Conversation
tuhaihe
marked this pull request as draft
September 16, 2026 02:53
The source release bundles no third-party code: there is no vendor/ directory, so LICENSE and NOTICE describe the source tree correctly. The convenience binary packages are a different artifact. They are statically linked Go binaries and therefore physically contain the code of every module in the build graph, plus the Go runtime and standard library and, because CGO is enabled for SQLite support, the SQLite amalgamation. Until now `make package` copied the source LICENSE and NOTICE verbatim into those packages, where the only third-party component listed is the Greenplum-derived code. That describes neither the 53 Go modules linked into the binaries nor the NOTICE files that eight of them ship, which the Apache License 2.0 requires us to propagate in section 4(d). Add the -binary variants, following the convention used by Apache Spark, Apache Kafka and apache/cloudberry#1994: LICENSE-binary -> installed as LICENSE NOTICE-binary -> installed as NOTICE licenses-binary/ -> installed as licenses/ They are generated by scripts/generate-binary-license.sh rather than maintained by hand. The script resolves the modules actually linked into each shipped binary on each released platform, so test-only dependencies such as Ginkgo and Gomega are left out, while platform-gated modules that appear only on Linux are included. A dependency bump that changes the inventory is caught by the new binary-license-check CI job, which runs the script with --check. The reproduced license texts carry their own upstream copyright notices and must not be given ASF headers, so they are excluded from the RAT scan. Verified against the actual artifacts: building the packages on Linux and reading the module list back out of the six shipped binaries with `go version -m` matches LICENSE-binary exactly, module for module and version for version. Backpatch-through: REL_2_STABLE
…files The inventory in LICENSE-binary is not a dependency list. What puts a component on it is that its compiled code is physically inside the shipped artifact, which for statically linked Go binaries means every module in the build graph, the Go runtime and, through cgo, the SQLite amalgamation. "Linked into the binaries" was a poor way to say that, because it reads just as naturally as "dynamically linked", which is the one case that does *not* belong on the list: the system C library is resolved from the host at run time, is not packaged with the binaries, and is correctly absent. Say "bundled" instead, and state the criterion and that exclusion outright, so a reviewer does not have to infer either. No change to which components are listed. Backpatch-through: REL_2_STABLE
NOTICE-binary is generated with NOTICE as its preamble, so dropping the license boilerplate from our own VMware attribution changes it too. The boilerplate that remains further down belongs to bundled third-party components and is reproduced from their own NOTICE files, which is what section 4(d) of the Apache License 2.0 asks for and what Apache Spark and Apache Kafka do with the one such case each of them carries. It is not ours to edit. Backpatch-through: REL_2_STABLE
cloudberry-go-libs carried the same VMware attribution that the Apache Incubator flagged on the Cloudberry 2.2.0-rc1 vote: a copyright notice followed by the full Apache License 2.0 boilerplate. Upstream has since dropped the boilerplate, in 0e762c9. We reproduce that NOTICE verbatim into NOTICE-binary under section 4(d), so the only way to fix our copy is to pick up theirs. Bump the dependency and regenerate. The range 3de23e2..0e762c9 changes no Go source: a release script, the NOTICE fix, and an x/net bump in go-libs' own go.mod that we already satisfy at v0.55.0. No other module moves in go.sum. The Apache boilerplate that remains in NOTICE-binary belongs to gopkg.in/yaml.v2 and go.yaml.in/yaml/v2, is written by Canonical in their own NOTICE, and is reproduced verbatim as section 4(d) requires. Apache Spark and Apache Kafka carry the equivalent scala-xml and Scala notices the same way. Backpatch-through: REL_2_STABLE
tuhaihe
force-pushed
the
binary-license-notice
branch
from
September 16, 2026 04:01
b345fb6 to
1498ae9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The source release bundles no third-party code: there is no vendor/ directory, so LICENSE and NOTICE describe the source tree correctly. The convenience binary packages are a different artifact. They are statically linked Go binaries and therefore physically contain the code of every module in the build graph, plus the Go runtime and standard library and, because CGO is enabled for SQLite support, the SQLite amalgamation.
Until now
make packagecopied the source LICENSE and NOTICE verbatim into those packages, where the only third-party component listed is the Greenplum-derived code. That describes neither the 53 Go modules linked into the binaries nor the NOTICE files that eight of them ship, which the Apache License 2.0 requires us to propagate in section 4(d).Add the -binary variants, following the convention used by Apache Spark, Apache Kafka and apache/cloudberry#1994:
They are generated by scripts/generate-binary-license.sh rather than maintained by hand. The script resolves the modules actually linked into each shipped binary on each released platform, so test-only dependencies such as Ginkgo and Gomega are left out, while platform-gated modules that appear only on Linux are included. A dependency bump that changes the inventory is caught by the new binary-license-check CI job, which runs the script with --check.
The reproduced license texts carry their own upstream copyright notices and must not be given ASF headers, so they are excluded from the RAT scan.
Verified against the actual artifacts: building the packages on Linux and reading the module list back out of the six shipped binaries with
go version -mmatches LICENSE-binary exactly, module for module and version for version.Backpatch-through: REL_2_STABLE
closes: #ISSUE_Number
Change logs
Contributor's checklist
Here are some reminders before you submit your pull request: