[GitHub] ivankelly commented on issue #888: Rework of binary distribution licenses

[GitBox <gi...@apache.org>]

ivankelly commented on issue #888: Rework of binary distribution licenses
URL: https://github.com/apache/bookkeeper/pull/888#issuecomment-355923733
 
 
   >  if the LICENSE and NOTICE file can not be generated automatically and still need reviews and eyes, I would suggest removing removing versions from the jars. This increases inconvenience for contributors who sends PRs to bump the version. We should make things easier for contributors.
   
   LICENSEs and NOTICEs can change between versions. Dependencies can be added or removed. They can pull in code from thirdparties into their own jar. Without the version, we go back to not having a clue what we are actually shipping.
   
   If you don't want to add a burden on contributors when bumping versions, then we shouldn't ship binary distributions. It's as simple as that.
   
   >  line 205-305 in LICENSE-all.bin.txt isn't really needed.
   
   Yes, they're not absolutely needed. However, they're there so that the tool can automatically check that everything we ship in the tarball mentioned in the LICENSE. Otherwise, this check is 100% manual. There are 73 jars there. That's a lot of room for omissions and mistakes. And people won't check it, they haven't been checking it so far.
   
   The URLs are their to make it easier to bump the versions. If a dependency version changes, it should be trivial to find the NOTICE/LICENSE of the newer version.
   
   > please move deps to all module or rename it to deps/all/ rather than in the root module. because server module has different deps than all module. it is confusing and unclear deps is used by what module. and we should not include licenses that we don't bundle.
   
   Server module deps are a subset of all module deps. If I move it to the all module it will mean having duplicate copies of some of the licenses in the source tree. I'll move if you're ok with the dupes.
   

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services