License: add binary license and notice files

.github/workflows/apache-rat-audit.yml

@@ -343,3 +343,29 @@ jobs:
             echo "FAILURE: One or more checks failed"
             exit 1
           fi
+
+  binary-license-check:
+    name: Binary compliance files
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Verify LICENSE-binary, NOTICE-binary and licenses-binary/
+        run: |
+          echo "The binaries we ship are statically linked, so LICENSE-binary"
+          echo "and NOTICE-binary must list every module linked into them."
+          echo "This check regenerates them from the build graph and fails if"
+          echo "the committed files have drifted, which happens whenever a"
+          echo "dependency is added, removed or bumped."
+          echo "----------------------------------------------------------------------"
+          ./scripts/generate-binary-license.sh --check

.gitignore

@@ -31,6 +31,11 @@ gpbackman
 
 !gpbackman/
 
+# Build output: "make package" writes the convenience tarballs here, and
+# the Apache RAT check writes its report to target/.
+build/
+target/
+
 # Logs
 *.log
 

Makefile

@@ -193,9 +193,17 @@ package:
 	@GOOS=$(GOOS) GOARCH=$(GOARCH) CGO_ENABLED=$(CGO) go build -tags '$(GPBACKMAN)' -o $(BUILD_DIR)/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-$(GOOS)-$(GOARCH)/bin/$(GPBACKMAN) --ldflags '-X $(GPBACKMAN_VERSION_STR)'
 	@GOOS=$(GOOS) GOARCH=$(GOARCH) CGO_ENABLED=$(CGO) go build -tags '$(EXPORTER)' -o $(BUILD_DIR)/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-$(GOOS)-$(GOARCH)/bin/$(EXPORTER) -ldflags "$(EXPORTER_VERSION_STR)"
 	@echo "Copying Apache compliance files..."
-	@cp LICENSE $(BUILD_DIR)/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-$(GOOS)-$(GOARCH)/
-	@cp NOTICE $(BUILD_DIR)/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-$(GOOS)-$(GOARCH)/
+# The binaries are statically linked, so they contain the code of every
+# module in the build graph. The package therefore ships the -binary
+# variants, which describe what is actually inside the artifact, under
+# the plain names. Regenerate them with scripts/generate-binary-license.sh.
+	@test -f LICENSE-binary || { echo "ERROR: LICENSE-binary is missing; run scripts/generate-binary-license.sh"; exit 1; }
+	@test -d licenses-binary || { echo "ERROR: licenses-binary/ is missing; run scripts/generate-binary-license.sh"; exit 1; }
+	@cp LICENSE-binary $(BUILD_DIR)/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-$(GOOS)-$(GOARCH)/LICENSE
+	@cp NOTICE-binary $(BUILD_DIR)/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-$(GOOS)-$(GOARCH)/NOTICE
 	@cp DISCLAIMER $(BUILD_DIR)/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-$(GOOS)-$(GOARCH)/
+	@rm -rf $(BUILD_DIR)/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-$(GOOS)-$(GOARCH)/licenses
+	@cp -a licenses-binary $(BUILD_DIR)/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-$(GOOS)-$(GOARCH)/licenses
 	@echo "Creating install script..."
 	@sed -e 's/__PACKAGE_NAME__/$(PACKAGE_NAME)/g' \
 	     -e 's/__BACKUP__/$(BACKUP)/g' \

