating-src.tar.gz
On Fri, 30 Jan 2026 at 22:52, Luciano Resende <lu...@gmail.com> wrote:
>
> We are in a transition period and publishing two packages to provide
> compatibility with the previous version,
> See apache prefixed in
> https://dist.apache.org/repos/dist/dev/incubator/toree/0.6.0-incubating-rc3/apache-toree-pip/
>
> On Fri, Jan 30, 2026 at 1:40 PM PJ Fanning <fa...@apache.org> wrote:
>
> > Hi Luciano,
> >
> > For the next RC, can you change the src release tar file to prefix the
> > name with 'apache-toree' instead of 'toree'? This is more standard.
> >
> >
> > https://dist.apache.org/repos/dist/dev/incubator/toree/0.6.0-incubating-rc3/toree/
> >
> > The bin tar in that dir, it would nice to make an equivalent change.
> >
> > The PR with the license changes looks good but I'm still reviewing if we
> > are missing anything else.
> >
> > Thanks,
> > PJ
> >
> > On 2026/01/29 11:18:00 PJ Fanning wrote:
> > > Usually the 3rd party license and notices (if applicable) are bundled
> > > but I'm not against providing links. I would suggest that if we
> > > already bundle some licenses and notices to keep those bundled. The
> > > missing ones - maybe links are ok. It's certainly better than not
> > > having any indication of their licensing.
> > >
> > > On Thu, 29 Jan 2026 at 12:15, PJ Fanning <fa...@gmail.com> wrote:
> > > >
> > > > The issue under discussion is a fat jar - one bundles Toree classes
> > > > with lots of classes from 3rd party libs.
> > > > That jar must contain the details of all the licenses and notices from
> > > > the 3rd party classes - and also include our Apache license and
> > > > notice.
> > > >
> > > > On Thu, 29 Jan 2026 at 05:31, Luciano Resende <lu...@gmail.com>
> > wrote:
> > > > >
> > > > > On Wed, Dec 3, 2025 at 3:27 PM PJ Fanning <fa...@apache.org>
> > wrote:
> > > > >
> > > > > > I think we're still missing NOTICE details for Apache licensed 3rd
> > party
> > > > > > libs in the bin tar.gz.
> > > > > >
> > > > > > For instance, scala-xml has this NOTICE file:
> > > > > > https://github.com/scala/scala-xml/blob/main/NOTICE
> > > > > >
> > > > > > We don't seem to have this in the bin tar.gz.
> > > > > >
> > > > > > This is just one example. I think most of the Scala libs have
> > NOTICE files
> > > > > > and there is a good chance that other ASL jars have them too.
> > > > > >
> > > > > > The Pekko NOTICE files are worth checking too because the document
> > some
> > > > > > third party source in their jars.
> > > > > > For the pekko-actor jar, you have:
> > > > > >
> > https://github.com/apache/pekko/blob/main/legal/pekko-actor-jar-notice.txt
> > > > > >
> > > > > >
> > > > > Hi PJ, sorry for the late reply...
> > > > >
> > > > > After looking into this further, I’ve identified a few key issues
> > with how
> > > > > our licenses and notices are being handled:
> > > > > - Missing license/notices: The distribution isn't currently
> > displaying all
> > > > > required license and notice files in its root.
> > > > > - Split sources: A large portion of these are currently linked in
> > > > > etc/legal/LICENSE_extras and NOTICE_extras and then appended to the
> > main
> > > > > distribution files.
> > > > > - Jar-level license/notices: The remaining files are being
> > concatenated
> > > > > into the META-INF folder of the Toree assembly jar, which sits in
> > the lib/
> > > > > directory of the bin.tar.gz.
> > > > >
> > > > > ```
> > > > > LICENSE_commons-exec-1.3.txt
> > > > > LICENSE_coursier-util_2.12-2.0.0
> > > > > LICENSE_jackson-annotations-2.14.2
> > > > > LICENSE_jackson-core-2.14.2
> > > > > LICENSE_jackson-databind-2.14.2
> > > > > LICENSE_jackson-datatype-jsr310-2.9.8
> > > > > LICENSE_joda-time-2.10.1.txt
> > > > > LICENSE_pekko-actor_2.12-1.1.5
> > > > > LICENSE_pekko-slf4j_2.12-1.1.5
> > > > > LICENSE_slf4j-api-2.0.16.txt
> > > > > license_spring-core-5.2.2.RELEASE.txt
> > > > > license_spring-jcl-5.2.2.RELEASE.txt
> > > > > ...
