This is an automated email from the ASF dual-hosted git repository.
lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git
The following commit(s) were added to refs/heads/rocketmq-studio by this push:
new 1e55597be build(server): make the license gate satisfiable and record
every determination (#6349)
1e55597be is described below
commit 1e55597be415582a62ddccf860a8463321faa192
Author: lizhimins <[email protected]>
AuthorDate: Mon Oct 12 18:23:11 2026 +0800
build(server): make the license gate satisfiable and record every
determination (#6349)
The gate required every bundled dependency JAR to carry its own upstream
LICENSE text inside itself. That is not satisfiable in principle: of the 277
dependencies in the fat JAR, 163 carry no license file at all (jtokkit, mcp,
antlr4-runtime, protobuf-java, logback, dom4j, curvesapi, reflections, every
netty native classifier JAR; bcprov has an org/bouncycastle/LICENSE.class,
which is code). So mvn package has not succeeded since the gate landed and the
release build could not run.
ASF asks a binary distribution to carry the terms, not each dependency to
embed them. The gate now accepts three recorded outcomes per artifact, keyed by
artifactId in server/scripts/legal-determinations.json:
- Apache-2.0 (143): covered by the distribution's own META-INF/LICENSE,
which is that text; a dependency's NOTICE is still merged into ours when
present. Elections are recorded — javassist takes Apache-2.0 out of
MPL-1.1/LGPL-2.1/Apache-2.0 (the old code read only the first <license>, which
is how a triple-licensed artifact looked LGPL), and the five com.aliyun
0.3.5-beta artifacts take it from their parent POM com.aliyun:core-service.
- other Category A (18): upstream text collected under
server/legal/licenses/ and embedded into the JAR, so the terms still ship.
Every one is verbatim from the exact version tag; SOURCES.md records
coordinate, declared license, elected license, URL and date.
- ASF Category B (2): logback-classic/core, EPL-2.0 — allowed only with a
recorded review decision, printed as a WARNING on every build and listed in the
manifest.
An artifact with neither internal text nor a determination still fails, so
a new dependency forces an explicit decision. GPL-family text inside a JAR is
still a hard error.
Also fixed a second stale assumption: Boot 4.x no longer copies the loader
artifact's META-INF/LICENSE.txt and NOTICE.txt into the repackaged JAR root,
and the loader classes come from spring-boot-loader-tools rather than a
dependency JAR, so there was nothing in the archive to read and the check could
never pass. Both are now collected from spring-boot-loader-tools 4.1.0 itself
and rejected if the NOTICE was collected for a different Spring-Boot-Version.
reflections needed a decision, not a download: dual-licensed WTFPL / New
BSD, but tag 0.9.11 publishes only COPYING.txt (WTFPL); no filled-in BSD text
exists there or at 0.9.12, and 0.10 switched to Apache-2.0 which does not apply
to 0.9.11. The SPDX BSD-3 template still says Copyright (c) [year], [fullname]
and upstream never published a filled copy, so it grants nothing and cannot
ship. The verbatim WTFPL text is kept and every build warns that WTFPL is not
named in the ASF license [...]
Verified: mvn -B -ntp package -DskipTests with the gate ON reports 278
components (143 Apache-covered, 20 from collected text, 2 Category B) and BUILD
SUCCESS. Four mutations each turn the gate red — deleting a determination,
deleting a collected text, rewriting the loader NOTICE to another Boot version,
blanking logback's review field — so this narrows the gate rather than
disabling it.
Still open: .github/workflows/ci.yml has no actions/setup-python, so
Backend Build (Java 21) will now fail on python3-not-found instead of on the
gate.
---
server/legal/licenses/SOURCES.md | 60 ++
server/legal/licenses/ST4.txt | 26 +
.../legal/licenses/animal-sniffer-annotations.txt | 21 +
server/legal/licenses/antlr-runtime.txt | 26 +
server/legal/licenses/antlr4-runtime.txt | 28 +
server/legal/licenses/bcprov-jdk18on.txt | 22 +
server/legal/licenses/curvesapi.txt | 28 +
server/legal/licenses/dom4j.txt | 39 +
server/legal/licenses/istack-commons-runtime.txt | 29 +
server/legal/licenses/jtokkit.txt | 21 +
server/legal/licenses/logback.txt | 797 +++++++++++++++++++++
server/legal/licenses/mcp.txt | 21 +
server/legal/licenses/protobuf-java.txt | 32 +
server/legal/licenses/reactive-streams.txt | 7 +
server/legal/licenses/reflections.txt | 13 +
.../legal/licenses/spring-boot-loader.LICENSE.txt | 202 ++++++
.../legal/licenses/spring-boot-loader.NOTICE.txt | 6 +
server/legal/licenses/webjars-locator-lite.txt | 18 +
server/legal/licenses/zstd-jni.txt | 26 +
server/scripts/legal-determinations.json | 521 ++++++++++++++
server/scripts/legal.py | 161 ++++-
21 files changed, 2086 insertions(+), 18 deletions(-)
diff --git a/server/legal/licenses/SOURCES.md b/server/legal/licenses/SOURCES.md
new file mode 100644
index 000000000..72f86d350
--- /dev/null
+++ b/server/legal/licenses/SOURCES.md
@@ -0,0 +1,60 @@
+# 第三方依赖上游许可证全文 — 来源清单
+
+`server/pom.xml` 的 `binary-license-gate`（`server/scripts/legal.py jar
<fat-jar>`）要求打进 fat jar
+的每个三方依赖都能拿出上游许可证全文。绝大多数 Maven 制品的 jar 内部不含 LICENSE 文件，因此把这些
+文本按依赖收集到本目录，门禁改从仓库读取。
+
+- 每份文件都是**上游原文逐字收录**，不翻译、不截断、不加本仓库自己的注释；文件内不写来源信息，
+ 来源一律记在本表。
+- 双许可组件把两份全文依次放进同一文件，中间用一行 `========== <许可名> ==========` 分隔；
+ 采用哪一份见「我们采用的许可」与「备注」。`logback.txt` 是这种形式（上游声明 + EPL-2.0 + LGPL-2.1）。
+ `reflections.txt` **例外**：只收 tag 内逐字发布的 WTFPL 一份，理由见主表该行。
+- 行尾统一 LF（无 CRLF），文件末尾保留且仅保留一个换行。
+- 取用方式：`gh api repos/<owner>/<repo>/contents/<path>?ref=<tag>`（走
api.github.com；本机
+ `raw.githubusercontent.com` 不可达）。全部 16 份都定位到了**对应版本的 tag**，无一退化到默认分支。
+- 取用时间：2026-10-12。
+
+## 主表
+
+| 文件名 | 组件坐标 | 声明许可 | 我们采用的许可 | 来源 URL | 取用时间 | 备注 |
+| :-- | :-- | :-- | :-- | :-- | :-- | :-- |
+| `jtokkit.txt` | `com.knuddels:jtokkit:1.1.0` | MIT | MIT |
https://github.com/knuddelsgmbh/jtokkit/blob/4c98bebbbc285de0432abca6b2c8f55f2f51133a/LICENSE
（tag `1.1.0`，文件 `LICENSE`） | 2026-10-12 | — |
+| `mcp.txt` |
`io.modelcontextprotocol.sdk:mcp:2.0.0`<br>`io.modelcontextprotocol.sdk:mcp-core:2.0.0`<br>`io.modelcontextprotocol.sdk:mcp-json-jackson3:2.0.0`
| MIT | MIT |
https://github.com/modelcontextprotocol/java-sdk/blob/f56d038409473210c59d6eddef09c4b5cd36042b/LICENSE
（tag `v2.0.0`，文件 `LICENSE`） | 2026-10-12 | **三个制品共用一份文本**（同仓库同 tag 的根
`LICENSE`；`mcp-parent` 根 pom 版本已核对为 `2.0.0`，且该 tag 下确有 `mcp-core` /
`mcp-json-jackson3` 模块目录） |
+| `animal-sniffer-annotations.txt` |
`org.codehaus.mojo:animal-sniffer-annotations:1.26` | MIT | MIT |
https://github.com/mojohaus/animal-sniffer/blob/a2d9596a701cc8c7a4b1741d5f09e8c16316d442/LICENSE
（tag `animal-sniffer-1.26`，文件 `LICENSE`） | 2026-10-12 | 上游版权声明为 `Copyright (c)
2009 codehaus.org.`（animal-sniffer 项目整体许可，覆盖 annotations 子模块） |
+| `antlr4-runtime.txt` | `org.antlr:antlr4-runtime:4.13.1` | BSD-3-Clause |
BSD-3-Clause |
https://github.com/antlr/antlr4/blob/7ed420ff2c78d62883875c442d75f32e73bc86c8/LICENSE.txt
（tag `4.13.1`，文件 `LICENSE.txt`） | 2026-10-12 | ⚠️ **marker 偏差（文本本身无问题）**：ANTLR
的第 3 条写作 `Neither name of copyright holders nor the names of its
contributors`，不含字面串 `Neither the name of`，标准 BSD-3 marker 校验会漏判。取的是该 tag 原文，未改字
|
+| `antlr-runtime.txt` | `org.antlr:antlr-runtime:3.5.3` | BSD |
BSD-3-Clause（ANTLR 变体） |
https://github.com/antlr/antlr3/blob/0519032bb167b37f206968d9037753ad655a2623/tool/LICENSE.txt
（tag `3.5.3`，文件 `tool/LICENSE.txt`） | 2026-10-12 | ⚠️ **待确认**。tag `3.5.3`
的仓库根目录与 `runtime/Java/` **都没有** LICENSE 文件（已用 `git/trees?recursive=1` 全树扫描，只有
`gunit/LICENSE.txt`、`tool/LICENSE.txt`、`runtime/Ruby/ANTLR-LICENSE.txt`
等各子模块副本）。根 `pom.xml` 声明 `BSD licence` → `http://antlr.org/license.html`。取同 tag
下 `to [...]
+| `protobuf-java.txt` |
`com.google.protobuf:protobuf-java:4.34.2`<br>`com.google.protobuf:protobuf-java-util:4.34.2`
| BSD-3-Clause | BSD-3-Clause |
https://github.com/protocolbuffers/protobuf/blob/b2f8f21c9a7b2bcd0cb26d92c459b7f2c30cd635/LICENSE
（tag `v34.2`，文件 `LICENSE`） | 2026-10-12 |
**两个制品共用一份文本**。版本映射已核对：`protobuf-java 4.34.2` ↔ protobuf release `34.2`，tag
`v34.2` 的 `java/pom.xml` 中 `<version>4.34.2</version>` |
+| `bcprov-jdk18on.txt` | `org.bouncycastle:bcprov-jdk18on:1.78.1` | Bouncy
Castle Licence（MIT 型） | MIT（即 Bouncy Castle Licence） |
https://github.com/bcgit/bc-java/blob/ada71e4cf20c990e045a57ee1d42378d84050e03/LICENSE.html
（tag `r1rv78v1`，文件 `LICENSE.html`） | 2026-10-12 | ⚠️ **待确认（marker
不匹配，非许可不匹配）**。tag `r1rv78v1`（= 版本 1.78.1，`gradle.properties` 中 `version=1.78.1`
已核对）下唯一法律文件是 `LICENSE.html`，为 **HTML 包裹的 MIT 全文**，本文件按原文逐字保留（含 `<html>`/`<p>`
标签），未剥标签。全仓库不含字面串 `Bouncy Castle Licence`；近似字样 [...]
