Repository navigation
Third-party files missing from LICENSE and carrying ASF headers #260
Description
While reviewing the 0.9.0-incubating-RC7 source release (apache-openserverless-0.9.0-incubating-src.tar.gz), I found third-party files that the top-level LICENSE does not mention, and vendored third-party files that carry the ASF source header instead of their upstream notices. All the licences involved are permissive (Apache-2.0, BSD-3-Clause), so this is about documenting them correctly, not about incompatible licences.
1. Third-party code missing from the top-level LICENSE
| File(s) | Origin | Licence |
|---|---|---|
cli/tools/sh.go |
Lightly modified copy of mvdan/sh cmd/gosh/main.go (only the package name and entry point differ from v3.8.0) |
BSD-3-Clause, Copyright (c) 2017 Daniel Martí |
oplugins-op/deploy/cert-manager/cert-manager.yaml |
cert-manager v1.10.1, rendered from its Helm chart (CRDs included) | Apache-2.0, The cert-manager Authors |
oplugins-op/deploy/milvus/*, oplugins-op/deploy/milvus-slim/*, oplugins-op/openserverless/templates/milvus-cfg-*.yaml |
Milvus Helm chart (Milvus v2.5.2) | Apache-2.0, Copyright Zilliz |
oplugins-op/deploy/milvus-operator/*, oplugins-op/deploy/openserverless-permissions/openserverless-milvus-operator-crd.yaml, openserverless-milvus-operator-roles.yaml |
milvus-operator Helm chart 1.1.3 | Apache-2.0, Copyright Zilliz |
testing/stress-test/locust-manifest.yaml |
Locust Helm chart (Locust 2.15.1) | Apache-2.0 |
Components that LICENSE already lists also appear at paths it does not mention:
- Kubegres CRD:
oplugins-op/deploy/openserverless-permissions/kubegres-crd.yaml,testing/stress-test/oplugins-stress/setup/kubernetes/crds/kubegres-crd.yaml - ingress-nginx:
oplugins-op/deploy/ingress-nginx/*.yaml(controller 1.5.1 and 1.8.1, versions LICENSE does not mention),testing/stress-test/oplugins-stress/setup/docker/ingress-deploy.yaml - openshift-acme:
oplugins-op/deploy/acme-openshift/* - OpenWhisk Helm chart renderings (
# Source: openwhisk/templates/...) underoplugins-op/andtesting/
The LICENSE files inside the submodules do not cover these: they describe the container images and state that the source is entirely Apache-2.0. cli/LICENSE includes the BSD-3-Clause text for sciabarracom/sh, but as a dependency of the CLI binary, not as source copied into the release.
2. ASF headers on third-party files
ASF policy says the ASF header should not be added to third-party files, and their original copyright and licence notices should be kept:
https://www.apache.org/legal/src-headers.html#3party
In the RC7 tarball, the vendored files carry the ASF header:
- ASF header added above the upstream notice:
cli/tools/sh.go(its "See LICENSE for licensing information" line now points at the wrong LICENSE), and the Milvus config files. - ASF header only, with no upstream attribution: all the manifests in section 1, plus the files LICENSE already lists (ingress-nginx, Kubegres, openshift-acme, the Prometheus and kube-state-metrics descriptors), and
oplugins/ide/mime.types(public domain, as the file itself says). oplugins/util/upload.jsandoplugins/admin/usage/usage.jsarebun buildbundles with an ASF header over embedded MIT, ISC and BSD code. LICENSE lists those packages, but the header claims the whole file.
Handled correctly, for reference: build/openwhisk/gradlew and gradlew.bat keep Gradle's own header.
Because every third-party file has an Apache header, Apache RAT reports 0 unapproved files and cannot flag any of this.
Suggested fixes
- Add LICENSE entries for mvdan/sh (with the BSD-3-Clause text), cert-manager, Milvus, milvus-operator and Locust, and extend the existing Kubegres, ingress-nginx, openshift-acme and OpenWhisk-chart entries to the
oplugins-op/andtesting/paths. - Remove the ASF header from vendored files, restore their upstream notices, and exclude those paths in
.rat-excludesand.licenserc.yamlso the header checks do not add it back. - For
cli/tools/sh.go: restore the BSD-3-Clause notice as its header, or depend on theshmodule directly instead of copying the file.
Related: #259 (Stack Overflow code in Unzip.scala).
Activity
pjfanning commentedon Sep 30, 2026
Update and cross-references:
Earlier report. Much of this was first reported in #250 (found while verifying RC5). That PR was closed pending a clean-up of obsolete dependencies; the items below are still in the RC7 source release.
Split out into their own issues:
oplugins-op/deploy/cert-manager/cert-manager.yaml): cert-manager.yaml: upstream copyright header replaced with ASF header, and not in LICENSE #263. Its upstreamCopyright 2022 The cert-manager Authors.header was replaced with the ASF header.kvrocks.confembedded inoplugins-op/openserverless/templates/kvrocks-cm.yaml: Apache Kvrocks kvrocks.conf is bundled but not attributed in LICENSE/NOTICE #262. It was missing from the list above.Unzip.scala: Unzip.scala contains Stack Overflow code, not allowed by ASF licensing policy #259 (upstream: Unzip.scala contains Stack Overflow code, not allowed by ASF licensing policy openwhisk#5588)Main.scala: Main.scala (OpenWhisk admin tool) contains MIT-licensed code from Scallop without attribution #264Sink.combineinDockerToActivationFileLogStore.scala: DockerToActivationFileLogStore.scala contains code derived from Akka Sink.combine without attribution #265ExecManifest.scala: ExecManifest.scala copies the docker/distribution image-reference grammar without attribution #266In progress: #261 extends the existing
LICENSEentries (ingress-nginx, Kubegres, openshift-acme, Prometheus / kube-state-metrics, OpenWhisk Helm chart) to the copies underoplugins-op/andtesting/. It also adds two things the description above missed:oplugins-op/deploy/postgres-operator/kubegres-operator.yaml(Kubegres 1.18) and the Prometheus / kube-state-metrics descriptors inoplugins-op/deploy/monitoring/.Resolved since #250 (checked against the RC7 tarball):
96138abin the operator repo). Only an RBAC rule formongodbcommunity.mongodb.comremains in the threeoperator-roles.yamlcopies; that is our own file, but the rule is now dead and could be removed.milvus_manifest.yamlis gone; no MinIO chart or manifest remains.c6482cc); the remaining one is tracked in cert-manager.yaml: upstream copyright header replaced with ASF header, and not in LICENSE #263.Still tracked only here:
cli/tools/sh.go(mvdan/sh, BSD-3-Clause), Milvus, milvus-operator and Locust missing fromLICENSE, and the ASF headers on vendored third-party files (including the pre-builtupload.js/usage.jsbundles).NOTICE: match the locations of the bundled Kubernetes components
sciabarracom commentedon Oct 11, 2026
you are not looking to the distribution and not to the branches we use (0.9.0 in all the submodules)
the readme is clear about how we build the distribution
git clone --branch 0.9.0 https://github.com/apache/openserverless --recurse-submodules
main is not always updated - we keep updated the main with reference to submodules but the distribution is always build from a branch
LICENSE/NOTICE: list every vendored copy of the bundled Kubernetes co…