Skip to content

ExecManifest.scala copies the docker/distribution image-reference grammar without attribution #266

Closed

Description

@pjfanning

build/openwhisk/common/scala/src/main/scala/org/apache/openwhisk/core/entity/ExecManifest.scala (vendored from Apache OpenWhisk, shipped in the 0.9.0-incubating-RC7 source release) contains the Docker image-reference grammar copied from docker/distribution:

    // docker image name grammar, taken from: https://github.com/docker/distribution/blob/master/reference/reference.go
    //
    // Grammar
    //
    // reference                       := name [ ":" tag ] [ "@" digest ]
    // name                            := [domain '/'] path-component ['/' path-component]*
    // domain                          := domain-component ['.' domain-component]* [':' port-number]
    // domain-component                := /([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])/
    // ...
    // digest-hex                      := /[0-9a-fA-F]{32,}/ ; At least 128 bit digest value

The 18-line grammar block is copied verbatim from the package comment of reference/reference.go in docker/distribution (now maintained as distribution/reference), and the parser below it (ImageName) implements that grammar. docker/distribution is licensed under the Apache License 2.0.

There is no licence conflict, but the copied text is not attributed: the file only carries the ASF header, and the top-level LICENSE does not mention docker/distribution. The existing comment gives the source URL, which is a good start but not a licence attribution. The link is also broken: it returns a 404. docker/distribution was renamed to distribution/distribution, its default branch changed from master to main, and the reference package was moved out into its own repository, distribution/reference. GitHub redirects the old URL to distribution/distribution on main, where reference/reference.go no longer exists.

Suggested fix, either:

  1. Add a LICENSE entry noting that the image-name grammar in this file is taken from docker/distribution reference/reference.go (Apache-2.0), and update the link to a pinned tag, e.g. https://github.com/distribution/distribution/blob/v2.7.1/reference/reference.go; or
  2. Replace the copied grammar with a short description in our own words plus the pinned link.

The same code is in upstream Apache OpenWhisk. Related: #260.

Activity

  1. sciabarracom commented on Oct 11, 2026

    @sciabarracom
    Contributor

    We no more vendor opennwhisk so this is no more relevant
    plase check branch 0.9.0 of openserverless-build

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions