I looked into new dependencies that timelineservice modules add (~ 50 at the individual artifact level). I arrived at that list by looking at the dependencies from these modules and removing the ones that are marked as "done" in Andrew's spreadsheet.
Most of them are ASLv2 licenses (e.g. HBase, Kerby, Tephra, Twill, etc.). I understand from
HADOOP-12893 that ASLv2, BSD, and MIT license do not require separate mentions in our L&N. I then arrive at the following that still needs to be examined:
(CDDL License) jsr311-api (javax.ws.rs:jsr311-api:1.1.1 - https://jsr311.dev.java.net)
(Mozilla Public License Version 1.1) jamon-runtime (org.jamon:jamon-runtime:2.3.1 - http://www.jamon.org/jamon-runtime/)
(Unknown license) sqlline (sqlline:sqlline:1.1.8 - no url defined)
It appears that sqlline is a 3-clause BSD license (https://github.com/julianhyde/sqlline). I suppose we're OK with the JSR 311 (CDDL license)? How about the Mozilla license?
Sean Busbey, I guess sqlline and jamon-runtime were looked at from the hbase and phoenix side of things? FYI, jsr311 is pulled in by jersey-core, jamon-runtime by hbase-server, and sqlline by phoenix-core.