Repository navigation
Conversation
…notices The top-level LICENSE held only the Apache License, and was cut off after section 9: "END OF TERMS AND CONDITIONS" and the appendix were missing. It said nothing about the third-party code the source release contains: jQuery, jQuery Migrate, jQuery UI, QUnit, Mockjax, Blanket.js (with Esprima and falafel), Prototype, Dojo, Behaviour, the JRCS-derived diff code, the W3C XHTML DTDs, the SIL OFL fonts of the examples and Stickman's MultiSelector. The ASF licensing guide asks for each of these to be listed in LICENSE. The Apache Trusted Releases platform compares LICENSE line by line with the full Apache License text, so the truncated file would also fail that check. NOTICE was built at release time by concatenating every module's META-INF/NOTICE. Most of what it collected was attribution that no license requires: MIT and BSD code, dependencies that are not bundled at all (Guice, AspectJ, SLF4J, Spring, ASM, ByteBuddy, jhighlight) and code that is no longer in the tree (Script.aculo.us, HttpUnit). The JRCS attribution sat in wicket-core although the code lives in wicket-util, and the module notices still said 2006-2023. Now: - LICENSE is the complete Apache License followed by a section that names each third-party component, its version, its location and its license. The license texts are in licenses/, which no longer holds the unreferenced ASM, JUnit, SLF4J and Yahoo texts. - NOTICE holds only the ASF notice. The JRCS code is ASF code under the Apache Software License 1.1, whose acknowledgement that line satisfies. - wicket-core and wicket-util ship a META-INF/LICENSE that adds the code bundled in their jar, with the license texts in full. The hand-written NOTICE files of wicket-core, wicket-guice, wicket-tester and wicket-metrics are gone, so these jars get the generated NOTICE with the current year. - The binary release gets LICENSE-binary, which covers what its jars bundle, instead of the source release's LICENSE. - release.sh no longer assembles NOTICE; it updates the copyright year. Applications see a different META-INF/LICENSE and META-INF/NOTICE in the wicket-core and wicket-util jars, and nothing else changes for them. The examples war, which bundles its dependencies, keeps its NOTICE and is left for a separate change. GitHub issue #1723 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The user guide's css/style.css is the Asciidoctor default stylesheet, released under the MIT License. Running Apache RAT over the source tree turned it up; it was missing from the list of third-party components. GitHub issue #1723 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 30, 2026
papegaaij
marked this pull request as ready for review
October 31, 2026 08:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1723
The source release bundles third-party code that the top-level
LICENSEnever mentioned.NOTICEwas assembled at release time from every module'sMETA-INF/NOTICEand was mostly attribution no license requires. This PR rebuilds both following the ASF licensing how-to.What changes
LICENSE: the complete Apache License text. The old file stopped after section 9, which the Apache Trusted Releases platform's line-by-line comparison would reject. After it comes a section naming each bundled third-party component, with its version, location and license.licenses/: the license texts thatLICENSEpoints to.NOTICE: only the ASF notice. The JRCS diff code is ASF code under ASL 1.1, and the standard ASF line is the acknowledgement that license asks for.META-INF/LICENSEthat adds the third-party code bundled in that jar, with the full license texts.LICENSE-binary: the binary release'sLICENSE, covering what its jars bundle.release.shpreviously copied the sourceLICENSEthere.release.sh: no longer concatenates NOTICE files; it only updates the copyright year.Needs a human eye
These are judgement calls I could not settle from the files alone:
examples/preview/behaviour.js) says only "entirely BSD licensed", with no license text.LICENSEquotes that statement instead of inventing a BSD text.MultiFileUploadField.js) is under "use this however/wherever you like" terms, not a recognised license.LICENSEquotes the terms. Whether that is acceptable may be a legal-discuss question..woff/.ttf/.eotfiles are binary, but the.svgfont variants inwicket-examplesare text.blanket.min.js) has no LICENSE file upstream any more. Its text inlicenses/is the MIT license with the copyright line from the bundled header.LICENSE-MITat thev1.1.5tag is plain MIT; that is the text used here.Not covered
WEB-INF/lib. Its LICENSE/NOTICE do not cover them. That is a separate decision: document all the jars, or stop deploying the war.Verification
mvn clean verify -Pjs-testpasses.META-INF/LICENSEandMETA-INF/NOTICE.git archive, finds no third-party license thatLICENSEdoesn't list. The RAT check itself is the follow-up PR.🤖 Generated with Claude Code