[MNG-6771] Fix license issues on binary distribution

- Update slf4j to 1.7.29
- Do not download ASL v2 license files but copy from local
- add Jsoup license
- keep a specific copy of MIT license for each dependency
- Add NOTICE to binary distribution
- Add Eclipse SISU about.html contents

Patch co-authored by Hervé Boutemy and Enrico Olivelli

apache-maven/pom.xml

@@ -79,6 +79,14 @@ under the License.
         </exclusion>
       </exclusions>
     </dependency>
+    <dependency>
+      <!-- this is included in Wagon Http
+           we are just making the dependency explicit
+           in order to ease license attribution -->
+      <groupId>org.jsoup</groupId>
+      <artifactId>jsoup</artifactId>
+      <scope>runtime</scope>
+    </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>jcl-over-slf4j</artifactId>

apache-maven/src/main/appended-resources/META-INF/LICENSE.vm

@@ -22,50 +22,60 @@ Apache Maven includes a number of components and libraries with separate
 copyright notices and license terms. Your use of those components are 
 subject to the terms and conditions of the following licenses: 
 ##
-#set ( $apacheLicenseNames = [ "Apache License, Version 2.0", "The Apache Software License, Version 2.0",
-    "ASLv2", "Apache Public License 2.0", "Apache 2.0" ] )
+#set ( $apacheMavenGroupIds = [ "org.apache.maven", "org.apache.maven.wagon", "org.apache.maven.resolver",
+                                "org.apache.maven.shared" ] )
 #set ( $MITLicenseNames = [ "MIT License", "MIT license", "The MIT License" ] )
 #foreach ( $project in $projects )
 #**##foreach ( $license in $project.licenses)
-#*  *##if ( !$apacheLicenseNames.contains( $license.name ) )
-#*    *##set ( $artId = $project.artifact.artifactId )
-#*    *##set ( $url = $license.url )
-#*    *##set ( $spdx = false )
-#*    *##set ( $includeLicense = true )
+#*  *##set ( $groupId = $project.artifact.groupId )
+#*  *##set ( $directory = 'lib' )
+#*  *##if ( !$apacheMavenGroupIds.contains( $groupId ) )
+#*    *### advertise about each non-Maven dependency
 #*    *###
-#*    *##if ( $project.artifact.artifactId == "jcl-over-slf4j" )
-#*      *### jcl-over-slf4j is Apache 2.0, even if its pom says MIT
-#*      *##set ( $includeLicense = false )
-#*    *##end
+#*    *### infer SPDX license code
 #*    *##if ( $license.name == "COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0" )
 #*      *##set ( $spdx = 'CDDL-1.0' )
-#*    *##end
-#*    *##if ( $MITLicenseNames.contains( $license.name ) )
+#*    *##elseif ( $MITLicenseNames.contains( $license.name ) )
 #*      *##set ( $spdx = 'MIT' )
-#*    *##end
-#*    *##if ( $license.name == "Eclipse Public License, Version 1.0" )
+#*    *##elseif ( $license.name == "Eclipse Public License, Version 1.0" )
 #*      *##set ( $spdx = 'EPL-1.0' )
+#*    *##elseif ( $license.url.contains( "www.apache.org/licenses/LICENSE-2.0" ) )
+#*      *##set ( $spdx = 'ASL-2.0' )
+#*    *##else
+#*      *### unrecognized license will require analysis to know obligations
+#*      *##set ( $spdx = 'unrecognized' )
 #*    *##end
+#*    *###
+#*    *### fix project urls that are wrong in pom
 #*    *##if ( $project.url.startsWith( "http://www.eclipse.org/sisu/" ) )
 #*      *##set ( $project.url = 'https://www.eclipse.org/sisu/' )
+#*    *##elseif ( $project.url.startsWith( "https://github.com/google/guava/" ) )
+#*      *##set ( $project.url = 'https://github.com/google/guava/' )
+#*    *##elseif ( $project.url.startsWith( "https://github.com/google/guice/" ) )
+#*      *##set ( $project.url = 'https://github.com/google/guice/' )
 #*    *##end
-#*    *##if ( $includeLicense )
-#*      *##if ( $url || $spdx )
-#*        *##set ( $licFile = 'lib/' + $artId + '.license' )
-#*        *##if ( $spdx )
-#*          *##set ( $downloaded = $locator.getResourceAsFile( "licenses/${spdx}.txt", "licenses/${licFile}" ) )
-#*        *##else
-#*          *##set ( $downloaded = $locator.getResourceAsFile( $url, "licenses/${licFile}" ) )
-#*        *##end
-#*      *##end
+#*    *###
+#*    *### Classworlds is in boot directory, not in lib
+#*    *##if ( $project.artifact.artifactId == "plexus-classworlds" )
+#*      *##set ( $directory = 'boot' )
+#*    *##end
+#*    *###
+#*    *### copy license file to lib/$artifactId.license
+#*    *##set ( $licFile = $directory + '/' + $project.artifact.artifactId + '.license' )
+#*    *##if ( $spdx == "MIT" )
+#*      *### MIT license contains date and copyright that makes the file specific to each artifact
+#*      *##set ( $downloaded = $locator.getResourceAsFile( "licenses/${spdx}-${project.artifact.artifactId}-${project.artifact.version}.txt", "licenses/${licFile}" ) )
+#*    *##else
+#*      *##set ( $downloaded = $locator.getResourceAsFile( "licenses/${spdx}.txt", "licenses/${licFile}" ) )
+#*    *##end
+#*    *### add dependency info to output
 