> > > > > NOTICE_commons-exec-1.3.txt
> > > > > NOTICE_jackson-annotations-2.14.2
> > > > > NOTICE_jackson-core-2.14.2
> > > > > NOTICE_jackson-databind-2.14.2
> > > > > NOTICE_joda-time-2.10.1.txt
> > > > > NOTICE_pekko-actor_2.12-1.1.5
> > > > > NOTICE_pekko-slf4j_2.12-1.1.5
> > > > > notice_spring-core-5.2.2.RELEASE.txt
> > > > > notice_spring-jcl-5.2.2.RELEASE.txt
> > > > > ```
> > > > >
> > > > > Before we make further changes, I’d like to align on a strategy for
> > how
> > > > > these should appear in our distributions. Specifically:
> > > > > - Top-level visibility: Is it mandatory to include all these
> > details in
> > > > > the top-level LICENSE and NOTICE files?
> > > > > - Current assembly approach: Is our existing method—where the
> > assembly
> > > > > plugin concatenates these into the META-INF folder of the assembly
> > > > > jar—sufficient for compliance?
> > > > >
> > > > > I’ve already addressed a few missing items in PR #239
> > > > > <https://github.com/apache/incubator-toree/pull/239>, but I want to
> > ensure
> > > > > we have a consistent approach moving forward.
> > > > >
> > > > > --
> > > > > Luciano Resende
> > > > > http://twitter.com/lresende1975
> > > > > http://lresende.blogspot.com/
> > >
> >
>
>
> --
> Luciano Resende
> http://twitter.com/lresende1975
> http://lresende.blogspot.com/
Re: License and Notice location, was Re: [VOTE] Apache Toree 0.6.0 RC3
Posted by Luciano Resende <lu...@gmail.com>.
We are in a transition period and publishing two packages to provide
compatibility with the previous version,
See apache prefixed in
https://dist.apache.org/repos/dist/dev/incubator/toree/0.6.0-incubating-rc3/apache-toree-pip/
On Fri, Jan 30, 2026 at 1:40 PM PJ Fanning <fa...@apache.org> wrote:
> Hi Luciano,
>
> For the next RC, can you change the src release tar file to prefix the
> name with 'apache-toree' instead of 'toree'? This is more standard.
>
>
> https://dist.apache.org/repos/dist/dev/incubator/toree/0.6.0-incubating-rc3/toree/
>
> The bin tar in that dir, it would nice to make an equivalent change.
>
> The PR with the license changes looks good but I'm still reviewing if we
> are missing anything else.
>
> Thanks,
> PJ
>
> On 2026/01/29 11:18:00 PJ Fanning wrote:
> > Usually the 3rd party license and notices (if applicable) are bundled
> > but I'm not against providing links. I would suggest that if we
> > already bundle some licenses and notices to keep those bundled. The
> > missing ones - maybe links are ok. It's certainly better than not
> > having any indication of their licensing.
> >
> > On Thu, 29 Jan 2026 at 12:15, PJ Fanning <fa...@gmail.com> wrote:
> > >
> > > The issue under discussion is a fat jar - one bundles Toree classes
> > > with lots of classes from 3rd party libs.
> > > That jar must contain the details of all the licenses and notices from
> > > the 3rd party classes - and also include our Apache license and
> > > notice.
> > >
> > > On Thu, 29 Jan 2026 at 05:31, Luciano Resende <lu...@gmail.com>
> wrote:
> > > >
> > > > On Wed, Dec 3, 2025 at 3:27 PM PJ Fanning <fa...@apache.org>
> wrote:
> > > >
> > > > > I think we're still missing NOTICE details for Apache licensed 3rd
> party
> > > > > libs in the bin tar.gz.