NOTICE-binary

@@ -0,0 +1,160 @@
+Apache Cloudberry (Incubating)
+Copyright 2024-2026 The Apache Software Foundation
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+---------------------------------------------------------------------------
+
+This product includes software originally developed by VMware.
+
+Greenplum Database Backup
+Copyright 2017-Present VMware, Inc. or its affiliates. All Rights Reserved.
+
+================================================================================
+                     BINARY DISTRIBUTION - BUNDLED NOTICES
+================================================================================
+
+The convenience binary packages bundle the third-party components listed
+in LICENSE-binary.  The notices below are reproduced from those bundled
+components as required by section 4(d) of the Apache License 2.0.  They
+apply to the binary artifacts only; none of these components are present
+in the source release.
+
+This file is generated by scripts/generate-binary-license.sh.  Do not
+edit it by hand; re-run the script instead.
+
+--------------------------------------------------------------------------------
+github.com/apache/cloudberry-go-libs v1.0.12-0.20260915140105-0e762c961c5e
+--------------------------------------------------------------------------------
+
+Apache Cloudberry (Incubating)
+Copyright 2024-2026 The Apache Software Foundation
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+---------------------------------------------------------------------------
+
+This product includes software originally developed by VMware.
+
+Greenplum Database Common Go Libraries
+Copyright 2017-Present VMware, Inc. or its affiliates. All Rights Reserved.
+
+
+--------------------------------------------------------------------------------
+github.com/aws/aws-sdk-go v1.44.257
+--------------------------------------------------------------------------------
+
+AWS SDK for Go
+Copyright 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+Copyright 2014-2015 Stripe, Inc.
+
+
+--------------------------------------------------------------------------------
+github.com/coreos/go-systemd/v22 v22.6.0
+--------------------------------------------------------------------------------
+
+CoreOS Project
+Copyright 2018 CoreOS, Inc
+
+This product includes software developed at CoreOS, Inc.
+(http://www.coreos.com/).
+
+
+--------------------------------------------------------------------------------
+github.com/prometheus/client_golang v1.23.2
+--------------------------------------------------------------------------------
+
+Prometheus instrumentation library for Go applications
+Copyright 2012-2015 The Prometheus Authors
+
+This product includes software developed at
+SoundCloud Ltd. (http://soundcloud.com/).
+
+
+The following components are included in this product:
+
+perks - a fork of https://github.com/bmizerany/perks
+https://github.com/beorn7/perks
+Copyright 2013-2015 Blake Mizerany, Björn Rabenstein
+See https://github.com/beorn7/perks/blob/master/README.md for license details.
+
+Go support for Protocol Buffers - Google's data interchange format
+http://github.com/golang/protobuf/
+Copyright 2010 The Go Authors
+See source code for license details.
+
+
+--------------------------------------------------------------------------------
+github.com/prometheus/client_model v0.6.2
+--------------------------------------------------------------------------------
+
+Data model artifacts for Prometheus.
+Copyright 2012-2015 The Prometheus Authors
+
+This product includes software developed at
+SoundCloud Ltd. (http://soundcloud.com/).
+
+
+--------------------------------------------------------------------------------
+github.com/prometheus/common v0.67.5
+--------------------------------------------------------------------------------
+
+Common libraries shared by Prometheus Go components.
+Copyright 2015 The Prometheus Authors
+
+This product includes software developed at
+SoundCloud Ltd. (http://soundcloud.com/).
+
+
+--------------------------------------------------------------------------------
+github.com/prometheus/procfs v0.16.1
+--------------------------------------------------------------------------------
+
+procfs provides functions to retrieve system, kernel and process
+metrics from the pseudo-filesystem proc.
+
+Copyright 2014-2015 The Prometheus Authors
+
+This product includes software developed at
+SoundCloud Ltd. (http://soundcloud.com/).
+
+
+--------------------------------------------------------------------------------
+go.yaml.in/yaml/v2 v2.4.3
+--------------------------------------------------------------------------------
+
+Copyright 2011-2016 Canonical Ltd.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
+--------------------------------------------------------------------------------
+gopkg.in/yaml.v2 v2.4.0
+--------------------------------------------------------------------------------
+
+Copyright 2011-2016 Canonical Ltd.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+

README.apache.md

@@ -32,6 +32,48 @@ The following entities have contributed to the Greenplum Backup source code unde
 
 RAT matchers are used to classify their license headers accordingly.
 