+| `curvesapi.txt` | `com.github.virtuald:curvesapi:1.06` | BSD | BSD-3-Clause
|
https://github.com/virtuald/curvesapi/blob/d5185b552e4362a84042e3af1feff16a0d2fc11b/license.txt
（tag `1.06`，文件 `license.txt`，注意小写） | 2026-10-12 | 上游文件为 CRLF 行尾，按门禁要求转成
LF（仅换行符，正文字符未改）；BSD-3 marker 全中（含 `Neither the name of`） |
+| `dom4j.txt` | `org.dom4j:dom4j:2.1.4` | Plexus（BSD 型） | Plexus（BSD 型） |
https://github.com/dom4j/dom4j/blob/8db3742e13860c6767971867458073e8dd0fa1d1/LICENSE
（tag `version-2.1.4`，文件 `LICENSE`） | 2026-10-12 | ⚠️ **marker
偏差（文本本身无问题）**：dom4j 用的是 Plexus 风格 BSD 变体，首句为 `Redistribution and use of this
software and associated documentation`（非 `…in source and binary forms`），第 3 条为
`The name "DOM4J" must not be used…`（非 `Neither the name of`），两个标准 BSD marker
均不命中。取的是该 tag 原文 |
+| `istack-commons-runtime.txt` | `com.sun.istack:istack-commons-runtime:4.1.2`
| EDL 1.0（BSD 型） | EDL 1.0（= BSD-3-Clause） |
https://github.com/eclipse-ee4j/jaxb-istack-commons/blob/343a28eabbd483e9ac0c5d7be32c1aa50ba52631/LICENSE.md
（tag `4.1.2`，文件 `LICENSE.md`） | 2026-10-12 | ⚠️ **marker 偏差**：Eclipse
Distribution License 1.0 的正文本身就是 BSD-3-Clause 文本（版权主体写作 `Eclipse Foundation,
Inc.`），文件内不含字面串 `Eclipse Distribution License`，EDL marker 校验会漏判；BSD-3 marker（含
`Neither the name of`）全中 |
+| `reactive-streams.txt` | `org.reactivestreams:reactive-streams:1.0.4` |
MIT-0 / CC0 | MIT-0 |
https://github.com/reactive-streams/reactive-streams/blob/944163a4b2477a2bebaaada86b0ba910b6302f2f/LICENSE
（tag `v1.0.4`，文件 `LICENSE`） | 2026-10-12 | 上游 LICENSE 首行即 `MIT No
Attribution`（= MIT-0），无 CC0 文本；MIT marker 命中 |
+| `reflections.txt` | `org.reflections:reflections:0.9.11` | WTFPL 或 New
BSD（双许可） | **WTFPL**（tag 内唯一逐字发布的一份） |
https://github.com/ronmamo/reflections/blob/c95609a4e83e1f3fc71e4b2fc58b17352a16eef7/COPYING.txt
（tag `0.9.11`，文件 `COPYING.txt`） | 2026-10-12 | ⚠️ **待 PMC/法务确认**。本件由
`org.apache.rocketmq:rocketmq-tools:5.5.0` 传递引入，我方代码不直接调用。双许可里 **New BSD 的全文在
0.9.11 tag 内并不存在**（该 tag 根目录只有 `COPYING.txt`；源码文件无许可头；0.9.12 也没有；0.10 起新增的
`LICENSE-2.0.txt` 经核对是 Apache-2.0，对 0.9.11 无效），所以可选的只有「tag 内逐 [...]
+| `ST4.txt` | `org.antlr:ST4:4.3.4` | BSD | BSD-3-Clause（ANTLR 变体） |
https://github.com/antlr/stringtemplate4/blob/a2c4ef074e7c5018c7eb46372ed07f756c140404/LICENSE.txt
（tag `ST4-4.3.4`，文件 `LICENSE.txt`） | 2026-10-12 | ⚠️ **marker 偏差**：与
`antlr-runtime.txt` 同一 ANTLR 变体措辞，第 3 条为 `The name of the author may not be
used…`，不含字面 `Neither the name of`。取的是该 tag 原文（`Copyright (c) 2011-2022 Terence
Parr`） |
+| `webjars-locator-lite.txt` | `org.webjars:webjars-locator-lite:1.1.3` | MIT
| MIT |
https://github.com/webjars/webjars-locator-lite/blob/f1ccc59473da1853f7258943a6baa0710fa2e960/LICENSE.md
（tag `webjars-locator-lite-1.1.3`，文件 `LICENSE.md`） | 2026-10-12 | — |
+| `zstd-jni.txt` | `com.github.luben:zstd-jni:1.5.2-2` | BSD-2-Clause |
BSD-2-Clause |
https://github.com/luben/zstd-jni/blob/3d5ab915167f2dfe244d2d2192b66a9feac7c543/LICENSE
（tag `v1.5.2-2`，文件 `LICENSE`） | 2026-10-12 | BSD-2 正确**不含** `Neither the name
of`；含 `Redistribution and use in source and binary forms` |
+| `logback.txt` |
`ch.qos.logback:logback-classic:1.5.34`<br>`ch.qos.logback:logback-core:1.5.34`
| EPL-2.0（另有 LGPL-2.1 可选） | **EPL-2.0** |
双许可声明：https://github.com/qos-ch/logback/blob/e62272ac152469aec1ede056c3c7d0d7314e7bfe/LICENSE.txt
（tag `v_1.5.34`）<br>EPL-2.0
全文：https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt<br>LGPL-2.1
全文：https://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt | 2026-10-12 |
**两个制品共用一份文本**。文件内三段，依次为：`========== Logback dual-licence notice (upstream
LICEN [...]
+
+## 校验口径与已知偏差
+
+门禁脚本按许可类型校验标志性字样时，以下 6 份会因**上游措辞差异**而漏判，文本本身都是对应 tag
+的原文，不要按 marker 失败去改文本：
+
+| 文件 | 期望 marker | 实际 | 结论 |
+| :-- | :-- | :-- | :-- |
+| `antlr4-runtime.txt` | `Neither the name of` | `Neither name of copyright
holders nor the names of its contributors` | ⚠️ marker 偏差 |
+| `antlr-runtime.txt` | `Neither the name of` | `The name of the author may
not be used to endorse…` | ⚠️ 待确认（tag 内无 Java runtime 专属 LICENSE） |
+| `ST4.txt` | `Neither the name of` | `The name of the author may not be used
to endorse…` | ⚠️ marker 偏差 |
+| `dom4j.txt` | `Redistribution and use in source and binary forms` + `Neither
the name of` | Plexus 变体，两条都不命中 | ⚠️ marker 偏差 |
+| `istack-commons-runtime.txt` | `Eclipse Distribution License` | EDL 1.0 正文即
BSD-3 文本，无该标题行 | ⚠️ marker 偏差（BSD-3 marker 全中） |
+| `bcprov-jdk18on.txt` | `Bouncy Castle Licence` | 上游为 HTML 包裹的 MIT 全文，无该字面串 |
⚠️ 待确认（MIT marker 命中） |
+
+最终 16 份**全部是上游 tag 内的逐字原文**：`reflections.txt` 初版曾把 SPDX 的 BSD-3 规范模板
+（带 `[year]` / `[fullname]` 占位符）作为第二份收进来，已删除，只留 tag `0.9.11` 的 `COPYING.txt`；
+`antlr-runtime.txt` 取的是同一 tag 的 `tool/LICENSE.txt`（ANTLR 3 全项目同一份 BSD 文本，
+Java runtime 目录下没有单独放）；`bcprov-jdk18on.txt` 是上游 `LICENSE.html` 的逐字内容
+（Bouncy Castle 就以 HTML 形式发布许可，未做重排）。
+
+其余 10 份（`jtokkit` / `mcp` / `animal-sniffer-annotations` / `protobuf-java` /
`curvesapi` /
+`reactive-streams` / `webjars-locator-lite` / `zstd-jni` / `logback` 的 EPL-2.0
段 /
+`reflections` 的 WTFPL 全文）marker 全部命中。
diff --git a/server/legal/licenses/ST4.txt b/server/legal/licenses/ST4.txt
new file mode 100644
index 000000000..a867b8e2f
--- /dev/null
+++ b/server/legal/licenses/ST4.txt
@@ -0,0 +1,26 @@
+[The "BSD license"]
+Copyright (c) 2011-2022 Terence Parr
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+ 1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+ 3. The name of the author may not be used to endorse or promote products
+ derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/server/legal/licenses/animal-sniffer-annotations.txt
b/server/legal/licenses/animal-sniffer-annotations.txt
new file mode 100644
index 000000000..370fb559b
--- /dev/null
+++ b/server/legal/licenses/animal-sniffer-annotations.txt
@@ -0,0 +1,21 @@
+The MIT License
+
+Copyright (c) 2009 codehaus.org.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/server/legal/licenses/antlr-runtime.txt
b/server/legal/licenses/antlr-runtime.txt
new file mode 100644
index 000000000..a5216ef20
--- /dev/null
+++ b/server/legal/licenses/antlr-runtime.txt
@@ -0,0 +1,26 @@
+[The "BSD license"]
+Copyright (c) 2013 Terence Parr
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+ 1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+ 3. The name of the author may not be used to endorse or promote products
+ derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/server/legal/licenses/antlr4-runtime.txt
b/server/legal/licenses/antlr4-runtime.txt
new file mode 100644
index 000000000..5d2769415
--- /dev/null
+++ b/server/legal/licenses/antlr4-runtime.txt
@@ -0,0 +1,28 @@
+Copyright (c) 2012-2022 The ANTLR Project. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+3. Neither name of copyright holders nor the names of its contributors
+may be used to endorse or promote products derived from this software
+without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR
+CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/server/legal/licenses/bcprov-jdk18on.txt
b/server/legal/licenses/bcprov-jdk18on.txt
new file mode 100644
index 000000000..c300d6164
--- /dev/null
+++ b/server/legal/licenses/bcprov-jdk18on.txt
@@ -0,0 +1,22 @@
+<html>
+<body bgcolor=#ffffff>
+
+Copyright (c) 2000-2023 The Legion of the Bouncy Castle Inc.
(https://www.bouncycastle.org)
+<p>
+Permission is hereby granted, free of charge, to any person obtaining a copy
of this software
+and associated documentation files (the "Software"), to deal in the Software
without restriction,
+including without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense,
+and/or sell copies of the Software, and to permit persons to whom the Software
is furnished to do so,
+subject to the following conditions:
+<p>
+The above copyright notice and this permission notice shall be included in all
copies or substantial
+portions of the Software.
+<p>
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR
+PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
OR OTHER
+DEALINGS IN THE SOFTWARE.
+</body>
+</html>
diff --git a/server/legal/licenses/curvesapi.txt
b/server/legal/licenses/curvesapi.txt
new file mode 100644
index 000000000..e30f01523
--- /dev/null
+++ b/server/legal/licenses/curvesapi.txt
@@ -0,0 +1,28 @@
+Copyright (c) 2005, Graph Builder
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+-Redistributions of source code must retain the above copyright notice,
+this list of conditions and the following disclaimer.
+
+-Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+-Neither the name of Graph Builder nor the names of its contributors may be
+used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/server/legal/licenses/dom4j.txt b/server/legal/licenses/dom4j.txt
new file mode 100644
index 000000000..1a02acb14
--- /dev/null
+++ b/server/legal/licenses/dom4j.txt
@@ -0,0 +1,39 @@
+Copyright 2001-2023 © MetaStuff, Ltd. and DOM4J contributors. All Rights
Reserved.
