[chrisdutz]

Description

LICENSE-binary and NOTICE-binary (packaged as LICENSE and NOTICE in the binary distributions) no longer match what the distributions bundle. I compared them with the jars of the default packages (all-bin, edge-bin, library-udf-bin), including the artifacts inside rest-*-jar-with-dependencies.jar and mqtt-*-jar-with-dependencies.jar, and with the licenses declared in each artifact's POM.

Listed, but not bundled (removed)

• javax.xml.bind:jaxb-api:2.4.0-b180725.0427 and org.glassfish.jaxb:jaxb-runtime:2.3.6: no javax.xml.bind, com.sun.xml.bind or org.glassfish.jaxb classes are in any package since the Jakarta migration (Upgrade minimum JDK to 17 and migrate JavaX to Jakarta #17859); jakarta.xml.bind-api is listed.
• com.librato.metrics:librato-java, com.librato.metrics:metrics-librato, io.dropwizard.metrics:metrics-jvm, com.bugsnag:bugsnag, com.h2database:h2-mvstore, org.jspecify:jspecify.

Outdated versions (fixed)

• Jackson 2.16.2 / 2.18.6 → 2.18.11, moquette 0.18 → 0.18.0; the malformed com.google.guava.guava and io.airlift.airline coordinates are corrected.

Bundled, but not listed (added)

• REST service: Jersey, HK2, jakarta.ws.rs-api, mimepull, javassist, snakeyaml, jackson-dataformat-yaml, jackson-datatype-jsr310, commons-lang3.
• MQTT service: reload4j, slf4j-reload4j, HikariCP, commons-codec, netty kqueue/tcnative.
• lib/: Ratis, reactor, micrometer, JNA, checker-qual, HdrHistogram, LatencyUtils, Java-WebSocket, cglib, Guava's annotation/companion artifacts, commons-csv, commons-pool2, airlift:units, jakarta.validation-api and further netty modules.

Dual-licensed artifacts are listed under the most permissive option (Jetty, JNA, javassist and moquette under Apache License 2.0; logback, Jakarta APIs, HK2 and Jersey under EPL 2.0; HdrHistogram under CC0). The Jersey lines name the third-party code that jersey-common (parts of Guava, JSR-166) and jersey-server (ASM) repackage.

licenses/

• Added: EDL 1.0 (already referenced, but the text was missing), CC0 1.0, MIT-0 (Reactive Streams), MIT texts with the copyright lines of ClassGraph, Checker Framework and Java-WebSocket.
• Removed, as nothing refers to them any more: CDDL 1.1, EPL 1.0, MIT (progressbar).

NOTICE-binary

• Removed Apache Commons Collections, which isn't bundled.
• Added the notices that the bundled Apache-2.0 artifacts ship in their NOTICE files: Apache Commons (CLI, Codec, CSV, Lang, Pool), Apache log4j (reload4j), Apache Ratis (including what ratis-thirdparty-misc bundles), Apache Thrift, Netty (including netty-tcnative's Tomcat Native, Maven Wrapper and BoringSSL), Micrometer, Jackson, Swagger Core and Jakarta Dependency Injection. Notices of artifacts under other licenses stay out of NOTICE.

jackson-core bundles FastDoubleParser (MIT, with portions under the Boost Software License 1.0, MIT and BSD 2-Clause) and Schubfach (MIT); its LICENSE-binary line says so, and the license texts from the jackson-core jar are in licenses/.

Result: 117 entries, exactly the 117 third-party artifacts in the packages (verified with a fresh mvn clean package -pl distribution -am -DskipTests on this branch; LICENSE and NOTICE in all three zips are identical to LICENSE-binary and NOTICE-binary, apache-rat:check passes).

Not part of this PR: the AINode and C++ client packages, which have their own license files.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 48.52%. Comparing base (1512190) to head (d0d6973).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master   #19164      +/-   ##
============================================
- Coverage     48.53%   48.52%   -0.01%     
  Complexity      635      635              
============================================
  Files          5573     5573              
  Lines        412215   412215              
  Branches      54338    54338              
============================================
- Hits         200062   200047      -15     
- Misses       212153   212168      +15     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.