[jira] [Created] (KAFKA-21287) Fix 'licenses' folder contents and 'LICENSE-binary' file references

["Dejan Stojadinović (Jira)" <ji...@apache.org>]

Dejan Stojadinović created KAFKA-21287:
------------------------------------------

             Summary: Fix 'licenses' folder contents and 'LICENSE-binary' file references
                 Key: KAFKA-21287
                 URL: https://issues.apache.org/jira/browse/KAFKA-21287
             Project: Kafka
          Issue Type: Bug
          Components: build
            Reporter: Dejan Stojadinović


h1. Kafka licenses/ folder audit

 

The {{licenses/}} folder shipped in the Kafka binary distribution has drifted from the dependencies it covers: one referenced file is missing, one has the wrong license text, four ship for nothing, and several copyright lines are stale. CI only compares versions in {{{}LICENSE-binary{}}}, never the contents of {{{}licenses/{}}}.
h2. Findings

16 files in {{licenses/}} were compared with the {{LICENSE-binary}} references and with the license each dependency ships at its current version ({{{}gradle/dependencies.gradle{}}}).
||#||File / entry||Problem||Fix||
|1|{{jakarta.activation-2.0.1}} → {{licenses/jakarta-BSD-3-clause}}|Referenced file does not exist. The jar's own {{META-INF/LICENSE.md}} is EDL 1.0 (BSD-3, Copyright 2018 Oracle).|Point to {{licenses/eclipse-distribution-license-1.0}}|
|2|{{protobuf-java-BSD-3-clause}}|Wrong text: "Copyright 2023, the original author or authors" (jline's wording). Upstream v25.5 is "Copyright 2008 Google Inc."|Replace with upstream v25.5 {{LICENSE}}|
|3|{{mock-oauth2-server-MIT}}|Test-only dependency ({{{}testImplementation{}}}), not bundled|Delete|
|3|{{jsr305-BSD-3-clause}}|Dependency dropped from {{LICENSE-binary}} in 2025, file left behind|Delete|
|3|{{paranamer-BSD-3-clause}}|Same as jsr305|Delete|
|3|{{eclipse-distribution-license-1.0}}|Not referenced, although it is the right file for #1 and #4|Reference it|
|4|{{{}jakarta.activation-api-2.1.0{}}}, {{jakarta.xml.bind-api-3.0.1}}|Listed as CDDL 1.1 + GPLv2; POM and jar say EDL 1.0|Move to an EDL 1.0 section|
|4|{{jakarta.servlet-api-6.0.0}}|Listed as CDDL 1.1 + GPLv2; POM says EPL 2.0 / GPL2 w/ CPE|Move to the EPL 2.0 section|
|4|{{CDDL+GPL-1.1}}|Unreferenced once the three jars above move|Delete|
|5|{{classgraph-MIT}} (4.8.196)|2019 vs upstream 2026|Upstream text|
|5|{{slf4j-MIT}} (1.7.36)|2004-2017 QOS.ch vs 2004-2022 QOS.ch Sarl (Switzerland)|Upstream text|
|5|{{jline-BSD-3-clause}} (3.30.17)|2002-2018 vs 2002-2023|Upstream text|
|5|{{jopt-simple-MIT}} (5.0.4)|2004-2016 vs 2004-2015 at the tag|Upstream text|
|5|{{argparse-MIT}} (0.7.0)|2011-2017 vs 2011, 2014, 2015 at the tag|Upstream text|
|5|{{zstd-jni-BSD-2-clause}} (1.5.7-17)|Extra title line; "BSD License" vs "BSD-2-Clause License" + URL|Upstream text|
|–|{{{}pcollections-MIT{}}}, {{{}hdrHistogram-BSD-2-clause{}}}, {{{}re2j-GO{}}}, {{eclipse-public-license-2.0}}|Match upstream|None|
h2. Proposed change

One {{MINOR}} PR, branch {{{}MINOR-fix-licenses-folder{}}}, touches only {{LICENSE-binary}} and {{{}licenses/{}}}.
 * {{{}LICENSE-binary{}}}: replace the "CDDL 1.1 + GPLv2" section with an "Eclipse Distribution License - v 1.0" section ({{{}jakarta.activation-2.0.1{}}}, {{{}jakarta.activation-api-2.1.0{}}}, {{{}jakarta.xml.bind-api-3.0.1{}}}); add {{jakarta.servlet-api-6.0.0}} to the EPL 2.0 section; drop the broken {{jakarta-BSD-3-clause}} line.
 * Replaced with upstream text at the current version: {{{}protobuf-java-BSD-3-clause{}}}, {{{}classgraph-MIT{}}}, {{{}slf4j-MIT{}}}, {{{}jline-BSD-3-clause{}}}, {{{}jopt-simple-MIT{}}}, {{{}argparse-MIT{}}}, {{{}zstd-jni-BSD-2-clause{}}}.
 * Deleted: {{{}mock-oauth2-server-MIT{}}}, {{{}jsr305-BSD-3-clause{}}}, {{{}paranamer-BSD-3-clause{}}}, {{{}CDDL+GPL-1.1{}}}.

h2. Verification

A fresh {{./gradlew clean releaseTarGz}} on the fix branch confirms the change.
 * The third-party jars in {{libs/}} match the entries in {{LICENSE-binary}} exactly. Nothing is missing on either side.
 * Every {{licenses/...}} path in {{LICENSE-binary}} exists, and every file in {{licenses/}} is referenced.
 * {{jakarta.servlet-api}} is bundled at 6.0.0, as {{LICENSE-binary}} says, even though {{dependencies.gradle}} declares 6.1.0. The 6.1.0 declaration does not reach the runtime classpath.
 * The tarball's {{licenses/}} now holds 12 files, down from 16.

h2. How it drifted

Each problem traces back to one commit. The CI step {{committer-tools/verify_license.py}} (KAFKA-17607) only matches jar names in {{libs/}} against {{{}LICENSE-binary{}}}, so none of these failed a build.
||Date||Commit||What happened||
|2026-05-07|KAFKA-20555 (#22232)|Removed the EDL 1.0 section and moved {{jakarta.activation-api}} and {{jakarta.xml.bind-api}} under CDDL|
|2025-06-12|KAFKA-19153 (#19938)|Added {{mock-oauth2-server-MIT}} for a test-only dependency|
|2025-02-18/19|#18943, #18950|Removed paranamer and jsr305 from {{{}LICENSE-binary{}}}, left their files|
|2025-01-01|KAFKA-18375 (#18359)|Added {{jakarta.activation-2.0.1}} pointing to the non-existent {{{}licenses/jakarta-BSD-3-clause{}}}, and {{jakarta.servlet-api-6.0.0}} under CDDL next to {{javax.servlet-api-3.1.0}}|
|2023-11-29|#14833|Added {{protobuf-java-BSD-3-clause}} with generic wording instead of Google's text|
|2021-04-06|KAFKA-12602 (#10474)|Added argparse and jopt-simple texts copied from newer upstream releases than the bundled jars. Later version bumps of slf4j, jline and classgraph never refreshed their texts|

 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)