+
+Redistribution and use of this software and associated documentation
+("Software"), with or without modification, are permitted provided
+that the following conditions are met:
+
+1. Redistributions of source code must retain copyright
+ statements and notices. Redistributions must also contain a
+ copy of this document.
+
+2. Redistributions in binary form must reproduce the
+ above copyright notice, this list of conditions and the
+ following disclaimer in the documentation and/or other
+ materials provided with the distribution.
+
+3. The name "DOM4J" must not be used to endorse or promote
+ products derived from this Software without prior written
+ permission of MetaStuff, Ltd. For written permission,
+ please contact [email protected].
+
+4. Products derived from this Software may not be called "DOM4J"
+ nor may "DOM4J" appear in their names without prior written
+ permission of MetaStuff, Ltd. DOM4J is a registered
+ trademark of MetaStuff, Ltd.
+
+5. Due credit should be given to the DOM4J Project - https://dom4j.github.io/
+
+THIS SOFTWARE IS PROVIDED BY METASTUFF, LTD. AND CONTRIBUTORS
+``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT
+NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+METASTUFF, LTD. OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/server/legal/licenses/istack-commons-runtime.txt
b/server/legal/licenses/istack-commons-runtime.txt
new file mode 100644
index 000000000..c739f78bc
--- /dev/null
+++ b/server/legal/licenses/istack-commons-runtime.txt
@@ -0,0 +1,29 @@
+
+ Copyright (c) 2017 Oracle and/or its affiliates. All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+
+ - Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+
+ - Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+ - Neither the name of the Eclipse Foundation, Inc. nor the names of its
+ contributors may be used to endorse or promote products derived
+ from this software without specific prior written permission.
+
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/server/legal/licenses/jtokkit.txt
b/server/legal/licenses/jtokkit.txt
new file mode 100644
index 000000000..7d74bd68e
--- /dev/null
+++ b/server/legal/licenses/jtokkit.txt
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Knuddels, Philip Müller
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/server/legal/licenses/logback.txt
b/server/legal/licenses/logback.txt
new file mode 100644
index 000000000..e2d24bd87
--- /dev/null
+++ b/server/legal/licenses/logback.txt
@@ -0,0 +1,797 @@
+========== Logback dual-licence notice (upstream LICENSE.txt) ==========
+Logback LICENSE
+---------------
+
+Logback: the reliable, generic, fast and flexible logging framework.
+Copyright (C) 1999-2024, QOS.ch. All rights reserved.
+
+This program and the accompanying materials are dual-licensed under
+either the terms of the Eclipse Public License v2.0 as published by
+the Eclipse Foundation
+
+ or (per the licensee's choosing)
+
+under the terms of the GNU Lesser General Public License version 2.1
+as published by the Free Software Foundation.
+
+========== EPL-2.0 (Eclipse Public License - v 2.0) ==========
+Eclipse Public License - v 2.0
+
+ THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE
+ PUBLIC LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION
+ OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+ a) in the case of the initial Contributor, the initial content
+ Distributed under this Agreement, and
+
+ b) in the case of each subsequent Contributor:
+ i) changes to the Program, and
+ ii) additions to the Program;
+ where such changes and/or additions to the Program originate from
+ and are Distributed by that particular Contributor. A Contribution
+ "originates" from a Contributor if it was added to the Program by
+ such Contributor itself or anyone acting on such Contributor's behalf.
+ Contributions do not include changes or additions to the Program that
+ are not Modified Works.
+
+"Contributor" means any person or entity that Distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which
+are necessarily infringed by the use or sale of its Contribution alone
+or when combined with the Program.
+
+"Program" means the Contributions Distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement
+or any Secondary License (as applicable), including Contributors.
+
+"Derivative Works" shall mean any work, whether in Source Code or other
+form, that is based on (or derived from) the Program and for which the
+editorial revisions, annotations, elaborations, or other modifications
+represent, as a whole, an original work of authorship.
+
+"Modified Works" shall mean any work in Source Code or other form that
+results from an addition to, deletion from, or modification of the
+contents of the Program, including, for purposes of clarity any new file
+in Source Code form that contains any contents of the Program. Modified
+Works shall not include works that contain only declarations,
+interfaces, types, classes, structures, or files of the Program solely
+in each case in order to link to, bind by name, or subclass the Program
+or Modified Works thereof.
+
+"Distribute" means the acts of a) distributing or b) making available
+in any manner that enables the transfer of a copy.
+
+"Source Code" means the form of a Program preferred for making
+modifications, including but not limited to software source code,
+documentation source, and configuration files.
+
+"Secondary License" means either the GNU General Public License,
+Version 2.0, or any later versions of that license, including any
+exceptions or additional permissions as identified by the initial
+Contributor.
+
+2. GRANT OF RIGHTS
+
+ a) Subject to the terms of this Agreement, each Contributor hereby
+ grants Recipient a non-exclusive, worldwide, royalty-free copyright
+ license to reproduce, prepare Derivative Works of, publicly display,
+ publicly perform, Distribute and sublicense the Contribution of such
+ Contributor, if any, and such Derivative Works.
+
+ b) Subject to the terms of this Agreement, each Contributor hereby
+ grants Recipient a non-exclusive, worldwide, royalty-free patent
+ license under Licensed Patents to make, use, sell, offer to sell,
+ import and otherwise transfer the Contribution of such Contributor,
+ if any, in Source Code or other form. This patent license shall
+ apply to the combination of the Contribution and the Program if, at
+ the time the Contribution is added by the Contributor, such addition
+ of the Contribution causes such combination to be covered by the
+ Licensed Patents. The patent license shall not apply to any other
+ combinations which include the Contribution. No hardware per se is
+ licensed hereunder.
+
+ c) Recipient understands that although each Contributor grants the
+ licenses to its Contributions set forth herein, no assurances are
+ provided by any Contributor that the Program does not infringe the
+ patent or other intellectual property rights of any other entity.
+ Each Contributor disclaims any liability to Recipient for claims
+ brought by any other entity based on infringement of intellectual
+ property rights or otherwise. As a condition to exercising the
+ rights and licenses granted hereunder, each Recipient hereby
+ assumes sole responsibility to secure any other intellectual
+ property rights needed, if any. For example, if a third party
+ patent license is required to allow Recipient to Distribute the
+ Program, it is Recipient's responsibility to acquire that license
+ before distributing the Program.
+
+ d) Each Contributor represents that to its knowledge it has
+ sufficient copyright rights in its Contribution, if any, to grant
+ the copyright license set forth in this Agreement.
+
+ e) Notwithstanding the terms of any Secondary License, no
+ Contributor makes additional grants to any Recipient (other than
+ those set forth in this Agreement) as a result of such Recipient's
+ receipt of the Program under the terms of a Secondary License
+ (if permitted under the terms of Section 3).
+
+3. REQUIREMENTS
+
+3.1 If a Contributor Distributes the Program in any form, then:
+
+ a) the Program must also be made available as Source Code, in
+ accordance with section 3.2, and the Contributor must accompany
+ the Program with a statement that the Source Code for the Program
+ is available under this Agreement, and informs Recipients how to
+ obtain it in a reasonable manner on or through a medium customarily
+ used for software exchange; and
+
+ b) the Contributor may Distribute the Program under a license
+ different than this Agreement, provided that such license:
+ i) effectively disclaims on behalf of all other Contributors all
+ warranties and conditions, express and implied, including
+ warranties or conditions of title and non-infringement, and
+ implied warranties or conditions of merchantability and fitness
+ for a particular purpose;
+
+ ii) effectively excludes on behalf of all other Contributors all
+ liability for damages, including direct, indirect, special,
+ incidental and consequential damages, such as lost profits;
+
+ iii) does not attempt to limit or alter the recipients' rights
+ in the Source Code under section 3.2; and
+
+ iv) requires any subsequent distribution of the Program by any
+ party to be under a license that satisfies the requirements
+ of this section 3.
+
+3.2 When the Program is Distributed as Source Code:
+
+ a) it must be made available under this Agreement, or if the
+ Program (i) is combined with other material in a separate file or
+ files made available under a Secondary License, and (ii) the initial
+ Contributor attached to the Source Code the notice described in
+ Exhibit A of this Agreement, then the Program may be made available
+ under the terms of such Secondary Licenses, and
+
+ b) a copy of this Agreement must be included with each copy of
+ the Program.
+
+3.3 Contributors may not remove or alter any copyright, patent,
+trademark, attribution notices, disclaimers of warranty, or limitations
+of liability ("notices") contained within the Program from any copy of
+the Program which they Distribute, provided that Contributors may add
+their own appropriate notices.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities
+with respect to end users, business partners and the like. While this
+license is intended to facilitate the commercial use of the Program,
+the Contributor who includes the Program in a commercial product
+offering should do so in a manner which does not create potential
+liability for other Contributors. Therefore, if a Contributor includes
+the Program in a commercial product offering, such Contributor
+("Commercial Contributor") hereby agrees to defend and indemnify every
+other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits
+and other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such
+Commercial Contributor in connection with its distribution of the Program
+in a commercial product offering. The obligations in this section do not
+apply to any claims or Losses relating to any actual or alleged
+intellectual property infringement. In order to qualify, an Indemnified
+Contributor must: a) promptly notify the Commercial Contributor in
+writing of such claim, and b) allow the Commercial Contributor to control,
+and cooperate with the Commercial Contributor in, the defense and any
+related settlement negotiations. The Indemnified Contributor may
+participate in any such claim at its own expense.
+
+For example, a Contributor might include the Program in a commercial
+product offering, Product X. That Contributor is then a Commercial
+Contributor. If that Commercial Contributor then makes performance
+claims, or offers warranties related to Product X, those performance
+claims and warranties are such Commercial Contributor's responsibility
+alone. Under this section, the Commercial Contributor would have to
+defend claims against the other Contributors related to those performance
+claims and warranties, and if a court requires any other Contributor to
+pay any damages as a result, the Commercial Contributor must pay
+those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT
+PERMITTED BY APPLICABLE LAW, THE PROGRAM IS PROVIDED ON AN "AS IS"
+BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF
+TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR
+PURPOSE. Each Recipient is solely responsible for determining the
+appropriateness of using and distributing the Program and assumes all
+risks associated with its exercise of rights under this Agreement,
+including but not limited to the risks and costs of program errors,
+compliance with applicable laws, damage to or loss of data, programs
+or equipment, and unavailability or interruption of operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT
+PERMITTED BY APPLICABLE LAW, NEITHER RECIPIENT NOR ANY CONTRIBUTORS
+SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST
+PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of
+the remainder of the terms of this Agreement, and without further
+action by the parties hereto, such provision shall be reformed to the
+minimum extent necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity
+(including a cross-claim or counterclaim in a lawsuit) alleging that the
+Program itself (excluding combinations of the Program with other software
+or hardware) infringes such Recipient's patent(s), then such Recipient's
+rights granted under Section 2(b) shall terminate as of the date such
+litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it
+fails to comply with any of the material terms or conditions of this
+Agreement and does not cure such failure in a reasonable period of
+time after becoming aware of such noncompliance. If all Recipient's
+rights under this Agreement terminate, Recipient agrees to cease use
+and distribution of the Program as soon as reasonably practicable.
