Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Source release: ship only the top-level LICENSE and NOTICE, not the subdirectory copies

Ouverte
  • Quelque chose ne va pas ?
#268 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
35/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
docker
Domaine
build-system, release

Piste de recherche

Start with no-release.txt and the listed Dockerfiles, especially oplugins-op/Dockerfile, streamer/Dockerfile, admin-api/Dockerfile, and the runtime image Dockerfiles. Trace how source archives and image builds consume the license files, then verify that the source tarball contains only the intended top-level files while image builds still receive their required licensing files.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

The 0.9.0-incubating-RC7 source release (apache-openserverless-0.9.0-incubating-src.tar.gz) contains the top-level LICENSE, NOTICE and DISCLAIMER, plus 85 more LICENSE/NOTICE/DISCLAIMER files in subdirectories. They come from the submodules and from each runtime image directory:

  • one set per submodule: admin-api/, build/, cli/, devcontainer/, oplugins/, oplugins-op/, runtimes/, streamer/, testing/;
  • one set per runtime image: runtimes/runtime/{go,java,nodejs,python}/*/ and runtimes/experimental/*/;
  • build/openwhisk/LICENSE.txt, NOTICE.txt and licenses/LICENSE-spray.txt (from the vendored OpenWhisk sources);
  • cli/tests/oplugins/LICENSE (test data).

Together they run to about 94,000 lines (runtimes/LICENSE alone is 37,204 lines).

Please ship only the top-level LICENSE and NOTICE in the source release, and leave the subdirectory ones out (e.g. via no-release.txt).

Why

For the source release, the top-level LICENSE and NOTICE are the ones that count. The subdirectory files mostly describe something else: the container images built from each directory, which bundle OS packages, language runtimes and dependencies that are not in the source release. Shipping them in the source tarball is confusing for users and reviewers, who cannot tell which file applies to what. It also means the same facts are maintained in many places, and they have already drifted apart. In RC7:

  • oplugins/LICENSE and oplugins-op/LICENSE state that the source distribution "is licensed in its entirety under the Apache License, Version 2.0". The top-level LICENSE correctly lists MIT, ISC and BSD-3-Clause code in the source (the pre-built JavaScript bundles), and there is more that is not yet listed (#260).
  • 20 of the subdirectory LICENSE/NOTICE files refer readers to a WARN file, but no-release.txt removes every WARN file from the source release.
  • 19 of the subdirectory NOTICE files say Copyright 2024 The Apache Software Foundation; the top-level NOTICE and 8 others say Copyright 2024-2026.
  • oplugins-op/LICENSE says the operator bundles gradlew/gradlew.bat and ConcurrentMapBackedCache.scala; neither exists under oplugins-op/.
  • Third-party content that should be attributed (cert-manager #263, Kvrocks #262, Milvus #260) is missing from the subdirectory files as well as the top-level ones. So there are two places to fix instead of one, and no place that is complete.

With only the top-level files, there is one place to review and keep correct for each release.

Things to handle

  1. Image builds use these files. 26 Dockerfiles COPY their directory's DISCLAIMER LICENSE NOTICE into the image (e.g. oplugins-op/Dockerfile:152, streamer/Dockerfile:30, admin-api/Dockerfile:47, every runtimes/runtime/*/*/Dockerfile, build/standalone/Dockerfile:47). The images do need their own LICENSE/NOTICE (as convenience binaries), so dropping the files from the source tarball needs one of:
    • generate the image LICENSE/NOTICE at image build time (they are largely derived from the image contents anyway); or
    • keep them in git but outside the source release, and have the image build (CI) supply them; or
    • if they must stay in the source tree, rename them (e.g. LICENSE-image, NOTICE-image) and add a first line saying they describe the container image, not the source, so they are not mistaken for the source release's licensing.
  2. The top-level LICENSE points at build/openwhisk/licenses/LICENSE-spray.txt. Either keep that one file, or inline the Spray licence text in the top-level LICENSE. The Spray licence is Apache-2.0, already reproduced there.
  3. build/openwhisk/LICENSE.txt / NOTICE.txt are the vendored OpenWhisk project's own files. The top-level NOTICE already carries the OpenWhisk attribution, so they can go too.
  4. Optional: the same applies to the 27 subdirectory DISCLAIMER files, which duplicate the top-level DISCLAIMER.

Related: #260, #262, #263, #267.

Langage dominant
Python
Étoiles
576
Forks
29
Merge moyen
7 h 7 min
PR mergées (30 j)
5

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de apache/openserverless

Toutes les issues de apache/openserverless

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.