Illustrate the expected NOTICE/LICENSE

[jbonofre]

This PR illustrates what should be in LICENSE and NOTICE.

1. The root LICENSE and NOTICE are for source distribution
2. The root LICENSE-BINARY-DIST and NOTICE-BINARY-DIST are for all jar by default
3. cli/cli/LICENSE and cli/cli/NOTICE are for the nessie-cli jar (I provide an example of expected content here)
4. gc/gc-tool/LICENSE and gc/gc-tool/NOTICE are for the gc-tool jaar
5. servers/quarkus-server/runner/LICENSE and servers/quarkus-server/runner/NOTICE are for the Quarkus fat jar for nessie-server
6. tools/server-admin/runner/LICENSE and tools/server-admin/runner/NOTICE are for the Quarkus fat jar for nessie-admin-server

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[jbonofre]

@snazy @dimas-b this is the improvement proposal about LICENSE and NOTICE.

[jbonofre]

I can apply this to #10331 but I wanted to illustrate and provide what should be included or not included.

[dimas-b]

This approach make sense to me 👍

I'm not sure about some specific listed dependencies, though :)

[dimas-b]

Is it standard to use | as the prefix on included lines?

[jbonofre]

It's a way to clearly format the NOTICE file from dependency (to avoid to confuse the reader). It's used in several ASF projects.

[dimas-b]

Really? Where does EnvoyProxy get bundled?

[dimas-b]

@jbonofre : do you have any particular methodology for checking bundled stuff?

[jbonofre]

It's a transitive from gRPC: envoyproxy is shaded in gRPC:

$ jar tvf nessie-cli-0.102.5-SNAPSHOT.jar|grep -i envoyproxy
...
  2713 Tue Dec 10 17:19:14 CET 2024 io/grpc/xds/shaded/io/envoyproxy/pgv/validate/Validate$FieldRules$1.class
 17354 Tue Dec 10 17:19:14 CET 2024 io/grpc/xds/shaded/io/envoyproxy/pgv/validate/Validate$Fixed64Rules.class
 20939 Tue Dec 10 17:19:14 CET 2024 io/grpc/xds/shaded/io/envoyproxy/pgv/validate/Validate$UInt64Rules$Builder.class
  1260 Tue Dec 10 17:19:14 CET 2024 io/grpc/xds/shaded/io/envoyproxy/pgv/validate/Validate$DurationRulesOrBuilder.class
  1212 Tue Dec 10 17:19:14 CET 2024 io/grpc/xds/shaded/io/envoyproxy/pgv/validate/Validate$KnownRegex$1.class
 20839 Tue Dec 10 17:19:14 CET 2024 io/grpc/xds/shaded/io/envoyproxy/pgv/validate/Validate$SInt32Rules$Builder.class

To check, I check what is actually in the distributed jar using jar tvf foobar.jar.

[dimas-b]

Thx! Good find :)

I wonder, though, why cli even gets gRPC 🤔

[dimas-b]

Should we have this for every published jar?

[jbonofre]

NB: TODO is because I know gc-tool is shading dependencies, but I didn't have time to list yet. I will do that today.

[dimas-b]

No, I mean we should do this exercise for every published jar, right?.. or only for "fat" jars?

[dimas-b]

Do you mean this NOTICE to be included into the jar too?

[jbonofre]

Yes as the NOTICE might be specific (depending of the bundled dependencies).