+However, Recipient's obligations under this Agreement and any licenses
+granted by Recipient relating to the Program shall continue and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement,
+but in order to avoid inconsistency the Agreement is copyrighted and
+may only be modified in the following manner. The Agreement Steward
+reserves the right to publish new versions (including revisions) of
+this Agreement from time to time. No one other than the Agreement
+Steward has the right to modify this Agreement. The Eclipse Foundation
+is the initial Agreement Steward. The Eclipse Foundation may assign the
+responsibility to serve as the Agreement Steward to a suitable separate
+entity. Each new version of the Agreement will be given a distinguishing
+version number. The Program (including Contributions) may always be
+Distributed subject to the version of the Agreement under which it was
+received. In addition, after a new version of the Agreement is published,
+Contributor may elect to Distribute the Program (including its
+Contributions) under the new version.
+
+Except as expressly stated in Sections 2(a) and 2(b) above, Recipient
+receives no rights or licenses to the intellectual property of any
+Contributor under this Agreement, whether expressly, by implication,
+estoppel or otherwise. All rights in the Program not expressly granted
+under this Agreement are reserved. Nothing in this Agreement is intended
+to be enforceable by any entity that is not a Contributor or Recipient.
+No third-party beneficiary rights are created under this Agreement.
+
+Exhibit A - Form of Secondary Licenses Notice
+
+"This Source Code may also be made available under the following
+Secondary Licenses when the conditions for such availability set forth
+in the Eclipse Public License, v. 2.0 are satisfied: {name license(s),
+version(s), and exceptions or additional permissions here}."
+
+ Simply including a copy of this Agreement, including this Exhibit A
+ is not sufficient to license the Source Code under Secondary Licenses.
+
+ If it is not possible or desirable to put the notice in a particular
+ file, then You may include the notice in a location (such as a LICENSE
+ file in a relevant directory) where a recipient would be likely to
+ look for such a notice.
+
+ You may add additional accurate notices of copyright ownership.
+
+========== LGPL-2.1 (GNU Lesser General Public License v2.1) ==========
+ GNU LESSER GENERAL PUBLIC LICENSE
+ Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL. It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+ Preamble
+
+ The licenses for most software are designed to take away your
+freedom to share and change it. By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+ This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it. You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+ When we speak of free software, we are referring to freedom of use,
+not price. Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+ To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights. These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+ For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you. You must make sure that they, too, receive or can get the source
+code. If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it. And you must show them these terms so they know their rights.
+
+ We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+ To protect each distributor, we want to make it very clear that
+there is no warranty for the free library. Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+ Finally, software patents pose a constant threat to the existence of
+any free program. We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder. Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+ Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License. This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License. We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+ When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library. The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom. The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+ We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License. It also provides other free software developers Less
+of an advantage over competing non-free programs. These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries. However, the Lesser license provides advantages in certain
+special circumstances.
+
+ For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard. To achieve this, non-free programs must be
+allowed to use the library. A more frequent case is that a free
+library does the same job as widely used non-free libraries. In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+ In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software. For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+ Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+ The precise terms and conditions for copying, distribution and
+modification follow. Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library". The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+ GNU LESSER GENERAL PUBLIC LICENSE
+ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+ 0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+ A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+ The "Library", below, refers to any such software library or work
+which has been distributed under these terms. A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language. (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+ "Source code" for a work means the preferred form of the work for
+making modifications to it. For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+ Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope. The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it). Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+ 1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+ You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+ 2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+ a) The modified work must itself be a software library.
+
+ b) You must cause the files modified to carry prominent notices
+ stating that you changed the files and the date of any change.
+
+ c) You must cause the whole of the work to be licensed at no
+ charge to all third parties under the terms of this License.
+
+ d) If a facility in the modified Library refers to a function or a
+ table of data to be supplied by an application program that uses
+ the facility, other than as an argument passed when the facility
+ is invoked, then you must make a good faith effort to ensure that,
+ in the event an application does not supply such function or
+ table, the facility still operates, and performs whatever part of
+ its purpose remains meaningful.
+
+ (For example, a function in a library to compute square roots has
+ a purpose that is entirely well-defined independent of the
+ application. Therefore, Subsection 2d requires that any
+ application-supplied function or table used by this function must
+ be optional: if the application does not supply it, the square
+ root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole. If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works. But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+ 3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library. To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License. (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.) Do not make any other change in
+these notices.
+
+ Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+ This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+ 4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+ If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+ 5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library". Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+ However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library". The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+ When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library. The
+threshold for this to be true is not precisely defined by law.
+
+ If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work. (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+ Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+ 6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+ You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License. You must supply a copy of this License. If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License. Also, you must do one
+of these things:
+
+ a) Accompany the work with the complete corresponding
+ machine-readable source code for the Library including whatever
+ changes were used in the work (which must be distributed under
+ Sections 1 and 2 above); and, if the work is an executable linked
+ with the Library, with the complete machine-readable "work that
+ uses the Library", as object code and/or source code, so that the
+ user can modify the Library and then relink to produce a modified
+ executable containing the modified Library. (It is understood
+ that the user who changes the contents of definitions files in the
+ Library will not necessarily be able to recompile the application
+ to use the modified definitions.)
+
+ b) Use a suitable shared library mechanism for linking with the
+ Library. A suitable mechanism is one that (1) uses at run time a
+ copy of the library already present on the user's computer system,
+ rather than copying library functions into the executable, and (2)
+ will operate properly with a modified version of the library, if
+ the user installs one, as long as the modified version is
+ interface-compatible with the version that the work was made with.
+
+ c) Accompany the work with a written offer, valid for at
+ least three years, to give the same user the materials
+ specified in Subsection 6a, above, for a charge no more
+ than the cost of performing this distribution.
+
+ d) If distribution of the work is made by offering access to copy
+ from a designated place, offer equivalent access to copy the above
+ specified materials from the same place.
+
+ e) Verify that the user has already received a copy of these
+ materials or that you have already sent this user a copy.
+
+ For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it. However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+ It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system. Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+ 7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+ a) Accompany the combined library with a copy of the same work
+ based on the Library, uncombined with any other library
+ facilities. This must be distributed under the terms of the
+ Sections above.
+
+ b) Give prominent notice with the combined library of the fact
+ that part of it is a work based on the Library, and explaining
+ where to find the accompanying uncombined form of the same work.
+
+ 8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License. Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License. However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+ 9. You are not required to accept this License, since you have not
+signed it. However, nothing else grants you permission to modify or
+distribute the Library or its derivative works. These actions are
+prohibited by law if you do not accept this License. Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+ 10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions. You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+ 11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all. For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices. Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+ 12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded. In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+ 13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation. If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+ 14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission. For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this. Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+ NO WARRANTY
+
+ 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+ 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+ END OF TERMS AND CONDITIONS
+
+ How to Apply These Terms to Your New Libraries
+
+ If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change. You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms of the
+ordinary General Public License).
+
+ To apply these terms, attach the following notices to the library. It is
+safest to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+ <one line to give the library's name and a brief idea of what it does.>
+ Copyright (C) <year> <name of author>
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with this library; if not, see
<https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the library, if
+necessary. Here is a sample; alter the names:
+
+ Yoyodyne, Inc., hereby disclaims all copyright interest in the
+ library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+
+ <signature of Moe Ghoul>, 1 April 1990
+ Moe Ghoul, President of Vice
+
+That's all there is to it!
diff --git a/server/legal/licenses/mcp.txt b/server/legal/licenses/mcp.txt
new file mode 100644
index 000000000..4bbd84189
--- /dev/null
+++ b/server/legal/licenses/mcp.txt
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 the original author or authors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/server/legal/licenses/protobuf-java.txt
b/server/legal/licenses/protobuf-java.txt
new file mode 100644
index 000000000..19b305b00
--- /dev/null
+++ b/server/legal/licenses/protobuf-java.txt
@@ -0,0 +1,32 @@
+Copyright 2008 Google Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+ * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+ * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Code generated by the Protocol Buffer compiler is owned by the owner
+of the input file used when generating it. This code is not
+standalone and requires a support library to be linked with it. This
+support library is itself covered by the above license.
diff --git a/server/legal/licenses/reactive-streams.txt
b/server/legal/licenses/reactive-streams.txt
new file mode 100644
index 000000000..1e141c13d
--- /dev/null
+++ b/server/legal/licenses/reactive-streams.txt
@@ -0,0 +1,7 @@
+MIT No Attribution
+
+Copyright 2014 Reactive Streams
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to do
so.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
diff --git a/server/legal/licenses/reflections.txt
b/server/legal/licenses/reflections.txt
new file mode 100644
index 000000000..082c994f2
--- /dev/null
+++ b/server/legal/licenses/reflections.txt
@@ -0,0 +1,13 @@
+DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ Version 2, December 2004
+
+ Copyright (C) 2004 Sam Hocevar <[email protected]>
+
+ Everyone is permitted to copy and distribute verbatim or modified
+ copies of this license document, and changing it is allowed as long
+ as the name is changed.
+
+ DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+ 0. You just DO WHAT THE FUCK YOU WANT TO.
diff --git a/server/legal/licenses/spring-boot-loader.LICENSE.txt
b/server/legal/licenses/spring-boot-loader.LICENSE.txt
new file mode 100644
index 000000000..823c1c8e9
--- /dev/null
+++ b/server/legal/licenses/spring-boot-loader.LICENSE.txt
@@ -0,0 +1,202 @@
+
+ Apache License
+ Version 2.0, January 2004
+ https://www.apache.org/licenses/
+
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+ 1. Definitions.
+
+ "License" shall mean the terms and conditions for use, reproduction,
+ and distribution as defined by Sections 1 through 9 of this document.
+
+ "Licensor" shall mean the copyright owner or entity authorized by
+ the copyright owner that is granting the License.
+
+ "Legal Entity" shall mean the union of the acting entity and all
+ other entities that control, are controlled by, or are under common
+ control with that entity. For the purposes of this definition,
+ "control" means (i) the power, direct or indirect, to cause the
+ direction or management of such entity, whether by contract or
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
+ outstanding shares, or (iii) beneficial ownership of such entity.
+
+ "You" (or "Your") shall mean an individual or Legal Entity
+ exercising permissions granted by this License.
+
+ "Source" form shall mean the preferred form for making modifications,
+ including but not limited to software source code, documentation
+ source, and configuration files.
+
+ "Object" form shall mean any form resulting from mechanical
+ transformation or translation of a Source form, including but
+ not limited to compiled object code, generated documentation,
+ and conversions to other media types.
+
+ "Work" shall mean the work of authorship, whether in Source or
+ Object form, made available under the License, as indicated by a
+ copyright notice that is included in or attached to the work
+ (an example is provided in the Appendix below).
+
+ "Derivative Works" shall mean any work, whether in Source or Object
+ form, that is based on (or derived from) the Work and for which the
+ editorial revisions, annotations, elaborations, or other modifications
+ represent, as a whole, an original work of authorship. For the purposes
+ of this License, Derivative Works shall not include works that remain
+ separable from, or merely link (or bind by name) to the interfaces of,
+ the Work and Derivative Works thereof.
+
+ "Contribution" shall mean any work of authorship, including
+ the original version of the Work and any modifications or additions
+ to that Work or Derivative Works thereof, that is intentionally
+ submitted to Licensor for inclusion in the Work by the copyright owner
+ or by an individual or Legal Entity authorized to submit on behalf of
+ the copyright owner. For the purposes of this definition, "submitted"
+ means any form of electronic, verbal, or written communication sent
+ to the Licensor or its representatives, including but not limited to
+ communication on electronic mailing lists, source code control systems,
+ and issue tracking systems that are managed by, or on behalf of, the
+ Licensor for the purpose of discussing and improving the Work, but
+ excluding communication that is conspicuously marked or otherwise
+ designated in writing by the copyright owner as "Not a Contribution."
