[FLINK-22555] LGPL-2.1 files in flink-python jars

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.13.0, 1.12.3
• Fix Version/s: 1.13.1, 1.12.4
• Component/s: API / Python
• Labels: pull-request-available
• Assignee: Chesnay Schepler
• Reporter: Henri Yandell
• Created: 03/May/21 20:12
• Updated: 28/Aug/21 11:18
• Resolved: 09/May/21 18:25

Description

Looking at, for example, https://repo1.maven.org/maven2/org/apache/flink/flink-python_2.11/1.13.0/ the jar file contains three LGPL-2.1 source files:

• flink-python_2.11-1.13.0/META-INF/maven/org.jboss.modules/jboss-modules/pom.xml
• flink-python_2.11-1.13.0/schema/module-1_1.xsd
• flink-python_2.11-1.13.0/schema/module-1_0.xsd

There's nothing in the DEPENDENCIES or licenses directory on the topic. It looks like Netty brings in the LGPL-2.1 JBoss dependency (depending on the Apache-2.0 JBoss Marshalling, which depends on the LGPL-2.1 JBoss Modules).

The xsd files are also appear to be coming from JBoss Modules. Given Apache's position on LGPL-2.1 dependency inclusion in ASF projects, this seems like an issue.

Issue Links

• links to: GitHub Pull Request #15827