Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Top-level LICENSE/NOTICE: bundled JavaScript copyright notices belong in LICENSE, and several are inaccurate

Ouverte Adaptée aux débutants
  • Quelque chose ne va pas ?
#267 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
2/5
Temps estimé
1-3 heures
Accessibilité débutants
84/100
Type d'issue
Documentation
Clarté
Clairement spécifiée
Activité
Active
Stack technique
javascript
Domaine
documentation

Piste de recherche

Commencez par les sections LICENSE et NOTICE de niveau supérieur couvrant PRE-BUILT JAVASCRIPT, puis comparez les lignes de copyright des packages listés avec les fichiers LICENSE upstream des versions incluses. Vérifiez les bundles référencés, oplugins/util/upload.js et oplugins/admin/usage/usage.js, afin de confirmer le périmètre du package. Le travail est terminé lorsque les mentions upstream corrigées se trouvent à côté des entrées des packages dans LICENSE et que la section JavaScript inclus, y compris MinIO, est supprimée de NOTICE.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

In the 0.9.0-incubating-RC7 source release, the copyright notices of the npm packages embedded in the pre-built JavaScript bundles (oplugins/util/upload.js, oplugins/admin/usage/usage.js) are in the top-level NOTICE rather than in LICENSE, and several of them do not match the upstream packages.

1. The notices are in NOTICE instead of LICENSE

The top-level LICENSE section "BUNDLED COMPONENTS -- PRE-BUILT JAVASCRIPT" lists each package by name and version, and reproduces the MIT, ISC and BSD-3-Clause licence texts once each. It does not include the packages' copyright lines. Those licences require "the above copyright notice" to be kept with the permission notice, so the copyright lines belong with the licence texts in LICENSE.

Instead, the copyright lines are in the top-level NOTICE (lines 69-162, about 90 lines: MinIO, the 24 MIT packages, the ISC and BSD-3-Clause packages, and yaml).

The ASF licensing guide says this is the wrong place:

Under normal circumstances, there is no need to modify NOTICE to mention a bundled dependency [under a permissive licence].

Do not add anything to NOTICE which is not legally required.

https://infra.apache.org/licensing-howto.html#permissive-deps and https://infra.apache.org/licensing-howto.html#mod-notice

It also notes that the copyright notices embedded in BSD and MIT licences do not need to be duplicated in NOTICE.

The MinIO entry in NOTICE is not needed either: minio-js 8.0.1 is Apache-2.0 but ships no NOTICE file, so there is nothing to propagate.

2. Copyright lines that differ from upstream

Checked against each package's own LICENSE at the bundled version (via unpkg):

Package (version) Top-level NOTICE says Upstream LICENSE says
fast-xml-parser (4.5.0) Copyright (c) 2021 Natural Intelligence Copyright (c) 2017 Amit Kumar Gupta
mime-db (1.52.0) Copyright (c) 2014 Jonathan Ong Copyright (c) 2014 Jonathan Ong; Copyright (c) 2015-2022 Douglas Christopher Wilson
mime-types (2.1.35) Copyright (c) 2014 Jonathan Ong Copyright (c) 2014 Jonathan Ong; Copyright (c) 2015 Douglas Christopher Wilson
readable-stream (3.6.2), string_decoder (1.3.0) Copyright Joyent, Inc. and other Node contributors Copyright Node.js contributors. All rights reserved.; Copyright Joyent, Inc. and other Node contributors. All rights reserved.
sax (1.4.1) Copyright (c) Isaac Z. Schlueter and Contributors Copyright (c) 2010-2024 Isaac Z. Schlueter and Contributors; Copyright (c) 2010-2024 Mathias Bynens
stream-chain (2.2.5) Copyright (c) 2005-2024, Eugene Lazutkin Copyright 2019 Eugene Lazutkin
stream-json (1.8.0) Copyright (c) 2005-2024, Eugene Lazutkin Copyright (c) 2005-2018, Eugene Lazutkin
decode-uri-component (0.2.2) Copyright (c) Sam Verschueren Copyright (c) 2017, Sam Verschueren

The others match, or differ only in omitted e-mail addresses. block-stream2 2.1.0 has no copyright line in its LICENSE, so "Copyright (c) James Halliday" (its package.json author) is a reasonable choice.

Suggested fix

  1. In the top-level LICENSE "PRE-BUILT JAVASCRIPT" section, put each package's upstream copyright line(s) next to its name, corrected as in the table above. The licence texts already there can stay.
  2. Remove the bundled-JavaScript section (lines 69-162) from the top-level NOTICE, including the MinIO entry.

Related: #260.

Langage dominant
Python
Étoiles
576
Forks
29
Merge moyen
7 h 7 min
PR mergées (30 j)
5

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de apache/openserverless

Toutes les issues de apache/openserverless

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.