+
+ "Contributor" shall mean Licensor and any individual or Legal Entity
+ on behalf of whom a Contribution has been received by Licensor and
+ subsequently incorporated within the Work.
+
+ 2. Grant of Copyright License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ copyright license to reproduce, prepare Derivative Works of,
+ publicly display, publicly perform, sublicense, and distribute the
+ Work and such Derivative Works in Source or Object form.
+
+ 3. Grant of Patent License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ (except as stated in this section) patent license to make, have made,
+ use, offer to sell, sell, import, and otherwise transfer the Work,
+ where such license applies only to those patent claims licensable
+ by such Contributor that are necessarily infringed by their
+ Contribution(s) alone or by combination of their Contribution(s)
+ with the Work to which such Contribution(s) was submitted. If You
+ institute patent litigation against any entity (including a
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
+ or a Contribution incorporated within the Work constitutes direct
+ or contributory patent infringement, then any patent licenses
+ granted to You under this License for that Work shall terminate
+ as of the date such litigation is filed.
+
+ 4. Redistribution. You may reproduce and distribute copies of the
+ Work or Derivative Works thereof in any medium, with or without
+ modifications, and in Source or Object form, provided that You
+ meet the following conditions:
+
+ (a) You must give any other recipients of the Work or
+ Derivative Works a copy of this License; and
+
+ (b) You must cause any modified files to carry prominent notices
+ stating that You changed the files; and
+
+ (c) You must retain, in the Source form of any Derivative Works
+ that You distribute, all copyright, patent, trademark, and
+ attribution notices from the Source form of the Work,
+ excluding those notices that do not pertain to any part of
+ the Derivative Works; and
+
+ (d) If the Work includes a "NOTICE" text file as part of its
+ distribution, then any Derivative Works that You distribute must
+ include a readable copy of the attribution notices contained
+ within such NOTICE file, excluding those notices that do not
+ pertain to any part of the Derivative Works, in at least one
+ of the following places: within a NOTICE text file distributed
+ as part of the Derivative Works; within the Source form or
+ documentation, if provided along with the Derivative Works; or,
+ within a display generated by the Derivative Works, if and
+ wherever such third-party notices normally appear. The contents
+ of the NOTICE file are for informational purposes only and
+ do not modify the License. You may add Your own attribution
+ notices within Derivative Works that You distribute, alongside
+ or as an addendum to the NOTICE text from the Work, provided
+ that such additional attribution notices cannot be construed
+ as modifying the License.
+
+ You may add Your own copyright statement to Your modifications and
+ may provide additional or different license terms and conditions
+ for use, reproduction, or distribution of Your modifications, or
+ for any such Derivative Works as a whole, provided Your use,
+ reproduction, and distribution of the Work otherwise complies with
+ the conditions stated in this License.
+
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
+ any Contribution intentionally submitted for inclusion in the Work
+ by You to the Licensor shall be under the terms and conditions of
+ this License, without any additional terms or conditions.
+ Notwithstanding the above, nothing herein shall supersede or modify
+ the terms of any separate license agreement you may have executed
+ with Licensor regarding such Contributions.
+
+ 6. Trademarks. This License does not grant permission to use the trade
+ names, trademarks, service marks, or product names of the Licensor,
+ except as required for reasonable and customary use in describing the
+ origin of the Work and reproducing the content of the NOTICE file.
+
+ 7. Disclaimer of Warranty. Unless required by applicable law or
+ agreed to in writing, Licensor provides the Work (and each
+ Contributor provides its Contributions) on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied, including, without limitation, any warranties or conditions
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+ PARTICULAR PURPOSE. You are solely responsible for determining the
+ appropriateness of using or redistributing the Work and assume any
+ risks associated with Your exercise of permissions under this License.
+
+ 8. Limitation of Liability. In no event and under no legal theory,
+ whether in tort (including negligence), contract, or otherwise,
+ unless required by applicable law (such as deliberate and grossly
+ negligent acts) or agreed to in writing, shall any Contributor be
+ liable to You for damages, including any direct, indirect, special,
+ incidental, or consequential damages of any character arising as a
+ result of this License or out of the use or inability to use the
+ Work (including but not limited to damages for loss of goodwill,
+ work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses), even if such Contributor
+ has been advised of the possibility of such damages.
+
+ 9. Accepting Warranty or Additional Liability. While redistributing
+ the Work or Derivative Works thereof, You may choose to offer,
+ and charge a fee for, acceptance of support, warranty, indemnity,
+ or other liability obligations and/or rights consistent with this
+ License. However, in accepting such obligations, You may act only
+ on Your own behalf and on Your sole responsibility, not on behalf
+ of any other Contributor, and only if You agree to indemnify,
+ defend, and hold each Contributor harmless for any liability
+ incurred by, or claims asserted against, such Contributor by reason
+ of your accepting any such warranty or additional liability.
+
+ END OF TERMS AND CONDITIONS
+
+ APPENDIX: How to apply the Apache License to your work.
+
+ To apply the Apache License to your work, attach the following
+ boilerplate notice, with the fields enclosed by brackets "{}"
+ replaced with your own identifying information. (Don't include
+ the brackets!) The text should be enclosed in the appropriate
+ comment syntax for the file format. We also recommend that a
+ file or class name and description of purpose be included on the
+ same "printed page" as the copyright notice for easier
+ identification within third-party archives.
+
+ Copyright {yyyy} {name of copyright owner}
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ https://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
\ No newline at end of file
diff --git a/server/legal/licenses/spring-boot-loader.NOTICE.txt
b/server/legal/licenses/spring-boot-loader.NOTICE.txt
new file mode 100644
index 000000000..ab69301ad
--- /dev/null
+++ b/server/legal/licenses/spring-boot-loader.NOTICE.txt
@@ -0,0 +1,6 @@
+Spring Boot 4.1.0
+Copyright (c) 2012-2026 VMware, Inc.
+
+This product is licensed to you under the Apache License, Version 2.0
+(the "License"). You may not use this product except in compliance with
+the License.
\ No newline at end of file
diff --git a/server/legal/licenses/webjars-locator-lite.txt
b/server/legal/licenses/webjars-locator-lite.txt
new file mode 100644
index 000000000..d83fc6f29
--- /dev/null
+++ b/server/legal/licenses/webjars-locator-lite.txt
@@ -0,0 +1,18 @@
+Copyright (c) 2013 James Ward
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/server/legal/licenses/zstd-jni.txt
b/server/legal/licenses/zstd-jni.txt
new file mode 100644
index 000000000..66abb8ae7
--- /dev/null
+++ b/server/legal/licenses/zstd-jni.txt
@@ -0,0 +1,26 @@
+Zstd-jni: JNI bindings to Zstd Library
+
+Copyright (c) 2015-present, Luben Karavelov/ All rights reserved.
+
+BSD License
+
+Redistribution and use in source and binary forms, with or without
modification,
+are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+ list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
this
+ list of conditions and the following disclaimer in the documentation and/or
+ other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/server/scripts/legal-determinations.json
b/server/scripts/legal-determinations.json
new file mode 100644
index 000000000..edb40e4c8
--- /dev/null
+++ b/server/scripts/legal-determinations.json
@@ -0,0 +1,521 @@
+{
+ "_readme": "打进 fat jar 但自身不带许可全文的依赖的许可认定表。绝大多数 Maven 制品的 jar 里根本没有 LICENSE
文件（实测 jtokkit / mcp / antlr4-runtime / protobuf-java / logback / dom4j 等法律文件数为
0），所以「jar 必须自带上游许可全文」这条口径不可满足。ASF 对二进制分发的要求是**条款随包**，由本表 +
server/legal/licenses/ 下的全文共同满足：Apache-2.0 由发行包自带的 LICENSE 覆盖（ASF 不要求按组件重复
Apache 全文，但依赖自带的 NOTICE 仍会并进我方 NOTICE），其余许可取仓库内收集的全文并嵌进 jar。**表里没有的依赖仍然报错** ——
新增依赖必须显式做一次许可认定。",
+ "apacheBasis": "POM（或其父 POM）的 <licenses> 声明 Apache License 2.0；ASF
不要求二进制发行包按组件重复 Apache-2.0 全文，发行包自带的 META-INF/LICENSE 就是该文本。依赖 jar 内若带 NOTICE，仍由
