> * You have MIT Licensed code but no mention of it in your LICENSE [1]. > One example [2] but there is another g4 file with the same header. > * The LICENSE mentions BSD LIcense for Antlr and maybe this relates to > these MIT Licensed files but this isn't clear
A little bit of confusion, hope to get an answer. The source code MySqlLexer.g4[1] is copied from the MySqlLexer.g4[2] in the antlr/grammars-v4[3] repository. The github repository of antlr/grammars-v4 does not have a specific license. Different source files in its source code contain different license headers, such as MIT and BSD 3-Clause headers. The official website of antlr states that it is under the BSD 3-Clause[4] license. What license should be declared under subcomponents in Seata's source license? [1]. https://github.com/apache/incubator-seata/blob/238cf3ab8e0c6f781e52f8efec19d54bab40cef0/sqlparser/seata-sqlparser-antlr/src/main/java/org/apache/seata/sqlparser/antlr/mysql/antlr/MySqlLexer.g4 [2]. https://github.com/antlr/grammars-v4/blob/master/sql/mysql/Positive-Technologies/MySqlLexer.g4 [3]. https://github.com/antlr/grammars-v4/tree/master [4]. https://www.antlr.org/license.html Warm regards, Ji Min PJ Fanning <fannin...@apache.org> 于2024年7月7日周日 03:00写道： > > -1 (binding) from me > > * You have MIT Licensed code but no mention of it in your LICENSE [1]. > One example [2] but there is another g4 file with the same header. > * The LICENSE mentions BSD LIcense for Antlr and maybe this relates to > these MIT Licensed files but this isn't clear > * there is another MIT licensed source file with no mention in your LICENSE > [3] > * seata-server/templates/_helpers.tpl [5] is a copy of a file in > github.com/open-hand/hzero-starter-parent/ - this should be mentioned > in your LICENSE unless the file in > github.com/open-hand/hzero-starter-parent/ is a copy of your file > * The LICENSE in your binary file could really be made easier to use > by explicitly including the names of the licenses instead of including > links to the license files many of which are not browser friendly. The > Abego one has an expired HTTPS cert. > * The LICENSE in your binary file should state which license you want > to use when the dependency has more than 1 license > * as an example, with 'CDDL-1.0 and GPL-2.0' [4], you should state > that you choose CDDL-1.0 because GPL-2.0 is not allowed > * more of a nit but I think you should use tar.gz for both the src and > bin artifacts - it seems odd to use zip for src and tar.gz for bin > > > > [1] https://github.com/apache/incubator-seata/blob/2.x/LICENSE > [2] > https://github.com/apache/incubator-seata/blob/238cf3ab8e0c6f781e52f8efec19d54bab40cef0/sqlparser/seata-sqlparser-antlr/src/main/java/org/apache/seata/sqlparser/antlr/mysql/antlr/MySqlLexer.g4 > [3] > https://github.com/apache/incubator-seata/blob/238cf3ab8e0c6f781e52f8efec19d54bab40cef0/console/src/main/resources/static/saga-statemachine-designer/bundle.js.LICENSE.txt > [4] > https://github.com/apache/incubator-seata/blob/238cf3ab8e0c6f781e52f8efec19d54bab40cef0/distribution/LICENSE#L610 > [5] > https://github.com/open-hand/hzero-starter-parent/blob/af7589bc0041f687b143e77f2171b1fd79ba0a9d/hzero-starter-seata/src/main/resources/script/server/helm/seata-server/templates/_helpers.tpl > > On Sat, 6 Jul 2024 at 19:17, PJ Fanning <fannin...