> > > > >
> > > > > For instance, scala-xml has this NOTICE file:
> > > > > https://github.com/scala/scala-xml/blob/main/NOTICE
> > > > >
> > > > > We don't seem to have this in the bin tar.gz.
> > > > >
> > > > > This is just one example. I think most of the Scala libs have
> NOTICE files
> > > > > and there is a good chance that other ASL jars have them too.
> > > > >
> > > > > The Pekko NOTICE files are worth checking too because the document
> some
> > > > > third party source in their jars.
> > > > > For the pekko-actor jar, you have:
> > > > >
> https://github.com/apache/pekko/blob/main/legal/pekko-actor-jar-notice.txt
> > > > >
> > > > >
> > > > Hi PJ, sorry for the late reply...
> > > >
> > > > After looking into this further, I’ve identified a few key issues
> with how
> > > > our licenses and notices are being handled:
> > > > - Missing license/notices: The distribution isn't currently
> displaying all
> > > > required license and notice files in its root.
> > > > - Split sources: A large portion of these are currently linked in
> > > > etc/legal/LICENSE_extras and NOTICE_extras and then appended to the
> main
> > > > distribution files.
> > > > - Jar-level license/notices: The remaining files are being
> concatenated
> > > > into the META-INF folder of the Toree assembly jar, which sits in
> the lib/
> > > > directory of the bin.tar.gz.
> > > >
> > > > ```
> > > > LICENSE_commons-exec-1.3.txt
> > > > LICENSE_coursier-util_2.12-2.0.0
> > > > LICENSE_jackson-annotations-2.14.2
> > > > LICENSE_jackson-core-2.14.2
> > > > LICENSE_jackson-databind-2.14.2
> > > > LICENSE_jackson-datatype-jsr310-2.9.8
> > > > LICENSE_joda-time-2.10.1.txt
> > > > LICENSE_pekko-actor_2.12-1.1.5
> > > > LICENSE_pekko-slf4j_2.12-1.1.5
> > > > LICENSE_slf4j-api-2.0.16.txt
> > > > license_spring-core-5.2.2.RELEASE.txt
> > > > license_spring-jcl-5.2.2.RELEASE.txt
> > > > ...
> > > > NOTICE_commons-exec-1.3.txt
> > > > NOTICE_jackson-annotations-2.14.2
> > > > NOTICE_jackson-core-2.14.2
> > > > NOTICE_jackson-databind-2.14.2
> > > > NOTICE_joda-time-2.10.1.txt
> > > > NOTICE_pekko-actor_2.12-1.1.5
> > > > NOTICE_pekko-slf4j_2.12-1.1.5
> > > > notice_spring-core-5.2.2.RELEASE.txt
> > > > notice_spring-jcl-5.2.2.RELEASE.txt
> > > > ```
> > > >
> > > > Before we make further changes, I’d like to align on a strategy for
> how
> > > > these should appear in our distributions. Specifically:
> > > > - Top-level visibility: Is it mandatory to include all these
> details in
> > > > the top-level LICENSE and NOTICE files?
> > > > - Current assembly approach: Is our existing method—where the
> assembly
> > > > plugin concatenates these into the META-INF folder of the assembly
> > > > jar—sufficient for compliance?
> > > >
> > > > I’ve already addressed a few missing items in PR #239
> > > > <https://github.com/apache/incubator-toree/pull/239>, but I want to
> ensure
> > > > we have a consistent approach moving forward.
> > > >
> > > > --
> > > > Luciano Resende
> > > > http://twitter.com/lresende1975
> > > > http://lresende.blogspot.com/
> >
>
--
Luciano Resende
http://twitter.com/lresende1975
http://lresende.blogspot.com/
Re: License and Notice location, was Re: [VOTE] Apache Toree 0.6.0 RC3
Posted by PJ Fanning <fa...@apache.org>.
Hi Luciano,
For the next RC, can you change the src release tar file to prefix the name with 'apache-toree' instead of 'toree'? This is more standard.
https://dist.apache.org/repos/dist/dev/incubator/toree/0.6.0-incubating-rc3/toree/
The bin tar in that dir, it would nice to make an equivalent change.
The PR with the license changes looks good but I'm still reviewing if we are missing anything else.