legal.py 并入我方 NOTICE。",
+ "apache": {
+ "HikariCP": {
+ "basis": "POM <licenses>（HikariCP-7.0.2.pom）"
+ },
+ "SparseBitSet": {
+ "basis": "POM <licenses>（SparseBitSet-1.2.pom）"
+ },
+ "alibabacloud-rocketmq20220801": {
+ "basis": "POM <licenses>（alibabacloud-rocketmq20220801-5.0.8.pom）"
+ },
+ "aliyun-gateway-pop": {
+ "basis": "许可在父 POM com.aliyun:core-service:0.3.5-beta（<licenses> 明写 The
Apache License, Version 2.0）"
+ },
+ "aliyun-http-apache": {
+ "basis": "同上，父 POM com.aliyun:core-service:0.3.5-beta"
+ },
+ "aliyun-java-auth": {
+ "basis": "同上，父 POM com.aliyun:core-service:0.3.5-beta"
+ },
+ "aliyun-java-core": {
+ "basis": "同上，父 POM com.aliyun:core-service:0.3.5-beta"
+ },
+ "annotations": {
+ "basis": "POM <licenses>（annotations-4.1.1.4.pom）"
+ },
+ "awaitility": {
+ "basis": "POM <licenses>（awaitility-4.3.0.pom）"
+ },
+ "cache-api": {
+ "basis": "POM <licenses>（cache-api-1.1.1.pom）"
+ },
+ "concurrentlinkedhashmap-lru": {
+ "basis": "POM <licenses>（concurrentlinkedhashmap-lru-1.4.2.pom）"
+ },
+ "darabonba-java-core": {
+ "basis": "同上，父 POM com.aliyun:core-service:0.3.5-beta"
+ },
+ "easyexcel": {
+ "basis": "POM <licenses>（easyexcel-3.3.4.pom）"
+ },
+ "easyexcel-core": {
+ "basis": "POM <licenses>（easyexcel-core-3.3.4.pom）"
+ },
+ "easyexcel-support": {
+ "basis": "POM <licenses>（easyexcel-support-3.3.4.pom）"
+ },
+ "ehcache": {
+ "basis": "POM <licenses>（ehcache-3.12.0.pom）"
+ },
+ "error_prone_annotations": {
+ "basis": "POM <licenses>（error_prone_annotations-2.49.0.pom）"
+ },
+ "failureaccess": {
+ "basis": "POM <licenses>（failureaccess-1.0.1.pom）"
+ },
+ "fastjson2": {
+ "basis": "POM <licenses>（fastjson2-2.0.59.pom）"
+ },
+ "grpc-api": {
+ "basis": "POM <licenses>（grpc-api-1.80.0.pom）"
+ },
+ "grpc-context": {
+ "basis": "POM <licenses>（grpc-context-1.80.0.pom）"
+ },
+ "grpc-core": {
+ "basis": "POM <licenses>（grpc-core-1.80.0.pom）"
+ },
+ "grpc-stub": {
+ "basis": "POM <licenses>（grpc-stub-1.80.0.pom）"
+ },
+ "grpc-util": {
+ "basis": "POM <licenses>（grpc-util-1.80.0.pom）"
+ },
+ "gson": {
+ "basis": "POM <licenses>（gson-2.13.2.pom）"
+ },
+ "itu": {
+ "basis": "POM <licenses>（itu-1.14.0.pom）"
+ },
+ "j2objc-annotations": {
+ "basis": "POM <licenses>（j2objc-annotations-2.8.pom）"
+ },
+ "jakarta.validation-api": {
+ "basis": "POM <licenses>（jakarta.validation-api-3.1.1.pom）"
+ },
+ "javassist": {
+ "basis": "POM 三许可 MPL-1.1 / LGPL-2.1 / Apache-2.0，选 Apache-2.0"
+ },
+ "jboss-logging": {
+ "basis": "POM <licenses>（jboss-logging-3.6.3.Final.pom）"
+ },
+ "jctools-core": {
+ "basis": "POM <licenses>（jctools-core-4.0.6.pom）"
+ },
+ "json-schema-validator": {
+ "basis": "POM <licenses>（json-schema-validator-3.0.0.pom）"
+ },
+ "jsonschema-generator": {
+ "basis": "POM <licenses>（jsonschema-generator-5.0.0.pom）"
+ },
+ "jsonschema-module-jackson": {
+ "basis": "POM <licenses>（jsonschema-module-jackson-5.0.0.pom）"
+ },
+ "jsonschema-module-swagger": {
+ "basis": "POM <licenses>（jsonschema-module-swagger-2-5.0.0.pom）"
+ },
+ "jspecify": {
+ "basis": "POM <licenses>（jspecify-1.0.0.pom）"
+ },
+ "jsqlparser": {
+ "basis": "POM <licenses>（jsqlparser-5.2.pom（双许可，选 Apache））"
+ },
+ "jsr305": {
+ "basis": "POM <licenses>（jsr305-3.0.2.pom）"
+ },
+ "kotlin-stdlib": {
+ "basis": "POM <licenses>（kotlin-stdlib-1.9.25.pom）"
+ },
+ "listenablefuture": {
+ "basis": "空占位 jar（0 个 class），随 com.google.guava:guava 的 Apache-2.0"
+ },
+ "logging-interceptor": {
+ "basis": "POM <licenses>（logging-interceptor-3.12.13.pom）"
+ },
+ "lz4-java": {
+ "basis": "POM <licenses>（lz4-java-1.10.3.pom）"
+ },
+ "mcp-spring-webmvc": {
+ "basis": "POM <licenses>（mcp-spring-webmvc-2.0.0.pom）"
+ },
+ "mybatis-plus": {
+ "basis": "POM <licenses>（mybatis-plus-3.5.17.pom）"
+ },
+ "mybatis-plus-annotation": {
+ "basis": "POM <licenses>（mybatis-plus-annotation-3.5.17.pom）"
+ },
+ "mybatis-plus-core": {
+ "basis": "POM <licenses>（mybatis-plus-core-3.5.17.pom）"
+ },
+ "mybatis-plus-extension": {
+ "basis": "POM <licenses>（mybatis-plus-extension-3.5.17.pom）"
+ },
+ "mybatis-plus-jsqlparser": {
+ "basis": "POM <licenses>（mybatis-plus-jsqlparser-3.5.17.pom）"
+ },
+ "mybatis-plus-jsqlparser-common": {
+ "basis": "POM <licenses>（mybatis-plus-jsqlparser-common-3.5.17.pom）"
+ },
+ "mybatis-plus-spring": {
+ "basis": "POM <licenses>（mybatis-plus-spring-3.5.17.pom）"
+ },
+ "mybatis-plus-spring-boot-autoconfigure": {
+ "basis": "POM <licenses>（mybatis-plus-spring-boot-autoconfigure-3.5.17.pom）"
+ },
+ "mybatis-plus-spring-boot-native-image": {
+ "basis": "POM <licenses>（mybatis-plus-spring-boot-native-image-3.5.17.pom）"
+ },
+ "mybatis-plus-spring-boot4-starter": {
+ "basis": "POM <licenses>（mybatis-plus-spring-boot4-starter-3.5.17.pom）"
+ },
+ "netty-all": {
+ "basis": "POM <licenses>（netty-all-4.2.15.Final.pom）"
+ },
+ "netty-buffer": {
+ "basis": "POM <licenses>（netty-buffer-4.2.15.Final.pom）"
+ },
+ "netty-codec": {
+ "basis": "POM <licenses>（netty-codec-4.2.15.Final.pom）"
+ },
+ "netty-codec-base": {
+ "basis": "POM <licenses>（netty-codec-base-4.2.15.Final.pom）"
+ },
+ "netty-codec-classes-quic": {
+ "basis": "POM <licenses>（netty-codec-classes-quic-4.2.15.Final.pom）"
+ },
+ "netty-codec-compression": {
+ "basis": "POM <licenses>（netty-codec-compression-4.2.15.Final.pom）"
+ },
+ "netty-codec-dns": {
+ "basis": "POM <licenses>（netty-codec-dns-4.2.15.Final.pom）"
+ },
+ "netty-codec-haproxy": {
+ "basis": "POM <licenses>（netty-codec-haproxy-4.2.15.Final.pom）"
+ },
+ "netty-codec-http": {
+ "basis": "POM <licenses>（netty-codec-http-4.2.15.Final.pom）"
+ },
+ "netty-codec-http2": {
+ "basis": "POM <licenses>（netty-codec-http2-4.2.15.Final.pom）"
+ },
+ "netty-codec-http3": {
+ "basis": "POM <licenses>（netty-codec-http3-4.2.15.Final.pom）"
+ },
+ "netty-codec-marshalling": {
+ "basis": "POM <licenses>（netty-codec-marshalling-4.2.15.Final.pom）"
+ },
+ "netty-codec-memcache": {
+ "basis": "POM <licenses>（netty-codec-memcache-4.2.15.Final.pom）"
+ },
+ "netty-codec-mqtt": {
+ "basis": "POM <licenses>（netty-codec-mqtt-4.2.15.Final.pom）"
+ },
+ "netty-codec-protobuf": {
+ "basis": "POM <licenses>（netty-codec-protobuf-4.2.15.Final.pom）"
+ },
+ "netty-codec-redis": {
+ "basis": "POM <licenses>（netty-codec-redis-4.2.15.Final.pom）"
+ },
+ "netty-codec-smtp": {
+ "basis": "POM <licenses>（netty-codec-smtp-4.2.15.Final.pom）"
+ },
+ "netty-codec-socks": {
+ "basis": "POM <licenses>（netty-codec-socks-4.2.15.Final.pom）"
+ },
+ "netty-codec-stomp": {
+ "basis": "POM <licenses>（netty-codec-stomp-4.2.15.Final.pom）"
+ },
+ "netty-codec-xml": {
+ "basis": "POM <licenses>（netty-codec-xml-4.2.15.Final.pom）"
+ },
+ "netty-common": {
+ "basis": "POM <licenses>（netty-common-4.2.15.Final.pom）"
+ },
+ "netty-handler": {
+ "basis": "POM <licenses>（netty-handler-4.2.15.Final.pom）"
+ },
+ "netty-handler-proxy": {
+ "basis": "POM <licenses>（netty-handler-proxy-4.2.15.Final.pom）"
+ },
+ "netty-handler-ssl-ocsp": {
+ "basis": "POM <licenses>（netty-handler-ssl-ocsp-4.2.15.Final.pom）"
+ },
+ "netty-resolver": {
+ "basis": "POM <licenses>（netty-resolver-4.2.15.Final.pom）"
+ },
+ "netty-resolver-dns": {
+ "basis": "POM <licenses>（netty-resolver-dns-4.2.15.Final.pom）"
+ },
+ "netty-resolver-dns-classes-macos": {
+ "basis": "POM <licenses>（netty-resolver-dns-classes-macos-4.2.15.Final.pom）"
+ },
+ "netty-resolver-dns-native-macos": {
+ "basis": "POM <licenses>（netty-resolver-dns-native-macos-4.2.15.Final.pom（剥
classifier））"
+ },
+ "netty-transport": {
+ "basis": "POM <licenses>（netty-transport-4.2.15.Final.pom）"
+ },
+ "netty-transport-classes-epoll": {
+ "basis": "POM <licenses>（netty-transport-classes-epoll-4.2.15.Final.pom）"
+ },
+ "netty-transport-classes-io_uring": {
+ "basis": "POM <licenses>（netty-transport-classes-io_uring-4.2.15.Final.pom）"
+ },
+ "netty-transport-classes-kqueue": {
+ "basis": "POM <licenses>（netty-transport-classes-kqueue-4.2.15.Final.pom）"
+ },
+ "netty-transport-native-epoll": {
+ "basis": "POM <licenses>（netty-transport-native-epoll-4.2.15.Final.pom（剥
classifier））"
+ },
+ "netty-transport-native-io_uring": {
+ "basis": "POM <licenses>（netty-transport-native-io_uring-4.2.15.Final.pom（剥
classifier））"
+ },
+ "netty-transport-native-kqueue": {
+ "basis": "POM <licenses>（netty-transport-native-kqueue-4.2.15.Final.pom（剥
classifier））"
+ },
+ "netty-transport-native-unix-common": {
+ "basis": "POM
<licenses>（netty-transport-native-unix-common-4.2.15.Final.pom）"
+ },
+ "netty-transport-rxtx": {
+ "basis": "POM <licenses>（netty-transport-rxtx-4.2.15.Final.pom）"
+ },
+ "netty-transport-sctp": {
+ "basis": "POM <licenses>（netty-transport-sctp-4.2.15.Final.pom）"
+ },
+ "netty-transport-udt": {
+ "basis": "POM <licenses>（netty-transport-udt-4.2.15.Final.pom）"
+ },
+ "okhttp": {
+ "basis": "POM <licenses>（okhttp-3.12.13.pom）"
+ },
+ "okhttp-jvm": {
+ "basis": "POM <licenses>（okhttp-jvm-5.3.2.pom）"
+ },
+ "okio": {
+ "basis": "POM <licenses>（okio-1.15.0.pom）"
+ },
+ "okio-jvm": {
+ "basis": "POM <licenses>（okio-jvm-3.4.0.pom）"
+ },
+ "opentelemetry-api": {
+ "basis": "POM <licenses>（opentelemetry-api-1.62.0.pom）"