@apache.org> wrote: > > > > I think it would be better to put RC4 in the directory name of the release > > dir. > > > > https://dist.apache.org/repos/dist/dev/incubator/seata/incubator-seata/2.1.0/ > > should be > > https://dist.apache.org/repos/dist/dev/incubator/seata/incubator-seata/2.1.0-RC4/ > > or even > > https://dist.apache.org/repos/dist/dev/incubator/seata/2.1.0-RC4/ > > > > Don't put the RC4 in the name of the tar.gz files or the directory > > names inside the tar.gz. > > > > Again, not a reason to restart the release process - but a suggestion > > for the next RC whenever that is. > > > > On Fri, 5 Jul 2024 at 18:14, tison <wander4...@gmail.com> wrote: > > > > > > BTW, the unpacked folders name: > > > > > > apache-seata-2.1.0-incubating-src.zip -> incubator-seata-2.1.0 > > > apache-seata-2.1.0-incubating-bin.tar.gz -> apache-seata > > > > > > looks unaligned. I suppose you try to name them: > > > > > > apache-seata-2.1.0-incubating-src.zip -> apache-seata-2.1.0-incubating-src > > > apache-seata-2.1.0-incubating-bin.tar.gz -> > > > apache-seata-2.1.0-incubating-bin > > > > > > while this is a suggestion rather than some guidelines or policies. > > > > > > Best, > > > tison. > > > > > > > > > tison <wander4...@gmail.com> 于2024年7月5日周五 10:11写道： > > > > > > > +1 (binding) > > > > > > > > I checked: > > > > > > > > * Download links work > > > > * Signature and checksum matches > > > > > > > > gpg: Signature made 六 6/15 06:08:36 2024 PDT > > > > gpg: using RSA key > > > > B51F1A5056BC5D6FBF2D82871E90338E9FA7635C > > > > gpg: Good signature from "jimin (CODE SIGN) <ji...@apache.org>" > > > > [unknown] > > > > gpg: WARNING: This key is not certified with a trusted signature! > > > > gpg: There is no indication that the signature belongs to the > > > > owner. > > > > Primary key fingerprint: B51F 1A50 56BC 5D6F BF2D 8287 1E90 338E 9FA7 > > > > 635C > > > > > > > > * LICENSE / NOTICE / DISCLAIMER exist > > > > * Files have ASF license header > > > > > > > > I cannot build from source on osx_aarch64 due to: > > > > > > > > [ERROR] Failed to execute goal > > > > org.xolstice.maven.plugins:protobuf-maven-plugin:0.6.1:compile > > > > (default) on > > > > project seata-serializer-protobuf: Unable to resolve artifact: Missing: > > > > [ERROR] ---------- > > > > [ERROR] 1) com.google.protobuf:protoc:exe:osx-aarch_64:3.11.0 > > > > [ERROR] > > > > [ERROR] Try downloading the file manually from the project website. > > > > [ERROR] > > > > [ERROR] Then, install it using the command: > > > > [ERROR] mvn install:install-file -DgroupId=com.google.protobuf > > > > -DartifactId=protoc -Dversion=3.11.0 -Dclassifier=osx-aarch_64 > > > > -Dpackaging=exe -Dfile=/path/to/file > > > > [ERROR] > > > > [ERROR] Alternatively, if you host your own repository you can deploy > > > > the file there: > > > > [ERROR] mvn deploy:deploy-file -DgroupId=com.google.protobuf > > > > -DartifactId=protoc -Dversion=3.11.0 -Dclassifier=osx-aarch_64 > > > > -Dpackaging=exe -Dfile=/path/to/file -Durl=[url] -DrepositoryId=[id] > > > > [ERROR] > > > > [ERROR] Path to dependency: > > > > [ERROR] 1) org.apache.seata:seata-serializer-protobuf:jar:2.1.0 > > > > [ERROR] 2) com.google.protobuf:protoc:exe:osx-aarch_64:3.11.0 > > > > [ERROR] > > > > [ERROR] ---------- > > > > [ERROR] 1 required artifact is missing. > > > > [ERROR] > > > > [ERROR] for artifact: > > > > [ERROR] org.apache.seata:seata-serializer-protobuf:jar:2.1.0 > > > > [ERROR] > > > > [ERROR] from the specified remote repositories: > > > > [ERROR] apache.snapshots (https://repository.apache.org/snapshots, > > > > releases=false, snapshots=true), > > > > [ERROR] central (https://repo.maven.apache.org/maven2, releases=true, > > > > snapshots=false) > > > > > > > > But I think it's fair enough to upgrade the related dependencies in a > > > > following commit. > > > > > > > > The link to KEYS file should be updated as stated above, but it's not a > > > > release blocker anyway. > > > > > > > > Best, > > > > tison. > > > > > > > > Best, > > > > tison. > > > > > > > > > > > > tison <wander4...