Thanks,
PJ
On 2026/01/29 11:18:00 PJ Fanning wrote:
> Usually the 3rd party license and notices (if applicable) are bundled
> but I'm not against providing links. I would suggest that if we
> already bundle some licenses and notices to keep those bundled. The
> missing ones - maybe links are ok. It's certainly better than not
> having any indication of their licensing.
>
> On Thu, 29 Jan 2026 at 12:15, PJ Fanning <fa...@gmail.com> wrote:
> >
> > The issue under discussion is a fat jar - one bundles Toree classes
> > with lots of classes from 3rd party libs.
> > That jar must contain the details of all the licenses and notices from
> > the 3rd party classes - and also include our Apache license and
> > notice.
> >
> > On Thu, 29 Jan 2026 at 05:31, Luciano Resende <lu...@gmail.com> wrote:
> > >
> > > On Wed, Dec 3, 2025 at 3:27 PM PJ Fanning <fa...@apache.org> wrote:
> > >
> > > > I think we're still missing NOTICE details for Apache licensed 3rd party
> > > > libs in the bin tar.gz.
> > > >
> > > > For instance, scala-xml has this NOTICE file:
> > > > https://github.com/scala/scala-xml/blob/main/NOTICE
> > > >
> > > > We don't seem to have this in the bin tar.gz.
> > > >
> > > > This is just one example. I think most of the Scala libs have NOTICE files
> > > > and there is a good chance that other ASL jars have them too.
> > > >
> > > > The Pekko NOTICE files are worth checking too because the document some
> > > > third party source in their jars.
> > > > For the pekko-actor jar, you have:
> > > > https://github.com/apache/pekko/blob/main/legal/pekko-actor-jar-notice.txt
> > > >
> > > >
> > > Hi PJ, sorry for the late reply...
> > >
> > > After looking into this further, I’ve identified a few key issues with how
> > > our licenses and notices are being handled:
> > > - Missing license/notices: The distribution isn't currently displaying all
> > > required license and notice files in its root.
> > > - Split sources: A large portion of these are currently linked in
> > > etc/legal/LICENSE_extras and NOTICE_extras and then appended to the main
> > > distribution files.
> > > - Jar-level license/notices: The remaining files are being concatenated
> > > into the META-INF folder of the Toree assembly jar, which sits in the lib/
> > > directory of the bin.tar.gz.
> > >
> > > ```
> > > LICENSE_commons-exec-1.3.txt
> > > LICENSE_coursier-util_2.12-2.0.0
> > > LICENSE_jackson-annotations-2.14.2
> > > LICENSE_jackson-core-2.14.2
> > > LICENSE_jackson-databind-2.14.2
> > > LICENSE_jackson-datatype-jsr310-2.9.8
> > > LICENSE_joda-time-2.10.1.txt
> > > LICENSE_pekko-actor_2.12-1.1.5
> > > LICENSE_pekko-slf4j_2.12-1.1.5
> > > LICENSE_slf4j-api-2.0.16.txt
> > > license_spring-core-5.2.2.RELEASE.txt
> > > license_spring-jcl-5.2.2.RELEASE.txt
> > > ...
> > > NOTICE_commons-exec-1.3.txt
> > > NOTICE_jackson-annotations-2.14.2
> > > NOTICE_jackson-core-2.14.2
> > > NOTICE_jackson-databind-2.14.2
> > > NOTICE_joda-time-2.10.1.txt
> > > NOTICE_pekko-actor_2.12-1.1.5
> > > NOTICE_pekko-slf4j_2.12-1.1.5
> > > notice_spring-core-5.2.2.RELEASE.txt
> > > notice_spring-jcl-5.2.2.RELEASE.txt
> > > ```
> > >
> > > Before we make further changes, I’d like to align on a strategy for how
> > > these should appear in our distributions. Specifically:
> > > - Top-level visibility: Is it mandatory to include all these details in
> > > the top-level LICENSE and NOTICE files?
> > > - Current assembly approach: Is our existing method—where the assembly
> > > plugin concatenates these into the META-INF folder of the assembly
> > > jar—sufficient for compliance?
