Page History

...

• If you are adding a new dependency, make sure it is licensed in category A or B [3]
• If you are modifying an existing dependency, make sure the license of the dependency is still the same
• Everything below applies to the changed dependency version AND new or updated transitive dependencies
  • If you are changing a dependency in a module that does not release a "fat jar" / shaded jar to Maven central, there are no additional checks needed for that module. Downstream modules (such as flink-dist) might still have version changes that need attention.
  • If the module is releasing a shaded jar, you need to update the src/main/resources/META-INF/NOTICE file: Run maven, check the output of the shade plugin. For each "Including groupId:artifactId:.. into shaded jar" line, there needs to be an entry in this file (see details above!)
    • Group dependencies by license
    • mention the version
    • only include dependencies in the NOTICE file that are really there.
    • Forward NOTICE file contents of dependencies, if they include NOTICE files.
    • using "mvn dependency:tree" or "mvn project-info-reports:dependencies" (see "target/site/dependencies.html" of that module) are a best practice for analyzing a module's dependencies
  • If your module is released through flink-dist (or somehow else as a compiled binary), the same rules as for shaded jars apply.

...