Skip to content

Fix missing Spring and OW2 attributions in shaded JAR - #1176

Open
skytin1004 wants to merge 3 commits into
apache:mainfrom
skytin1004:fix/shaded-license-attribution
Open

skytin1004 wants to merge 3 commits into
apache:mainfrom
skytin1004:fix/shaded-license-attribution

Conversation

@skytin1004

@skytin1004 skytin1004 commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor

Purpose of the pull request

Closed: #1172

Add the missing copyright attribution for the Spring and ASM code bundled in fesod-shaded, and keep the standalone ASM license used by the source distribution consistent.

What's changed?

  • Added the Pivotal copyright line to fesod-shaded's META-INF/NOTICE.
  • Added the OW2 Consortium copyright line to fesod-shaded's META-INF/LICENSE.
  • Added the same OW2 attribution to dist/licenses/LICENSE-asm.txt, which is included in the source release ZIP.
  • Kept the OW2 attribution in the same position as the original spring-core 5.3.39 license and preserved the existing LF/EOF style.

Validation

  • Ran ./mvnw clean package -Papache-release -DskipTests -Dgpg.skip=true.
  • Scanned all 870 tracked files for other ASM and Spring attribution copies; no additional missing attribution was found.
  • Verified every generated JAR and the source release ZIP contains the expected updated LICENSE and NOTICE entries.
  • Confirmed the shaded JAR contains the expected 35 ASM and 254 cglib classes from spring-core 5.3.39, with no Objenesis or unexpected third-party classes.
  • Ran git diff --check and verified all three changed files use LF line endings.

Checklist

  • I have read the Contributor Guide.
  • I have updated the required NOTICE/LICENSE entries.
  • The release-profile build passes.

@skytin1004

skytin1004 commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor Author

I did another pass through the repository and found one additional copy of the ASM license in dist/licenses/LICENSE-asm.txt, which is included in the source release. I've added the missing OW2 attribution there as well. I also rebuilt the release artifacts and confirmed the updated license and notice files are included. I didn’t find any other missing copies.

@skytin1004
skytin1004 force-pushed the fix/shaded-license-attribution branch from 70bd704 to 989e479 Compare October 3, 2026 13:50
The Apache Software Foundation (http://www.apache.org/).
-----------------------------------------------------------------------
This product includes software developed by the Spring Framework Project (https://spring.io).
Copyright (c) 2002-2024 Pivotal, Inc.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

better to have

Spring Framework 5.3.39
Copyright (c) 2002-2024 Pivotal, Inc.

This is in #1172 description

@pjfanning

Copy link
Copy Markdown
Member

Thanks @skytin1004. After looking into it further, I think we should drop the OW2 Consortium line and keep only the NOTICE change.

The OW2 line looks like something unusual that Spring added rather than something ASM requires:

  • ASM's own LICENSE.txt has only Copyright (c) 2000-2011 INRIA, France Telecom, which we already include.
  • The ASM jars contain no LICENSE or NOTICE file at all.
  • The OW2 line comes from Spring's own src/docs/dist/license.txt, which they maintain by hand and copy into their jars.

More detail is in #1172 (comment).

Could you revert the changes to dist/licenses/LICENSE-asm.txt and fesod-shaded/src/main/resources/META-INF/LICENSE? The NOTICE change (the Pivotal copyright line) looks good.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fesod-shaded jar: NOTICE/LICENSE missing Spring and ASM (OW2) copyright lines

2 participants