> > >
> > > I’ve already addressed a few missing items in PR #239
> > > <https://github.com/apache/incubator-toree/pull/239>, but I want to ensure
> > > we have a consistent approach moving forward.
> > >
> > > --
> > > Luciano Resende
> > > http://twitter.com/lresende1975
> > > http://lresende.blogspot.com/
>
Re: License and Notice location, was Re: [VOTE] Apache Toree 0.6.0 RC3
Posted by PJ Fanning <fa...@gmail.com>.
Usually the 3rd party license and notices (if applicable) are bundled
but I'm not against providing links. I would suggest that if we
already bundle some licenses and notices to keep those bundled. The
missing ones - maybe links are ok. It's certainly better than not
having any indication of their licensing.
On Thu, 29 Jan 2026 at 12:15, PJ Fanning <fa...@gmail.com> wrote:
>
> The issue under discussion is a fat jar - one bundles Toree classes
> with lots of classes from 3rd party libs.
> That jar must contain the details of all the licenses and notices from
> the 3rd party classes - and also include our Apache license and
> notice.
>
> On Thu, 29 Jan 2026 at 05:31, Luciano Resende <lu...@gmail.com> wrote:
> >
> > On Wed, Dec 3, 2025 at 3:27 PM PJ Fanning <fa...@apache.org> wrote:
> >
> > > I think we're still missing NOTICE details for Apache licensed 3rd party
> > > libs in the bin tar.gz.
> > >
> > > For instance, scala-xml has this NOTICE file:
> > > https://github.com/scala/scala-xml/blob/main/NOTICE
> > >
> > > We don't seem to have this in the bin tar.gz.
> > >
> > > This is just one example. I think most of the Scala libs have NOTICE files
> > > and there is a good chance that other ASL jars have them too.
> > >
> > > The Pekko NOTICE files are worth checking too because the document some
> > > third party source in their jars.
> > > For the pekko-actor jar, you have:
> > > https://github.com/apache/pekko/blob/main/legal/pekko-actor-jar-notice.txt
> > >
> > >
> > Hi PJ, sorry for the late reply...
> >
> > After looking into this further, I’ve identified a few key issues with how
> > our licenses and notices are being handled:
> > - Missing license/notices: The distribution isn't currently displaying all
> > required license and notice files in its root.
> > - Split sources: A large portion of these are currently linked in
> > etc/legal/LICENSE_extras and NOTICE_extras and then appended to the main
> > distribution files.
> > - Jar-level license/notices: The remaining files are being concatenated
> > into the META-INF folder of the Toree assembly jar, which sits in the lib/
> > directory of the bin.tar.gz.
> >
> > ```
> > LICENSE_commons-exec-1.3.txt
> > LICENSE_coursier-util_2.12-2.0.0
> > LICENSE_jackson-annotations-2.14.2
> > LICENSE_jackson-core-2.14.2
> > LICENSE_jackson-databind-2.14.2
> > LICENSE_jackson-datatype-jsr310-2.9.8
> > LICENSE_joda-time-2.10.1.txt
> > LICENSE_pekko-actor_2.12-1.1.5
> > LICENSE_pekko-slf4j_2.12-1.1.5
> > LICENSE_slf4j-api-2.0.16.txt
> > license_spring-core-5.2.2.RELEASE.txt
> > license_spring-jcl-5.2.2.RELEASE.txt
> > ...
> > NOTICE_commons-exec-1.3.txt
> > NOTICE_jackson-annotations-2.14.2
> > NOTICE_jackson-core-2.14.2
> > NOTICE_jackson-databind-2.14.2
> > NOTICE_joda-time-2.10.1.txt
> > NOTICE_pekko-actor_2.12-1.1.5
> > NOTICE_pekko-slf4j_2.12-1.1.5
> > notice_spring-core-5.2.2.RELEASE.txt
> > notice_spring-jcl-5.2.2.RELEASE.txt
> > ```
> >
> > Before we make further changes, I’d like to align on a strategy for how
> > these should appear in our distributions. Specifically:
> > - Top-level visibility: Is it mandatory to include all these details in
> > the top-level LICENSE and NOTICE files?