+ },
+ "opentelemetry-common": {
+ "basis": "POM <licenses>（opentelemetry-common-1.62.0.pom）"
+ },
+ "opentelemetry-context": {
+ "basis": "POM <licenses>（opentelemetry-context-1.62.0.pom）"
+ },
+ "opentelemetry-exporter-common": {
+ "basis": "POM <licenses>（opentelemetry-exporter-common-1.62.0.pom）"
+ },
+ "opentelemetry-exporter-logging": {
+ "basis": "POM <licenses>（opentelemetry-exporter-logging-1.62.0.pom）"
+ },
+ "opentelemetry-exporter-logging-otlp": {
+ "basis": "POM <licenses>（opentelemetry-exporter-logging-otlp-1.62.0.pom）"
+ },
+ "opentelemetry-exporter-otlp": {
+ "basis": "POM <licenses>（opentelemetry-exporter-otlp-1.62.0.pom）"
+ },
+ "opentelemetry-exporter-otlp-common": {
+ "basis": "POM <licenses>（opentelemetry-exporter-otlp-common-1.62.0.pom）"
+ },
+ "opentelemetry-exporter-prometheus": {
+ "basis": "POM <licenses> 明写 The Apache License, Version 2.0"
+ },
+ "opentelemetry-exporter-sender-okhttp": {
+ "basis": "POM <licenses>（opentelemetry-exporter-sender-okhttp-1.62.0.pom）"
+ },
+ "opentelemetry-sdk": {
+ "basis": "POM <licenses>（opentelemetry-sdk-1.62.0.pom）"
+ },
+ "opentelemetry-sdk-common": {
+ "basis": "POM <licenses>（opentelemetry-sdk-common-1.62.0.pom）"
+ },
+ "opentelemetry-sdk-extension-autoconfigure-spi": {
+ "basis": "POM
<licenses>（opentelemetry-sdk-extension-autoconfigure-spi-1.62.0.pom）"
+ },
+ "opentelemetry-sdk-logs": {
+ "basis": "POM <licenses>（opentelemetry-sdk-logs-1.62.0.pom）"
+ },
+ "opentelemetry-sdk-metrics": {
+ "basis": "POM <licenses>（opentelemetry-sdk-metrics-1.62.0.pom）"
+ },
+ "opentelemetry-sdk-trace": {
+ "basis": "POM <licenses>（opentelemetry-sdk-trace-1.62.0.pom）"
+ },
+ "perfmark-api": {
+ "basis": "POM <licenses>（perfmark-api-0.27.0.pom）"
+ },
+ "prometheus-metrics-config": {
+ "basis": "POM <licenses>（prometheus-metrics-config-1.5.1.pom）"
+ },
+ "prometheus-metrics-exporter-common": {
+ "basis": "POM <licenses>（prometheus-metrics-exporter-common-1.5.1.pom）"
+ },
+ "prometheus-metrics-exporter-httpserver": {
+ "basis": "POM <licenses>（prometheus-metrics-exporter-httpserver-1.5.1.pom）"
+ },
+ "prometheus-metrics-exposition-formats": {
+ "basis": "POM <licenses>（prometheus-metrics-exposition-formats-1.5.1.pom）"
+ },
+ "prometheus-metrics-exposition-textformats": {
+ "basis": "POM
<licenses>（prometheus-metrics-exposition-textformats-1.5.1.pom）"
+ },
+ "prometheus-metrics-model": {
+ "basis": "POM <licenses>（prometheus-metrics-model-1.5.1.pom）"
+ },
+ "rocketmq-logback-classic": {
+ "basis": "POM <licenses>（rocketmq-logback-classic-1.0.1.pom）"
+ },
+ "rocketmq-proto": {
+ "basis": "POM <licenses>（rocketmq-proto-2.1.2.pom）"
+ },
+ "rocketmq-rocksdb": {
+ "basis": "POM <licenses>（rocketmq-rocksdb-1.0.6.pom（双许可，选 Apache））"
+ },
+ "rocketmq-slf4j-api": {
+ "basis": "POM <licenses>（rocketmq-slf4j-api-1.0.1.pom）"
+ },
+ "snakeyaml": {
+ "basis": "POM <licenses>（snakeyaml-2.6.pom）"
+ },
+ "snakeyaml-engine": {
+ "basis": "POM <licenses>（snakeyaml-engine-3.0.1.pom）"
+ },
+ "spring-ai-autoconfigure-mcp-server-common": {
+ "basis": "POM
<licenses>（spring-ai-autoconfigure-mcp-server-common-2.0.0.pom）"
+ },
+ "spring-ai-autoconfigure-mcp-server-webmvc": {
+ "basis": "POM
<licenses>（spring-ai-autoconfigure-mcp-server-webmvc-2.0.0.pom）"
+ },
+ "spring-ai-commons": {
+ "basis": "POM <licenses>（spring-ai-commons-2.0.0.pom）"
+ },
+ "spring-ai-mcp": {
+ "basis": "POM <licenses>（spring-ai-mcp-2.0.0.pom）"
+ },
+ "spring-ai-mcp-annotations": {
+ "basis": "POM <licenses>（spring-ai-mcp-annotations-2.0.0.pom）"
+ },
+ "spring-ai-model": {
+ "basis": "POM <licenses>（spring-ai-model-2.0.0.pom）"
+ },
+ "spring-ai-starter-mcp-server-webmvc": {
+ "basis": "POM <licenses>（spring-ai-starter-mcp-server-webmvc-2.0.0.pom）"
+ },
+ "spring-ai-template-st": {
+ "basis": "POM <licenses>（spring-ai-template-st-2.0.0.pom）"
+ },
+ "swagger-ui": {
+ "basis": "POM <licenses>（swagger-ui-5.32.2.pom）"
+ },
+ "tencentcloud-sdk-java-common": {
+ "basis": "POM <licenses>（tencentcloud-sdk-java-common-3.1.1498.pom）"
+ },
+ "tencentcloud-sdk-java-trocket": {
+ "basis": "POM <licenses>（tencentcloud-sdk-java-trocket-3.1.1498.pom）"
+ }
+ },
+ "collected": {
+ "ST4": {
+ "license": "The BSD License",
+ "text": "ST4.txt",
+ "basis": "POM <licenses>（ST4-4.3.4.pom）"
+ },
+ "animal-sniffer-annotations": {
+ "license": "MIT License",
+ "text": "animal-sniffer-annotations.txt",
+ "basis": "POM <licenses>（animal-sniffer-annotations-1.26.pom）"
+ },
+ "antlr-runtime": {
+ "license": "BSD licence",
+ "text": "antlr-runtime.txt",
+ "basis": "POM <licenses>（antlr-runtime-3.5.3.pom）"
+ },
+ "antlr4-runtime": {
+ "license": "BSD-3-Clause",
+ "text": "antlr4-runtime.txt",
+ "basis": "POM <licenses>（antlr4-runtime-4.13.1.pom）"
+ },
+ "bcprov-jdk18on": {
+ "license": "Bouncy Castle Licence",
+ "text": "bcprov-jdk18on.txt",
+ "basis": "POM <licenses>（bcprov-jdk18on-1.78.1.pom）"
+ },
+ "curvesapi": {
+ "license": "BSD License",
+ "text": "curvesapi.txt",
+ "basis": "POM <licenses>（curvesapi-1.06.pom）"
+ },
+ "dom4j": {
+ "license": "Plexus",
+ "text": "dom4j.txt",
+ "basis": "POM <licenses>（dom4j-2.1.4.pom）"
+ },
+ "istack-commons-runtime": {
+ "license": "Eclipse Distribution License - v 1.0",
+ "text": "istack-commons-runtime.txt",
+ "basis": "POM <licenses>（istack-commons-runtime-4.1.2.pom）"
+ },
+ "jtokkit": {
+ "license": "MIT License",
+ "text": "jtokkit.txt",
+ "basis": "POM <licenses>（jtokkit-1.1.0.pom）"
+ },
+ "mcp": {
+ "license": "MIT License",
+ "text": "mcp.txt",
+ "basis": "POM <licenses>（mcp-2.0.0.pom）"
+ },
+ "mcp-core": {
+ "license": "MIT License",
+ "text": "mcp.txt",
+ "basis": "POM <licenses>（mcp-core-2.0.0.pom）"
+ },
+ "mcp-json-jackson3": {
+ "license": "MIT License",
+ "text": "mcp.txt",
+ "basis": "POM <licenses>（mcp-json-jackson3-2.0.0.pom）"
+ },
+ "protobuf-java": {
+ "license": "BSD-3-Clause",
+ "text": "protobuf-java.txt",
+ "basis": "POM <licenses>（protobuf-java-4.34.2.pom）"
+ },
+ "protobuf-java-util": {
+ "license": "BSD-3-Clause",
+ "text": "protobuf-java.txt",
+ "basis": "POM <licenses>（protobuf-java-util-4.34.2.pom）"
+ },
+ "reactive-streams": {
+ "license": "MIT-0",
+ "text": "reactive-streams.txt",
+ "basis": "POM <licenses>（reactive-streams-1.0.4.pom）"
+ },
+ "reflections": {
+ "license": "WTFPL（上游另有 New BSD 可选）",
+ "text": "reflections.txt",
+ "basis": "POM <licenses> 双许可 WTFPL / The New BSD License；tag 0.9.11 只发布了
WTFPL 全文，故收录它",
+ "review": "本件由 org.apache.rocketmq:rocketmq-tools:5.5.0 传递引入，我方代码不直接调用。双许可里
New BSD 的全文在 0.9.11 tag 上并不存在（0.10 起改发 Apache-2.0），只有 WTFPL 是上游逐字发布过的，因此收录
WTFPL；WTFPL 未在 ASF 的许可分类表里点名，3.0.0 GA 前请 PMC/法务确认，或改为排除该传递依赖。"
+ },
+ "webjars-locator-lite": {
+ "license": "MIT",
+ "text": "webjars-locator-lite.txt",
+ "basis": "POM <licenses>（webjars-locator-lite-1.1.3.pom）"
+ },
+ "zstd-jni": {
+ "license": "BSD-2-Clause",
+ "text": "zstd-jni.txt",
+ "basis": "POM <licenses> 明写 BSD 2-Clause License"
+ }
+ },
+ "categoryB": {
+ "logback-classic": {
+ "license": "EPL-2.0",
+ "text": "logback.txt",
+ "review": "EPL-2.0（另有 LGPL-2.1 可选，选 EPL-2.0）。ASF Category
B：文件级弱著佐权，对我方代码无链接传染，二进制分发在 ASF 第三方许可政策下可接受；因是 Spring Boot 默认日志实现而随包分发。3.0.0 GA
前需 PMC/法务确认这条记录。",
+ "basis": "POM <licenses>（logback-classic-1.5.34.pom）"
+ },
+ "logback-core": {
+ "license": "EPL-2.0",
+ "text": "logback.txt",
+ "review": "EPL-2.0（另有 LGPL-2.1 可选，选 EPL-2.0）。ASF Category
B：文件级弱著佐权，对我方代码无链接传染，二进制分发在 ASF 第三方许可政策下可接受；因是 Spring Boot 默认日志实现而随包分发。3.0.0 GA
前需 PMC/法务确认这条记录。",
+ "basis": "POM <licenses>（logback-core-1.5.34.pom）"
+ }
+ }
+}
\ No newline at end of file
diff --git a/server/scripts/legal.py b/server/scripts/legal.py
index 76a343e3a..93acc7bd3 100644
--- a/server/scripts/legal.py
+++ b/server/scripts/legal.py
@@ -32,6 +32,58 @@ LEGAL_NAME =
re.compile(r"^(licen[sc]e|notice|copying|copyright|patents|authors|
LICENSE_NAME = re.compile(r"^(licen[sc]e|copying)([._-].*)?$", re.I)
NOTICE_NAME = re.compile(r"^notice([._-].*)?$", re.I)
PERMISSIVE = {"MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC",
"0BSD"}
+DETERMINATIONS = "scripts/legal-determinations.json"
+COLLECTED = "legal/licenses"
+# ASF Category B: weak copyleft. Allowed in a binary distribution only with a
recorded decision,
+# never silently — so an entry has to carry `review` or the gate stays red.
+CATEGORY_B = {"EPL-1.0", "EPL-2.0", "MPL-1.1", "MPL-2.0", "CDDL-1.0",
"CDDL-1.1", "LGPL-2.1", "LGPL-3.0"}
+
+
+def artifact_id(jar_name):
+ """`netty-transport-native-epoll-4.2.15.Final-linux-x86_64.jar` ->
`netty-transport-native-epoll`.
+
+ Determinations are recorded per artifact, not per build: the leftmost
dash-separated part that
+ starts with a digit begins the version, and anything after it is a version
suffix or classifier.
+ """
+ base = jar_name[:-4] if jar_name.endswith(".jar") else jar_name
+ parts = base.split("-")
+ for index in range(1, len(parts)):
+ if parts[index][:1].isdigit():
+ return "-".join(parts[:index])
+ return base
+
+
+def load_determinations(base):
+ """The checked-in license determination for artifacts whose JAR carries no
license text.
