Skip to content

License: add binary license and notice files - #118

Draft
tuhaihe wants to merge 4 commits into
apache:mainfrom
tuhaihe:binary-license-notice
Draft

tuhaihe wants to merge 4 commits into
apache:mainfrom
tuhaihe:binary-license-notice

Conversation

@tuhaihe

@tuhaihe tuhaihe commented Sep 16, 2026

Copy link
Copy Markdown
Member

The source release bundles no third-party code: there is no vendor/ directory, so LICENSE and NOTICE describe the source tree correctly. The convenience binary packages are a different artifact. They are statically linked Go binaries and therefore physically contain the code of every module in the build graph, plus the Go runtime and standard library and, because CGO is enabled for SQLite support, the SQLite amalgamation.

Until now make package copied the source LICENSE and NOTICE verbatim into those packages, where the only third-party component listed is the Greenplum-derived code. That describes neither the 53 Go modules linked into the binaries nor the NOTICE files that eight of them ship, which the Apache License 2.0 requires us to propagate in section 4(d).

Add the -binary variants, following the convention used by Apache Spark, Apache Kafka and apache/cloudberry#1994:

  LICENSE-binary   -> installed as LICENSE
  NOTICE-binary    -> installed as NOTICE
  licenses-binary/ -> installed as licenses/

They are generated by scripts/generate-binary-license.sh rather than maintained by hand. The script resolves the modules actually linked into each shipped binary on each released platform, so test-only dependencies such as Ginkgo and Gomega are left out, while platform-gated modules that appear only on Linux are included. A dependency bump that changes the inventory is caught by the new binary-license-check CI job, which runs the script with --check.

The reproduced license texts carry their own upstream copyright notices and must not be given ASF headers, so they are excluded from the RAT scan.

Verified against the actual artifacts: building the packages on Linux and reading the module list back out of the six shipped binaries with go version -m matches LICENSE-binary exactly, module for module and version for version.

Backpatch-through: REL_2_STABLE

closes: #ISSUE_Number


Change logs

Describe your change clearly, including what problem is being solved or what document is being added or updated.

Contributor's checklist

Here are some reminders before you submit your pull request:

@tuhaihe
tuhaihe marked this pull request as draft September 16, 2026 02:53
The source release bundles no third-party code: there is no vendor/
directory, so LICENSE and NOTICE describe the source tree correctly.
The convenience binary packages are a different artifact. They are
statically linked Go binaries and therefore physically contain the code
of every module in the build graph, plus the Go runtime and standard
library and, because CGO is enabled for SQLite support, the SQLite
amalgamation.

Until now `make package` copied the source LICENSE and NOTICE verbatim
into those packages, where the only third-party component listed is the
Greenplum-derived code. That describes neither the 53 Go modules linked
into the binaries nor the NOTICE files that eight of them ship, which
the Apache License 2.0 requires us to propagate in section 4(d).

Add the -binary variants, following the convention used by Apache Spark,
Apache Kafka and apache/cloudberry#1994:

  LICENSE-binary   -> installed as LICENSE
  NOTICE-binary    -> installed as NOTICE
  licenses-binary/ -> installed as licenses/

They are generated by scripts/generate-binary-license.sh rather than
maintained by hand. The script resolves the modules actually linked into
each shipped binary on each released platform, so test-only dependencies
such as Ginkgo and Gomega are left out, while platform-gated modules that
appear only on Linux are included. A dependency bump that changes the
inventory is caught by the new binary-license-check CI job, which runs
the script with --check.

The reproduced license texts carry their own upstream copyright notices
and must not be given ASF headers, so they are excluded from the RAT
scan.

Verified against the actual artifacts: building the packages on Linux and
reading the module list back out of the six shipped binaries with
`go version -m` matches LICENSE-binary exactly, module for module and
version for version.

Backpatch-through: REL_2_STABLE
…files

The inventory in LICENSE-binary is not a dependency list. What puts a
component on it is that its compiled code is physically inside the
shipped artifact, which for statically linked Go binaries means every
module in the build graph, the Go runtime and, through cgo, the SQLite
amalgamation.

"Linked into the binaries" was a poor way to say that, because it reads
just as naturally as "dynamically linked", which is the one case that
does *not* belong on the list: the system C library is resolved from the
host at run time, is not packaged with the binaries, and is correctly
absent. Say "bundled" instead, and state the criterion and that
exclusion outright, so a reviewer does not have to infer either.

No change to which components are listed.

Backpatch-through: REL_2_STABLE
NOTICE-binary is generated with NOTICE as its preamble, so dropping the
license boilerplate from our own VMware attribution changes it too.

The boilerplate that remains further down belongs to bundled third-party
components and is reproduced from their own NOTICE files, which is what
section 4(d) of the Apache License 2.0 asks for and what Apache Spark and
Apache Kafka do with the one such case each of them carries. It is not
ours to edit.

Backpatch-through: REL_2_STABLE
cloudberry-go-libs carried the same VMware attribution that the Apache
Incubator flagged on the Cloudberry 2.2.0-rc1 vote: a copyright notice
followed by the full Apache License 2.0 boilerplate. Upstream has since
dropped the boilerplate, in 0e762c9.

We reproduce that NOTICE verbatim into NOTICE-binary under section 4(d),
so the only way to fix our copy is to pick up theirs. Bump the dependency
and regenerate.

The range 3de23e2..0e762c9 changes no Go source: a release script, the
NOTICE fix, and an x/net bump in go-libs' own go.mod that we already
satisfy at v0.55.0. No other module moves in go.sum.

The Apache boilerplate that remains in NOTICE-binary belongs to
gopkg.in/yaml.v2 and go.yaml.in/yaml/v2, is written by Canonical in their
own NOTICE, and is reproduced verbatim as section 4(d) requires. Apache
Spark and Apache Kafka carry the equivalent scala-xml and Scala notices
the same way.

Backpatch-through: REL_2_STABLE
@tuhaihe
tuhaihe force-pushed the binary-license-notice branch from b345fb6 to 1498ae9 Compare September 16, 2026 04:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant