> Instead, since you are including dep1 and dep2 inside >giraph-bin.tar.gz, they should be covered by the NOTICE/LICENSE pair > of the tarball. This is the case for Giraph (and Kafka and other projects that bring in transitive dependencies into the tar.gz via maven), so the jackrabbit approach won't work. Which puts me back at my original question: how to include N&L for the binary distribution without having to re-create it on the release branch each time. I'll take a look at Whisker, but for now it seems like one just needs to have a release-specific N&L for the binary artifact?
-jg On Tue, Jan 31, 2012 at 6:05 AM, sebb <seb...@gmail.com> wrote: > On 31 January 2012 11:07, Jukka Zitting <jukka.zitt...@gmail.com> wrote: >> Hi, >> >> On Tue, Jan 31, 2012 at 2:49 AM, Jakob Homan <jgho...@gmail.com> wrote: >>> Great, thanks. Using this method, I get a file layout similar to: >>> giraph-0.1-SNAPSHOT-bin.tar.gz >>> NOTICE (without appended text for dep1 and dep2) >>> LICENSE (without appended text for dep1 and dep2) >>> bin/ >>> lib/ >>> dep1.jar >>> dep2.jar >>> giraph.jar >>> META-INF/ >>> NOTICE (with appended text for dep1 and dep2) >>> LICENSE (with appended text for dep1 and dep2) >>> >>> This matches with what I see when I checkout the jackrabbit-standalone >>> code and do a package command from maven there. I just want to verify >>> that this will past muster with incubator. This configuration >>> satisfies the requirement for those notices/licenses to be included? >> >> The general idea is that the NOTICE/LICENSE pair of an artifact should >> cover all the bits included inside that artifact. > > Also the idea is that the N&L (and Disclaimer, Readme if any) are at > the top-level of the artifact. > > The only exception to this is that N&L files are added to a jar > META-INF directory instead (as that is the convention for jars) . > > Having the files in a standard place is intended to make it easy for > the consumer to find the files. > > The N&L files are important for the consumer; they should not have to > go looking for them. > >> If giraph.jar doesn't embed dep1 and dep2, then there's no need to >> mention them in the NOTICE/LICENSE pair of that jar. >> >> Instead, since you are including dep1 and dep2 inside >> giraph-bin.tar.gz, they should be covered by the NOTICE/LICENSE pair >> of the tarball. >> >> If you look inside the jackrabbit-standalone jar, you'll notice that >> it actually contains all the external components mentioned in the >> NOTICE/LICENSE files. >> >> BR, >> >> Jukka Zitting >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org >> For additional commands, e-mail: general-h...@incubator.apache.org >> > > --------------------------------------------------------------------- > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org > --------------------------------------------------------------------- To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
