[mraible]

The LICENSE and NOTICE files described Roller 5/6. They listed Spring 4.1.4, Guice 4.2.2, SLF4J 1.7.26, "romtools 1.12.0", Derby 10.11.1.1, jquery 2.1.1, jquery-ui 1.11.0, Summernote 0.8.11 and the long-gone YUI 3 directory. binary-includes/ wasn't used by any build, and the WAR had no LICENSE or NOTICE.

Draft. Merge after #260, #261, #262, #263 and #266. The versions here come from a local build with all of the open dependency PRs merged. If any of them change, the versions here need to follow.

What changes:

• Which files ship where.

  • The source archives keep the root LICENSE.txt and NOTICE.txt, and now include binary-includes/, which a build from the source release needs.
  • The binary archives use binary-includes/LICENSE.txt and NOTICE.txt.
  • The WAR carries them as META-INF/LICENSE.txt and META-INF/NOTICE.txt, through a webResources block in app/pom.xml.

• Root LICENSE.txt (source tree).

  • Removed: components no longer in the tree (YUI, jQuery 2.1.1, jQuery UI 1.11.0, Summernote, JDOM source).
  • Corrected: versions and paths for the theme assets (Bootstrap 3.4.1 and normalize.css in Gaurav, Font Awesome 3.2.1, YUI/Pure CSS grids in Fauxcoly).
  • Added: what was missing (jQuery 3.7.1 in Gaurav, jQuery Mobile CSS, the Octicons clippy.svg, Silk icons).

• binary-includes/LICENSE.txt (WAR and binary archives).

  • It covers all 106 jars in WEB-INF/lib from the integration build. license-maven-plugin found a license for each, and each was checked against the jar's own META-INF.
  • Non-Apache licenses:
    • MIT: SLF4J, Bouncy Castle, webjars-locator-lite
    • BSD: ASM, HdrHistogram
    • JDOM's own license
    • EDL 1.0: EclipseLink, JAXB, Jakarta Activation, Persistence and XML Binding
    • EPL-2.0: Jakarta EL and JSTL
  • The seven browser WebJars (MIT), and the fonts embedded in the PDF docs (OFL).
  • Where a jar is dual-licensed, the non-copyleft option is named: Javassist under Apache 2.0, EclipseLink and Jakarta Persistence under EDL, Jakarta EL and JSTL under EPL-2.0.

• binary-includes/NOTICE.txt. It adds the notices that bundled jars' own NOTICE files require:

  • Spring, Guice, Jackson and Micrometer;
  • Log4j Core's ResolverUtil, and the domTT and Struts2 Bootstrap notices;
  • Lucene, trimmed to the modules shipped.

  Plain ASF boilerplate is left out, as the licensing how-to allows.

mvn apache-rat:check passes. The WAR's META-INF files and both binary archives were byte-compared against binary-includes/.

Decisions from dev@ (Dave Johnson):

• The Category B files in the source tree (Font Awesome 3.2.1's OFL fonts in the Gaurav theme and the CC BY 2.5 Silk icons), searchhi.js and the theme icons with no recorded source are replaced or removed by Replace icons, fonts and scripts that can't ship in the 7.0 source release #266. Their LICENSE entries and the famfamfam NOTICE credit are gone here (9636915), and Bootstrap Icons (MIT) is credited for the outlines now drawn inline in the Gaurav and Fauxcoly themes.
• The "RSS and Atom in Action" credit is dropped from both NOTICE files, as of 2cafa12.

[snoopdave]

PR-Review: no issues found. The library versions I spot-checked against master (Spring 7.0.10, Guice 7.0.0, Log4j 2.26.1) match. As the description says, merge this after #260, #261, #262, #263 and #266, and recheck the versions against the final WEB-INF/lib then. If #266 adds credits for any of the remaining webapp/images/ files (see the comment there), this PR's LICENSE needs them too.

[snoopdave]

LGTM

[mraible]

I rechecked the versions against WEB-INF/lib from a build of master (with #261 and #263 merged) plus #260 and #266. That's the set this pull request will ship with.

• All 106 jars appear in binary-includes/LICENSE.txt at the version shipped. jquery-ui-1.14.2+1.jar is the WebJars repackaging of jQuery UI 1.14.2, which is what's listed.
• No entry is left for anything that no longer ships: the XML-RPC libraries, jcl-over-slf4j and Lucene 9 are all gone.
• Replace icons, fonts and scripts that can't ship in the 7.0 source release #266 needs no new credits. Its additions are Bootstrap Icons, which 75bfcce already credits.

If #260 or #266 changes before merging, I'll check again.