add notice file for python binding

[houqp]

Which issue does this PR close?

From #875 (comment).

Relates to #887.

Rationale for this change

Since our python binding release artifacts will be binaries, we need to include all licenses used by our dependencies.

What changes are included in this PR?

Add notice file following https://github.com/apache/arrow/blob/master/NOTICE.txt

Are there any user-facing changes?

no

[jorgecarleitao]

Thanks a lot for taking this, QP!

I was imagining that our notice would have to be something like "go to all our (transitive and non-transitive) dependencies, extract their licenses, create a notice based on the list of dependencies and respective licenses".

This offers the guarantees that anyone using the binary shipped from Apache that we verified that it can be used in the same or comparable terms as the Apache license itself (my understanding of why such notice exists in apache/arrow, but I am not very experienced here).

[houqp]

@kszucs it would be really helpful you can provide some insights here since I noticed you have made significant change to arrow's NOTICE.txt file. Do you know if arrow's NOTICE.txt file is managed manually or through automation? How deep do we need to get into the dependency graph to fish out all the downstream licenses?

The change in this PR only includes non-transitive dependencies.

[kszucs]

We maintain the license and notice files manually. I think it's enough to mention the dependencies where we have vendored source code from. Otherwise we'd need to generate the whole cargo dependency tree since we statically link everything with cargo (if I'm not mistaken). cc @kou

[kou]

These documents will help us:

• http://apache.org/legal/src-headers.html#notice
• https://infra.apache.org/licensing-howto.html#binary

[houqp]

Thanks @kszucs and @kou for the pointers. I went through the ASF docs, it looks like we do need to account for the full dependency tree for statically linked binary release :(

For source releases, we only need to take care of vendored source code.

Both LICENSE file and NOTICE needs to be updated for each compiled in dependency for the binary release.

[houqp]

closing this in favor of #966