-- lib/${project.artifact.artifactId}-${project.artifact.version}.jar: $project.artifact.toString().replace( ':eclipse-plugin:', ':jar:' )
+- $directory/${project.artifact.artifactId}-${project.artifact.version}.jar: $project.artifact.toString().replace( ':eclipse-plugin:', ':jar:' )
     $project.name
     #if ( $project.url )Project URL: ${project.url}#end
 
-    License: $license.name#if ( $spdx ) ($spdx)#end#if ( $url )  $url ($licFile)#end
+    License: $license.name#if ( $spdx ) ($spdx)#end  $license.url ($licFile)
 
-#*    *##end
 #*  *##end
 #**##end
 #end

apache-maven/src/main/appended-resources/META-INF/NOTICE.vm

@@ -0,0 +1,116 @@
+##
+## Licensed to the Apache Software Foundation (ASF) under one
+## or more contributor license agreements.  See the NOTICE file
+## distributed with this work for additional information
+## regarding copyright ownership.  The ASF licenses this file
+## to you under the Apache License, Version 2.0 (the
+## "License"); you may not use this file except in compliance
+## with the License.  You may obtain a copy of the License at
+##
+##  http://www.apache.org/licenses/LICENSE-2.0
+##
+## Unless required by applicable law or agreed to in writing,
+## software distributed under the License is distributed on an
+## "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+## KIND, either express or implied.  See the License for the
+## specific language governing permissions and limitations
+## under the License.
+##
+This software bundles the following NOTICE files from third party library providers:
+
+META-INF/NOTICE in archive lib/guice-4.2.1-no_aop.jar
+Google Guice - Core Library
+Copyright 2006-2018 Google, Inc.
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+META-INF/NOTICE in archive lib/plexus-utils-3.2.1.jar
+This product includes software developed by the Indiana University
+ Extreme! Lab (http://www.extreme.indiana.edu/).
+This product includes software developed by
+The Apache Software Foundation (http://www.apache.org/).
+This product includes software developed by
+ThoughtWorks (http://www.thoughtworks.com).
+This product includes software developed by
+javolution (http://javolution.org/).
+This product includes software developed by
+Rome (https://rome.dev.java.net/).
+
+about.html in archive lib/org.eclipse.sisu.inject-0.3.4.jar
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"/>
+<title>About org.eclipse.sisu.inject</title>
+</head>
+<body lang="EN-US">
+<h2>About org.eclipse.sisu.inject</h2>
+
+<p>November 5, 2013</p>	
+<h3>License</h3>
+
+<p>The Eclipse Foundation makes available all content in this plug-in (&quot;Content&quot;).  Unless otherwise 
+indicated below, the Content is provided to you under the terms and conditions of the
+Eclipse Public License Version 1.0 (&quot;EPL&quot;).  A copy of the EPL is available 
+at <a href="http://www.eclipse.org/legal/epl-v10.html">http://www.eclipse.org/legal/epl-v10.html</a>.
+For purposes of the EPL, &quot;Program&quot; will mean the Content.</p>
+
+<p>If you did not receive this Content directly from the Eclipse Foundation, the Content is 
+being redistributed by another party (&quot;Redistributor&quot;) and different terms and conditions may
+apply to your use of any object code in the Content.  Check the Redistributor's license that was 
+provided with the Content.  If no such license exists, contact the Redistributor.  Unless otherwise
+indicated below, the terms and conditions of the EPL still apply to any source code in the Content
+and such source code may be obtained at <a href="http://www.eclipse.org/">http://www.eclipse.org</a>.</p>
+
+<h3>Third Party Content</h3>
+<p>The Content includes items that have been sourced from third parties as set 
+out below. If you did not receive this Content directly from the Eclipse Foundation, 
+the following is provided for informational purposes only, and you should look 
+to the Redistributor's license for terms and conditions of use.</p>
+
+<h4>ASM 4.1</h4>
+<p>The plug-in includes software developed by the ObjectWeb consortium as part
+of the ASM project at <a href="http://asm.ow2.org/">http://asm.ow2.org/</a>.</p>
+
+<p>A subset of ASM is re-packaged within the source and binary of the plug-in (org.eclipse.sisu.space.asm.*)
+to avoid version collisions with other usage and is also available from the plug-in's github repository.</p>
+
+<p>Your use of the ASM code is subject to the terms and conditions of the ASM License
+below which is also available at <a href="http://asm.ow2.org/license.html">http://asm.ow2.org/license.html</a>.</p>
+
+<blockquote><pre>
+Copyright (c) 2000-2011 INRIA, France Telecom
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holders nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS &quot;AS IS&quot;
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+THE POSSIBILITY OF SUCH DAMAGE.
+</pre></blockquote>
+
+</body>
+</html>