> > - Current assembly approach: Is our existing method—where the assembly
> > plugin concatenates these into the META-INF folder of the assembly
> > jar—sufficient for compliance?
> >
> > I’ve already addressed a few missing items in PR #239
> > <https://github.com/apache/incubator-toree/pull/239>, but I want to ensure
> > we have a consistent approach moving forward.
> >
> > --
> > Luciano Resende
> > http://twitter.com/lresende1975
> > http://lresende.blogspot.com/
Re: License and Notice location, was Re: [VOTE] Apache Toree 0.6.0 RC3
Posted by PJ Fanning <fa...@gmail.com>.
The issue under discussion is a fat jar - one bundles Toree classes
with lots of classes from 3rd party libs.
That jar must contain the details of all the licenses and notices from
the 3rd party classes - and also include our Apache license and
notice.
On Thu, 29 Jan 2026 at 05:31, Luciano Resende <lu...@gmail.com> wrote:
>
> On Wed, Dec 3, 2025 at 3:27 PM PJ Fanning <fa...@apache.org> wrote:
>
> > I think we're still missing NOTICE details for Apache licensed 3rd party
> > libs in the bin tar.gz.
> >
> > For instance, scala-xml has this NOTICE file:
> > https://github.com/scala/scala-xml/blob/main/NOTICE
> >
> > We don't seem to have this in the bin tar.gz.
> >
> > This is just one example. I think most of the Scala libs have NOTICE files
> > and there is a good chance that other ASL jars have them too.
> >
> > The Pekko NOTICE files are worth checking too because the document some
> > third party source in their jars.
> > For the pekko-actor jar, you have:
> > https://github.com/apache/pekko/blob/main/legal/pekko-actor-jar-notice.txt
> >
> >
> Hi PJ, sorry for the late reply...
>
> After looking into this further, I’ve identified a few key issues with how
> our licenses and notices are being handled:
> - Missing license/notices: The distribution isn't currently displaying all
> required license and notice files in its root.
> - Split sources: A large portion of these are currently linked in
> etc/legal/LICENSE_extras and NOTICE_extras and then appended to the main
> distribution files.
> - Jar-level license/notices: The remaining files are being concatenated
> into the META-INF folder of the Toree assembly jar, which sits in the lib/
> directory of the bin.tar.gz.
>
> ```
> LICENSE_commons-exec-1.3.txt
> LICENSE_coursier-util_2.12-2.0.0
> LICENSE_jackson-annotations-2.14.2
> LICENSE_jackson-core-2.14.2
> LICENSE_jackson-databind-2.14.2
> LICENSE_jackson-datatype-jsr310-2.9.8
> LICENSE_joda-time-2.10.1.txt
> LICENSE_pekko-actor_2.12-1.1.5
> LICENSE_pekko-slf4j_2.12-1.1.5
> LICENSE_slf4j-api-2.0.16.txt
> license_spring-core-5.2.2.RELEASE.txt
> license_spring-jcl-5.2.2.RELEASE.txt
> ...
> NOTICE_commons-exec-1.3.txt
> NOTICE_jackson-annotations-2.14.2
> NOTICE_jackson-core-2.14.2
> NOTICE_jackson-databind-2.14.2
> NOTICE_joda-time-2.10.1.txt
> NOTICE_pekko-actor_2.12-1.1.5
> NOTICE_pekko-slf4j_2.12-1.1.5
> notice_spring-core-5.2.2.RELEASE.txt
> notice_spring-jcl-5.2.2.RELEASE.txt
> ```
>
> Before we make further changes, I’d like to align on a strategy for how
> these should appear in our distributions. Specifically:
> - Top-level visibility: Is it mandatory to include all these details in
> the top-level LICENSE and NOTICE files?
> - Current assembly approach: Is our existing method—where the assembly
> plugin concatenates these into the META-INF folder of the assembly
> jar—sufficient for compliance?
>
> I’ve already addressed a few missing items in PR #239
> <https://github.com/apache/incubator-toree/pull/239>, but I want to ensure
> we have a consistent approach moving forward.
>
> --
> Luciano Resende
> http://twitter.com/lresende1975
> http://lresende.blogspot.com/