Hi, I agree with Ufuk that we can start with something simple, achievable, yet effective, like using flink-bot. The wiki that explains licensing of Flink is very good but hard to be found and noticed by new contributors, do we have plan to move it to a more discoverable place like flink.apache.org? Well, even with that, it may not be so directly effective as flinkt-bot IMO. We will of course also continue evaluating more automated ways to solve this problem.
Besides, there's another proposal from Jark [1] to use flink-bot to help community keep docs in English and Chinese in sync. Looks like we have general desires for flink-bot to remind contributors of different requirements according to modules they modify, and we may want to develop and adapt flink-bot to fulfill that need. I personally believe flink-bot has proven to be handy, productive and user-friendly since it's created, and we may increase investment on flink-bot for helping devs with miscellaneous issues like LICENSING and NOTICE. [1] http://apache-flink-mailing-list-archive.1008284.n3.nabble.com/DISCUSS-Improve-the-flinkbot-tp26965p27863.html On Tue, Mar 19, 2019 at 10:50 AM Ufuk Celebi <u...@apache.org> wrote: > There are definitely license checking tools around that can generate > NOTICE files etc. I don't have the details, but Robert should have > some input here. I don't know whether they would fit our setup and how > we would integrate them or whether INFRA can get them for is. > > Note that simple things can already improve the experience going > forward. A simple thing for the flink-bot could be to require/propose > a NOTICE file check whenever a pom.xml file was modified. What do you > think? > > – Ufuk > > On Tue, Mar 19, 2019 at 6:43 PM Chesnay Schepler <ches...@apache.org> > wrote: > > > > Realistically you can't automatically infer from changes to any pom > whether and what we have to change in the notice files. > > Doing this on the XML level requires a view over the entire project to > detect dependency changes in parent modules / dependency management and > packaging changes in downstream modules (like flink-dist); this would be > ridiculously complex check. > > > > Whether you have to change something can be inferred from the > shade-plugin output, but not 100% reliably (for example, if a dependency is > declared to be included but everything is filtered out (yeah, that > happened)). > > Theoretically it is even possible to generate the licensing files from > said output, but haven't had time yet to look into whether this is truly > possible. > > > > On 19.03.2019 07:15, Ufuk Celebi wrote: > > > > Hey Aljoscha, > > > > thanks for bringing this up. I think that we should either integrate > > checks for this into our CI/CD environment (using existing tools) or > > add a conditional check for this into flink-bot in case a pom.xml was > > modified. Otherwise it will be easy to forget in the future. > > > > – Ufuk > > > > On Mon, Mar 18, 2019 at 12:03 PM Aljoscha Krettek <aljos...@apache.org> > wrote: > > > > Hi All, > > > > Please remember to add newly added dependencies to the NOTICE file of > flink-dist (which will then end up in NOTICE-binary and so on). Discovering > this late will cause delays in releases, as it is doing now. > > > > There is a handy guide that Chesnay and Till worked on that explains > licensing for Apache projects and Flink specifically: > https://cwiki.apache.org/confluence/display/FLINK/Licensing < > https://cwiki.apache.org/confluence/display/FLINK/Licensing> > > > > Best, > > Aljoscha > > > > >
