[ISSUE #4830] Generate LICENSE and NOTICE with Gradle tasks

[Pil0tXia]

Fixes #4830

Motivation

As is discussed in #4720, the LICENSE and NOTICE files of the EventMesh binary distribution release need to be maintained manually, and for a long time the contents of the files were incomplete and not updated in time when artifacts were introduced or updated.

Following the suggestion in #4720 (comment), I implemented generateDistLicense task that automatically generates the LICENSE file and licenses/ directory, and generateDistNotice task that automatically generates the NOTICE file.

They can be run manually, or automatically when the dist task is executed. After #4719 is merged, I'll specify the generateDistLicense task and the generateDistNotice task as dependencies of the dist task.

The licenses generated by the generateDistLicense task are named after the license name, e.g. Apache-2.0.txt, which conforms to ASF regulations. I can also modify it to be named after an artifact, e.g. log4j-core 2.22.1 Apache-2.0.txt. Please let me know if you want to do like that.

Modifications

• Add the generateDistLicense task and the generateDistNotice task.
• Excessive mavenLocal() was removed according to https://docs.gradle.org/current/userguide/declaring_repositories.html#sub:maven_local

Update:

Now executing the dist task automatically generates the LICENSE and NOTICE files and automatically packages them.

Incompatible artifacts will be printed on screen. Release Manager must remove these artifacts from classpath, remove their license files from licenses dir, and tell users to manually download them.

Documentation

• Does this pull request introduce a new feature? (yes)
• If yes, how is the feature documented? (JavaDocs)

[ppkarwasz]

Great job!

I think other Apache projects might profit from it, if you transform it into a Gradle plugin.

[Pil0tXia]

@xwm1992

This PR has completed the #4719 (comment) follow-up and is ready to be merged.

Now executing the dist task automatically generates the LICENSE and NOTICE files and automatically packages them.

Incompatible artifacts will be printed on screen. Release Manager must remove these artifacts from classpath, remove their license files from licenses dir, and tell users to manually download them.

[ppkarwasz]

I think it would be best to have more control on the licenses that are included in the distribution.

There is also the problem of software available under multiple licenses: e.g. Logback is available under EPL 1.0 and LGPL 2.1. The first one is a category B license and Apache projects can include it in binary form. The second one is a category X license and can not be included in Apache distributions.

Does it mean we shouldn't even mention that Logback is available under LGPL 2.1? I have no idea, better ask LEGAL about that. You probably could generate a snapshot of your distribution and ask them to look at the LICENSE part.

[Pil0tXia]

checkDeniedLicense task done (c.f. #4827 (comment)).

@xwm1992 checkDeniedLicense task depends on generateDistLicense task of this PR. To enable it, please merge this PR first, then I will add it into CI in #4827.

[xwm1992]

LGTM