+
+ Most Maven artifacts ship no LICENSE inside the JAR at all, so "the JAR
must contain its own
+ upstream license" is not satisfiable in principle. What ASF actually
requires of a binary
+ distribution is that the terms travel with it, which this file plus
`legal/licenses/` provides:
+ an explicit, reviewable determination per artifact instead of an
impossible self-contained one.
+ """
+ path = Path(base) / DETERMINATIONS
+ if not path.exists():
+ return {}
+ return json.loads(path.read_text(encoding="utf-8"))
+
+
+def determination_for(name, determinations):
+ """-> {"kind": "apache"|"collected"|"categoryB", ...} or None when nothing
is recorded."""
+ if not determinations:
+ return None
+ key = artifact_id(name)
+ if key in determinations.get("apache", {}):
+ entry = determinations["apache"][key] or {}
+ return {"kind": "apache", "license": "Apache-2.0",
+ "basis": entry.get("basis") or
determinations.get("apacheBasis", "")}
+ for kind in ("collected", "categoryB"):
+ if key in determinations.get(kind, {}):
+ entry = dict(determinations[kind][key])
+ entry["kind"] = "categoryB" if kind == "categoryB" else "collected"
+ if entry.get("license") in CATEGORY_B:
+ entry["kind"] = "categoryB"
+ return entry
+ return None
def sha(data):
@@ -68,7 +120,8 @@ def texts_from_zip(data):
if not name.endswith("/") and is_legal(name)}
-def add_component(files, components, errors, name, payload, texts, notice,
source):
+def add_component(files, components, errors, name, payload, texts, notice,
source,
+ determinations=None, warnings=None, base=SERVER):
prefix = f"licenses/{safe(name)}/"
component = {"name": name, "sha256": sha(payload), "source": source,
"files": []}
license_texts = [data for filename, data in texts.items() if
LICENSE_NAME.match(PurePosixPath(filename).name)]
@@ -76,7 +129,43 @@ def add_component(files, components, errors, name, payload,
texts, notice, sourc
or b"GNU AFFERO GENERAL PUBLIC LICENSE" in data for data in
license_texts):
errors.append(f"{name}: contains GPL-family terms; dual-license
choice/exception and redistribution obligations require manual review")
if not license_texts or not any(len(data.strip()) >= 300 for data in
license_texts):
- errors.append(f"{name}: missing complete upstream LICENSE/COPYING; a
POM name or link is not a substitute")
+ determination = determination_for(name, determinations)
+ if determination is None:
+ errors.append(f"{name}: missing complete upstream LICENSE/COPYING
and no determination in "
+ f"{DETERMINATIONS}; a POM name or link is not a
substitute")
+ elif determination["kind"] == "apache":
+ # ASF does not ask a binary distribution to repeat the Apache-2.0
text once per component:
+ # the distribution's own LICENSE already is that text. Their
NOTICE, if the JAR carries
+ # one, is still merged into ours by the loop below.
+ component["license"] = "Apache-2.0"
+ component["coveredBy"] = "distribution LICENSE (Apache-2.0)"
+ component["basis"] = determination["basis"]
+ else:
+ source_path = Path(base) / COLLECTED / safe(determination["text"])
+ try:
+ collected = read(source_path)
+ except (OSError, ValueError) as failure:
+ errors.append(f"{name}: collected license text is unusable
({source_path}): {failure}")
+ else:
+ texts = dict(texts)
+ texts["LICENSE"] = collected
+ component["license"] = determination["license"]
+ component["basis"] = determination.get("basis", "")
+ component["textSource"] =
f"server/{COLLECTED}/{determination['text']}"
+ # Any determination may carry an open question. Surfacing it
on every build beats
+ # burying it in a JSON file nobody re-reads.
+ if determination.get("review") and determination["kind"] !=
"categoryB" and warnings is not None:
+ warnings.append(f"{name}: {determination['license']} —
{determination['review']}")
+ component["review"] = determination["review"]
+ if determination["kind"] == "categoryB":
+ review = determination.get("review")
+ if not review:
+ errors.append(f"{name}: ASF Category B
({determination['license']}) is bundled "
+ f"without a recorded review decision")
+ else:
+ component["categoryBReview"] = review
+ if warnings is not None:
+ warnings.append(f"{name}: ASF Category B
({determination['license']}) bundled — {review}")
for filename, data in sorted(texts.items()):
if not data.strip():
errors.append(f"{name}: empty license file {filename}")
@@ -90,12 +179,18 @@ def add_component(files, components, errors, name,
payload, texts, notice, sourc
return notice
-def finish(files, components, errors, license_text, notice, payload):
+def finish(files, components, errors, license_text, notice, payload,
warnings=None):
for component in components:
- license_text += f"\n{component['name']}: complete upstream license,
copyright and additional terms under
META-INF/legal/licenses/{component['name']}/\n".encode()
+ if component.get("coveredBy"):
+ license_text += (f"\n{component['name']}: {component['license']},
covered by the "
+ f"META-INF/LICENSE text of this
distribution\n").encode()
+ else:
+ license_text += f"\n{component['name']}: complete upstream
license, copyright and additional terms under
META-INF/legal/licenses/{component['name']}/\n".encode()
files["LICENSE"] = license_text
files["NOTICE"] = notice
manifest = {"components": components, "payload": payload, "manualReview":
sorted(set(errors)),
+ "warnings": sorted(set(warnings or [])),
+ "categoryB": sorted(c["name"] for c in components if
c.get("categoryBReview")),
"files": {name: sha(data) for name, data in
sorted(files.items())}}
files["manifest.json"] = (json.dumps(manifest, ensure_ascii=False,
indent=2) + "\n").encode()
return files, manifest
@@ -107,6 +202,7 @@ def generated_entry(name):
def collect_jar(jar, base=SERVER):
files, components, errors, payload = {}, [], [], {}
+ warnings, determinations = [], load_determinations(base)
license_text, notice = read(base / "LICENSE"), read(base / "NOTICE")
with zipfile.ZipFile(jar) as archive:
if len(archive.namelist()) != len(set(archive.namelist())):
@@ -121,23 +217,44 @@ def collect_jar(jar, base=SERVER):
data = archive.read(name)
filename = PurePosixPath(name).name
texts = texts_from_zip(data)
- notice = add_component(files, components, errors, filename, data,
texts, notice, name)
+ notice = add_component(files, components, errors, filename, data,
texts, notice, name,
+ determinations, warnings, base)
if filename.startswith("mysql-connector-j-"):
errors.append(f"{filename}: applicability of GPLv2 + Universal
FOSS Exception and ASF redistribution licensing pending PMC/legal review; this
is not the Classpath Exception")
- # The Spring Boot loader itself is also copied into the JAR, not only
the dependencies under BOOT-INF/lib.
+ # The Spring Boot loader itself is also copied into the JAR, not only
the dependencies under
+ # BOOT-INF/lib, so its own license and NOTICE have to travel with the
distribution too.
if any(name.startswith("org/springframework/boot/loader/") and
name.endswith(".class") for name in archive.namelist()):
- spring_license = "META-INF/LICENSE.txt"
- spring_notice = "META-INF/NOTICE.txt"
- if spring_license not in archive.namelist() or spring_notice not
in archive.namelist():
- errors.append("Spring Boot loader: missing the original
META-INF/LICENSE.txt or NOTICE.txt")
+ spring_license, spring_notice = "META-INF/LICENSE.txt",
"META-INF/NOTICE.txt"
+ version = re.search(rb"(?m)^Spring-Boot-Version: ([^\r\n]+)",
archive.read("META-INF/MANIFEST.MF"))
+ if not version:
+ errors.append("Spring Boot loader: missing version source")
+ loader_version = version.group(1).decode() if version else
"unknown"
+ if spring_license in archive.namelist() and spring_notice in
archive.namelist():
+ # Up to Boot 3.x the repackage goal copied the loader
artifact's own materials here.
+ texts = {name: archive.read(name) for name in (spring_license,
spring_notice)}
+ source = "JAR root META-INF"
else:
- texts = {name: archive.read(name) for name in [spring_license,
spring_notice]}
- version = re.search(rb"(?m)^Spring-Boot-Version: ([^\r\n]+)",
archive.read("META-INF/MANIFEST.MF"))
- if not version:
- errors.append("Spring Boot loader: missing version source")
- loader = "spring-boot-loader@" + (version.group(1).decode() if
version else "unknown")
- notice = add_component(files, components, errors, loader,
b"".join(texts.values()), texts, notice, "JAR root META-INF")
- return finish(files, components, errors, license_text, notice, payload)
+ # Boot 4.x stopped copying them, and the loader classes arrive
embedded in
+ # spring-boot-loader-tools rather than as a dependency JAR, so
there is nothing left
+ # in the archive to read. Take the checked-in copies of that
artifact's own
+ # META-INF/LICENSE.txt and META-INF/NOTICE.txt instead — and
refuse them if they were
+ # collected for a different Boot version, which is how a stale
NOTICE would sneak in.
+ texts, source = {}, f"server/{COLLECTED}
(spring-boot-loader-tools {loader_version})"
+ for collected_name, embedded_name in
(("spring-boot-loader.LICENSE.txt", spring_license),
+
("spring-boot-loader.NOTICE.txt", spring_notice)):
+ path = Path(base) / COLLECTED / collected_name
+ if not path.exists():
+ errors.append(f"Spring Boot loader: collected
{collected_name} is missing ({path})")
+ continue
+ texts[embedded_name] = read(path)
+ if loader_version != "unknown" and loader_version.encode() not
in texts.get(spring_notice, b""):
+ errors.append(f"Spring Boot loader: the collected NOTICE
is not for {loader_version}; "
+ f"re-collect it from
spring-boot-loader-tools {loader_version}")
+ if texts:
+ loader = "spring-boot-loader@" + loader_version
+ notice = add_component(files, components, errors, loader,
b"".join(texts.values()), texts,
+ notice, source, determinations,
warnings, base)
+ return finish(files, components, errors, license_text, notice, payload,
warnings)
def write_bundle(directory, files):
@@ -167,14 +284,22 @@ def check_jar(jar, base=SERVER):
actual = {name for name in archive.namelist() if generated_entry(name)
and not name.endswith("/")}
if actual != {embedded_path(name) for name in files}:
raise ValueError("JAR has stale or unregistered legal materials")
+ for warning in manifest["warnings"]:
+ print(f"WARNING {warning}")
require_complete(manifest)
- print(f"JAR license check passed: {len(manifest['components'])} actual
components")
+ covered = sum(1 for c in manifest["components"] if c.get("coveredBy"))
+ collected = sum(1 for c in manifest["components"] if c.get("textSource"))
+ print(f"JAR license check passed: {len(manifest['components'])} actual
components "
+ f"({covered} Apache-2.0 covered by the distribution LICENSE,
{collected} from collected text, "
+ f"{len(manifest['categoryB'])} Category B)")
def package_jar(jar, output, base=SERVER):
jar = Path(jar)
files, manifest = collect_jar(jar, base)
write_bundle(output, files)
+ # Warnings are printed by the check_jar pass at the end of this function;
printing them here too
+ # would double every line.
# Emit the review materials first for inspection, but do not produce a
seemingly compliant distribution package when materials are missing or
licensing is unresolved.
require_complete(manifest)
with tempfile.NamedTemporaryFile(dir=jar.parent, suffix=".legal.jar",
delete=False) as temporary:
