[LIVY-982] THIRD-PARTY file in binary release zip has licenses for jars that do not appear in the zip

• Type: Task
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: Build
• Assignee: Unassigned
• Reporter: PJ Fanning
• Created: 31/Jul/23 18:50
• Updated: 31/Jul/23 18:50

Description

The 0.8.0-incubating binaries at https://dist.apache.org/repos/dist/dev/incubator/livy/0.8.0-incubating-rc1/ include a THIRD-PARTY file.

https://dist.apache.org/repos/dist/dev/incubator/livy/0.8.0-incubating-rc1/

I checked some of the Category X licensed jars and some of them don't seem to be in  apache-livy-0.8.0-incubating_2.12-bin.

We shouldn't include them in the THIRD-PARTY file if we don't include the jar in the bin zip.

Example:

• Javassist (org.javassist:javassist:3.18.1-GA - http://www.javassist.org/)
• JTransforms (com.github.rwl:jtransforms:2.4.0 - http://sourceforge.net/projects/jtransforms/)
• javax.ws.rs-api (javax.ws.rs:javax.ws.rs-api:2.0.1 - http://jax-rs-spec.java.net)
• of all the jersey jars in THIRD-PARTY, only 1 is actually included in the zip

 

• • jersey-client-1.9.jar (and one of its licenses is CDDL 1.1 - so this is ok to include)

 

Issue Links

• relates to: LIVY-981 licensing of ldapsdk