@gmail.com> 于2024年7月5日周五 10:09写道： > > > > > > > >> You should use https://downloads.apache.org/incubator/seata/KEYS > > > >> instead of dist dev. > > > >> > > > >> You can upload the KEYS file to > > > >> https://dist.apache.org/repos/dist/release/incubator/seata/KEYS and > > > >> the downloads link would work. > > > >> > > > >> Best, > > > >> tison. > > > >> > > > >> Min Ji <ji...@apache.org> 于2024年7月5日周五 10:03写道： > > > >> > > > > >> > Hello, > > > >> > > > > >> > This is a call for vote on releasing Apache Seata(incubating) > > > >> v2.1.0-RC4. > > > >> > > > > >> > The vote thread: > > > >> > https://lists.apache.org/thread/s0gxv49802kk8y3dnxr8ytxy6ghkkjr6 > > > >> > > > > >> > Vote Result: > > > >> > https://lists.apache.org/thread/km5dzmhw2j7ow86pk3g81f1z50sojomz > > > >> > > > > >> > The release candidates: > > > >> > > > > >> https://dist.apache.org/repos/dist/dev/incubator/seata/incubator-seata/2.1.0/ > > > >> > > > > >> > The staging repo: > > > >> > https://repository.apache.org/content/repositories/orgapacheseata-1030/ > > > >> > > > > >> > Git tag for the release: > > > >> > https://github.com/apache/incubator-seata/releases/tag/v2.1.0 > > > >> > > > > >> > Git commit id for the release: > > > >> > > > > >> https://github.com/apache/incubator-seata/commit/38e9cea8bd611eca1e837e766b41a1334473c5f4 > > > >> > > > > >> > Release Notes: > > > >> > https://github.com/apache/incubator-seata/releases/tag/v2.1.0 > > > >> > > > > >> > The artifacts have been signed with Key : > > > >> > B51F1A5056BC5D6FBF2D82871E90338E9FA7635C, which can be found in the > > > >> > keys file: > > > >> > https://dist.apache.org/repos/dist/dev/incubator/seata/KEYS > > > >> > > > > >> > Build Environment: JDK 8+, Apache Maven 3.6.0+. > > > >> > Build Command: ./mvnw clean package -DskipTests=true, If you are > > > >> > building on an ARM64 architecture, please add the profile -Parrch64. > > > >> > > > > >> > CI Test Workflow: > > > >> > > > > >> https://github.com/apache/incubator-seata/actions/runs/9527005533/job/26263693001 > > > >> > > > > >> > The vote will be open for at least 72 hours or until necessary number > > > >> > of votes are reached. > > > >> > > > > >> > Please vote accordingly: > > > >> > > > > >> > [ ] +1 approve > > > >> > [ ] +0 no opinion > > > >> > [ ] -1 disapprove with the reason > > > >> > > > > >> > Checklist for reference: > > > >> > [ ] Download links are valid. > > > >> > [ ] Checksums and PGP signatures are valid. > > > >> > [ ] Source code distributions have correct names matching the current > > > >> > release. > > > >> > [ ] LICENSE and NOTICE files are correct for each Answer repo. > > > >> > [ ] All files have license headers if necessary. > > > >> > [ ] No unlicensed compiled archives bundled in source archive. > > > >> > > > > >> > > > > >> > > > > >> > Warm regards, > > > >> > > > > >> > Ji Min > > > >> > > > > >> > --------------------------------------------------------------------- > > > >> > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > > > >> > For additional commands, e-mail: general-h...@incubator.apache.org > > > >> > > > > >> > > > > --------------------------------------------------------------------- To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