+## Binary Distribution Compliance
+
+The source release bundles no third-party dependencies: there is no
+`vendor/` directory, so `LICENSE` and `NOTICE` describe the source tree on
+their own and are the files that apply to the source release.
+
+The convenience binary packages are a different artifact. They are
+statically linked Go binaries, so they physically contain the code of
+every module in the build graph, plus the Go runtime and standard library
+and — because CGO is enabled for SQLite support — the SQLite amalgamation.
+None of that is present in the source release. Following the convention
+used by Apache Spark, Apache Kafka and the Apache Cloudberry main
+repository, those packages therefore ship:
+
+| File in this repository | Installed in the package as | Contents |
+| --- | --- | --- |
+| `LICENSE-binary`  | `LICENSE`  | `LICENSE`, plus an inventory of every component bundled inside the binaries, grouped by license |
+| `NOTICE-binary`   | `NOTICE`   | `NOTICE`, plus the NOTICE files of bundled Apache-licensed components, as required by section 4(d) of the Apache License 2.0 |
+| `licenses-binary/` | `licenses/` | The verbatim license text of each bundled component, laid out by import path |
+
+These three are generated from the build graph rather than maintained by
+hand, so that adding, removing or bumping a dependency cannot silently
+invalidate them:
+
+```bash
+scripts/generate-binary-license.sh
+```
+
+The script resolves the modules actually compiled into each shipped
+binary, for each released platform, which means test-only dependencies
+such as Ginkgo and Gomega are correctly excluded, while platform-gated
+modules that only appear on Linux are correctly included.  Libraries that
+stay outside the artifact and are resolved from the host at run time, such
+as the system C library, are not bundled and so are not listed. `make package` copies
+the generated files into the tarball, and the `binary-license-check` job
+in the compliance workflow runs the script with `--check` to fail the
+build when the committed files have drifted.
+
+The license texts under `licenses-binary/` are reproduced unmodified from
+upstream and carry their own copyright notices, so they are excluded from
+the RAT scan and must not be given ASF headers.
+
 ## Compressed Files in Source
 
 The following compressed files are included in the source tree. These files are archives of text files used for testing purposes and do not contain binary executables. They are not used during the build process.

go.mod

@@ -5,7 +5,7 @@ go 1.25.0
 require (
 	github.com/DATA-DOG/go-sqlmock v1.5.0
 	github.com/alecthomas/kingpin/v2 v2.4.0
-	github.com/apache/cloudberry-go-libs v1.0.12-0.20260624080114-3de23e29a87a
+	github.com/apache/cloudberry-go-libs v1.0.12-0.20260915140105-0e762c961c5e
 	github.com/aws/aws-sdk-go v1.44.257
 	github.com/blang/semver/v4 v4.0.0
 	github.com/blang/vfs v1.0.0

go.sum

@@ -5,8 +5,8 @@ github.com/alecthomas/kingpin/v2 v2.4.0 h1:f48lwail6p8zpO1bC4TxtqACaGqHYA22qkHjH
 github.com/alecthomas/kingpin/v2 v2.4.0/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
 github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b h1:mimo19zliBX/vSQ6PWWSL9lK8qwHozUj03+zLoEB8O0=
 github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b/go.mod h1:fvzegU4vN3H1qMT+8wDmzjAcDONcgo2/SZ/TyfdUOFs=
-github.com/apache/cloudberry-go-libs v1.0.12-0.20260624080114-3de23e29a87a h1:xDVS0fObqCupd0eBTdk1OQC5vQJ9YD7KCyAsnP8zZXw=
-github.com/apache/cloudberry-go-libs v1.0.12-0.20260624080114-3de23e29a87a/go.mod h1:yaH60R8eMGETbTAAxrcBVXJ0T7WwWXPddm2LWLKB7kI=
+github.com/apache/cloudberry-go-libs v1.0.12-0.20260915140105-0e762c961c5e h1:whGrrxGScrNdPtqD5AOxTp4psjFjCBeEqxQmyJGHtN8=
+github.com/apache/cloudberry-go-libs v1.0.12-0.20260915140105-0e762c961c5e/go.mod h1:S9wcw2zjwgwMNr8rAVnxs/qgHe0QDK5HVb88rSwuDOQ=
 github.com/aws/aws-sdk-go v1.44.257 h1:HwelXYZZ8c34uFFhgVw3ybu2gB5fkk8KLj2idTvzZb8=
 github.com/aws/aws-sdk-go v1.44.257/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=

licenses-binary/github.com/alecthomas/kingpin/v2/COPYING

@@ -0,0 +1,19 @@
+Copyright (C) 2014 Alec Thomas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

licenses-binary/github.com/alecthomas/units/COPYING

@@ -0,0 +1,19 @@
+Copyright (C) 2014 Alec Thomas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.