[700] Ship a license text for every bundled non-Apache-2.0 dependency

[vinishjail97]

What

Every bundled non-Apache-2.0 dependency now ships its license text, and a check enforces that against the built jar rather than the poms.

Closes #700. Also closes #865, since the check fails in both directions.

Why the jar

LICENSE-bundled opens with "See licenses/ for text of these licenses", and today that is not true. The published artifact is the only thing that settles what is actually bundled — a shade <includes> list can name dependencies that no longer resolve, and a module with <filters> ships a subset of what the dependency tree describes. It is also what a release reviewer inspects, which is how #700 was found in the first place.

Before this change, measured on jars built from main:

• xtable-aws carried texts for 3 of 5 bundled non-Apache-2.0 dependencies
• xtable-hive-metastore for 3 of 22
• xtable-hudi-support-extensions for 3 of 3, plus two texts for dependencies it does not bundle

The check

release/scripts/validate_bundled_license_texts.py (152 lines) reads each *-bundled.jar, takes the coordinate listing from its META-INF/LICENSE, confirms each non-Apache-2.0 coordinate's classes are genuinely present by matching against that artifact's own jar, and requires META-INF/licenses/LICENSE-<artifactId>. A text with no bundled dependency behind it fails too. An empty run — no jars found — is a failure rather than a pass.

Wired into mvn-license-check.yml as two steps: build the shaded modules, then run the check.

OK   xtable-aws-0.5.0-SNAPSHOT-bundled.jar: 5 bundled non-Apache-2.0 dependencies, all with license texts.
OK   xtable-hive-metastore-0.5.0-SNAPSHOT-bundled.jar: 22 bundled non-Apache-2.0 dependencies, all with license texts.
OK   xtable-hudi-support-extensions_2.12-0.5.0-SNAPSHOT-bundled.jar: 3 bundled non-Apache-2.0 dependencies, all with license texts.

Changes

• 21 license texts added. All taken from [700] Bundle license texts for all non-Apache-2.0 shaded dependencies #857, where @rangareddy had already curated and verified them — that curation is the part of [700] Bundle license texts for all non-Apache-2.0 shaded dependencies #857 that has to happen regardless of which mechanism produces the metadata, and it is reused here rather than redone.
• Texts renamed to LICENSE-<artifactId> so the mapping is mechanical rather than by eye: LICENSE-jruby-jcodings to LICENSE-jcodings, LICENSE-leveldbjni to LICENSE-leveldbjni-all, LICENSE-javax-annotation-api to LICENSE-javax.annotation-api, and the single LICENSE-jersey-core split into LICENSE-jersey-client, LICENSE-jersey-json and LICENSE-jersey-guice.
• Texts removed for dependencies that are not bundled — antlr4-runtime and slf4j-api across modules, glassfish-java-servlet-jsp, glasshfish-javax-servlet.
• Shade filter on xtable-hive-metastore for META-INF/license/** and META-INF/licenses/*.txt. Five third-party files (antlr2-license.txt, asm-license.txt, jline2-license.txt, jsr223-license.txt, normalize-stylesheet-license.txt) were landing alongside the curated set. Ours carry no file extension, so they are unaffected.

One licensing correction worth review

junit was listed as 4.11 under Common Public License 1.0. The runtime tree resolves 4.12, which is EPL 1.0. The bundled artifact was therefore declared under the wrong license. Corrected in LICENSE-bundled, and the text is the EPL 1.0 one from #857.

Two things I would like a second opinion on:

1. xml-apis:1.3.04 — its POM declares no license and its jar's license/LICENSE is the Apache text, but the same jar also ships the W3C DOM and SAX licenses for the interfaces it redistributes. LICENSE-bundled currently files it under Apache Software License 1.1. I have kept a text for it rather than treating it as Apache-2.0-and-therefore-covered, which seemed the conservative reading, but the family heading may still be wrong.
2. junit and hamcrest-core are bundled at all. They arrive transitively at compile scope. Shipping test libraries in a production bundle is arguably the real defect, and excluding them would be better than licensing them.

Scope

The coordinate listings are otherwise untouched, so this does not depend on #880. Nothing in generate_shaded_license_metadata.py or validate_shaded_license_coverage.sh is modified.

Testing

• ./mvnw apache-rat:check -B — pass
• python3 -m py_compile on the new script — pass
• Built xtable-aws, xtable-hive-metastore, xtable-hudi-support-extensions and ran the check — exit 0, output above
• Verified the check fails as expected before the texts were added, and that removing any single text reintroduces a failure

[vinishjail97]

Closing as github actions are not working.
https://www.githubstatus.com/