From 183c18be555569e6dfcbfd548e3d4e6b31e93ff8 Mon Sep 17 00:00:00 2001 From: Chris Earle Date: Tue, 17 Feb 2026 17:16:07 -0700 Subject: [PATCH 1/7] [Build] Add Ability to update NOTICE.txt file This adds the same functionality from the Maven build. --- build.gradle.kts | 10 ++ buildSrc/build.gradle.kts | 12 +++ .../elastic/support/gradle/NoticeRenderer.kt | 93 +++++++++++++++++++ 3 files changed, 115 insertions(+) create mode 100644 buildSrc/build.gradle.kts create mode 100644 buildSrc/src/main/kotlin/co/elastic/support/gradle/NoticeRenderer.kt diff --git a/build.gradle.kts b/build.gradle.kts index d697ea26..817d44a9 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -4,6 +4,7 @@ plugins { java `maven-publish` signing + id("com.github.jk1.dependency-license-report") } group = property("group") as String @@ -77,6 +78,15 @@ dependencies { testImplementation("org.wiremock:wiremock:3.13.2") } +// --------------------------------------------------------------------------- +// Generate NOTICE.txt from NOTICE.template + runtime dependency licenses +// --------------------------------------------------------------------------- +licenseReport { + configurations = arrayOf("runtimeClasspath") + renderers = arrayOf(co.elastic.support.gradle.NoticeRenderer("NOTICE.template", "NOTICE.txt")) + excludeOwnGroup = true +} + // --------------------------------------------------------------------------- // Jar // --------------------------------------------------------------------------- diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts new file mode 100644 index 00000000..a756038d --- /dev/null +++ b/buildSrc/build.gradle.kts @@ -0,0 +1,12 @@ +plugins { + `kotlin-dsl` +} + +repositories { + mavenCentral() + gradlePluginPortal() +} + +dependencies { + implementation("com.github.jk1:gradle-license-report:3.1.1") +} diff --git a/buildSrc/src/main/kotlin/co/elastic/support/gradle/NoticeRenderer.kt b/buildSrc/src/main/kotlin/co/elastic/support/gradle/NoticeRenderer.kt new file mode 100644 index 00000000..a946b16e --- /dev/null +++ b/buildSrc/src/main/kotlin/co/elastic/support/gradle/NoticeRenderer.kt @@ -0,0 +1,93 @@ +package co.elastic.support.gradle + +import com.github.jk1.license.LicenseReportExtension +import com.github.jk1.license.ModuleData +import com.github.jk1.license.ProjectData +import com.github.jk1.license.render.ReportRenderer +import java.io.File +import java.util.TreeSet + +/** + * Custom renderer for the jk1 license-report plugin that generates a NOTICE.txt + * from a NOTICE.template file. Each dependency is listed as: + * + * Name under License + * + * The template must contain the placeholder `#GENERATED_NOTICES#` which + * will be replaced with the sorted dependency listing. + */ +class NoticeRenderer( + private val templatePath: String = "NOTICE.template", + private val outputFileName: String = "NOTICE.txt" +) : ReportRenderer { + + override fun render(data: ProjectData) { + val project = data.project + val config = project.extensions.getByType(LicenseReportExtension::class.java) + + val templateFile = project.file(templatePath) + if (!templateFile.exists()) { + throw IllegalStateException("NOTICE template not found: ${templateFile.absolutePath}") + } + + val entries = TreeSet() + + data.allDependencies.forEach { module -> + val name = resolveModuleName(module) + val license = resolveModuleLicense(module) + entries.add(" $name under $license") + } + + val template = templateFile.readText() + val notices = entries.joinToString("\n") + val outputFile = File(config.absoluteOutputDir, outputFileName) + outputFile.writeText(template.replace("#GENERATED_NOTICES#", notices) + "\n") + + // Also write to project root so NOTICE.txt stays in sync + val rootNotice = project.file(outputFileName) + rootNotice.writeText(outputFile.readText()) + } + + companion object { + private fun resolveModuleName(module: ModuleData): String { + // Try POM name first + for (pom in module.poms) { + val name = pom.name?.trim() + if (!name.isNullOrEmpty()) return name + } + // Try manifest name + for (manifest in module.manifests) { + val name = manifest.name?.trim() + if (!name.isNullOrEmpty()) return name + } + // Fall back to group:name + return "${module.group}:${module.name}" + } + + private fun resolveModuleLicense(module: ModuleData): String { + val licenseNames = linkedSetOf() + + // Check POM licenses + for (pom in module.poms) { + for (license in pom.licenses) { + val name = license.name?.trim() + if (!name.isNullOrEmpty()) { + licenseNames.add(name) + } + } + } + + // Check manifest license + if (licenseNames.isEmpty()) { + for (manifest in module.manifests) { + val name = manifest.license?.trim() + if (!name.isNullOrEmpty()) { + licenseNames.add(name) + } + } + } + + return if (licenseNames.isEmpty()) "Unknown" else licenseNames.joinToString(" or ") + } + } +} From 9391366299b2a794d1769e9e9686429774e63eb8 Mon Sep 17 00:00:00 2001 From: Chris Earle Date: Tue, 17 Feb 2026 17:18:12 -0700 Subject: [PATCH 2/7] Add Git workflow to fail the build if the notice is not properly updated --- .github/workflows/check-notice.yml | 32 ++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .github/workflows/check-notice.yml diff --git a/.github/workflows/check-notice.yml b/.github/workflows/check-notice.yml new file mode 100644 index 00000000..4c25a147 --- /dev/null +++ b/.github/workflows/check-notice.yml @@ -0,0 +1,32 @@ +name: Check NOTICE.txt + +on: + pull_request: + paths: + - 'build.gradle.kts' + - 'NOTICE.template' + - 'NOTICE.txt' + - 'buildSrc/**' + +jobs: + check-notice: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-java@v4 + with: + distribution: temurin + java-version: '25' + + - uses: gradle/actions/setup-gradle@v4 + + - name: Generate NOTICE.txt + run: ./gradlew generateLicenseReport + + - name: Check NOTICE.txt is up to date + run: | + if ! git diff --exit-code NOTICE.txt; then + echo "::error::NOTICE.txt is out of date. Run './gradlew generateLicenseReport' and commit the result." + exit 1 + fi \ No newline at end of file From 5ea4ba8c1df4b612608d20b03f75f51ce517042f Mon Sep 17 00:00:00 2001 From: Chris Earle Date: Tue, 17 Feb 2026 17:20:08 -0700 Subject: [PATCH 3/7] Use zulu instead of temurin --- .github/workflows/check-notice.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-notice.yml b/.github/workflows/check-notice.yml index 4c25a147..06e49e26 100644 --- a/.github/workflows/check-notice.yml +++ b/.github/workflows/check-notice.yml @@ -16,7 +16,7 @@ jobs: - uses: actions/setup-java@v4 with: - distribution: temurin + distribution: zulu java-version: '25' - uses: gradle/actions/setup-gradle@v4 @@ -29,4 +29,4 @@ jobs: if ! git diff --exit-code NOTICE.txt; then echo "::error::NOTICE.txt is out of date. Run './gradlew generateLicenseReport' and commit the result." exit 1 - fi \ No newline at end of file + fi From b44e9e9910351141afc971235a5b4052842cd8ba Mon Sep 17 00:00:00 2001 From: Chris Earle Date: Tue, 17 Feb 2026 17:22:29 -0700 Subject: [PATCH 4/7] Reuse same action steps --- .github/workflows/check-notice.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/check-notice.yml b/.github/workflows/check-notice.yml index 06e49e26..777ffb65 100644 --- a/.github/workflows/check-notice.yml +++ b/.github/workflows/check-notice.yml @@ -12,14 +12,14 @@ jobs: check-notice: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - - uses: actions/setup-java@v4 + - name: Set up JDK 25 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 with: distribution: zulu java-version: '25' - - - uses: gradle/actions/setup-gradle@v4 + cache: gradle - name: Generate NOTICE.txt run: ./gradlew generateLicenseReport From ccd889c728ad91648b1378c744c027045e8de523 Mon Sep 17 00:00:00 2001 From: Chris Earle Date: Tue, 17 Feb 2026 17:25:00 -0700 Subject: [PATCH 5/7] Update NOTICE.txt --- NOTICE.txt | 132 +++++------------------------------------------------ 1 file changed, 12 insertions(+), 120 deletions(-) diff --git a/NOTICE.txt b/NOTICE.txt index b7594ae6..78bd57ac 100644 --- a/NOTICE.txt +++ b/NOTICE.txt @@ -8,141 +8,33 @@ Foundation (http://www.apache.org/). Third party libraries used by the Support Diagnostics Utilities: ================================================================ - Angus Activation Registries under EDL 1.0 - Apache Commons BeanUtils under Apache License, Version 2.0 Apache Commons Codec under Apache-2.0 - Apache Commons Collections under Apache License, Version 2.0 Apache Commons Compress under Apache-2.0 - Apache Commons Digester under The Apache Software License, Version 2.0 Apache Commons IO under Apache-2.0 Apache Commons Lang under Apache-2.0 Apache Commons Logging under Apache-2.0 - Apache Commons Text under Apache License, Version 2.0 Apache FreeMarker under Apache License, Version 2.0 Apache HttpClient under Apache License, Version 2.0 Apache HttpCore under Apache License, Version 2.0 Apache Log4j API under Apache-2.0 Apache Log4j Commons Logging Bridge under Apache-2.0 Apache Log4j Core under Apache-2.0 - Apache Velocity - Engine under Apache License, Version 2.0 - Apache Velocity - JSR 223 Scripting under Apache License, Version 2.0 - Apache Velocity Tools - Generic tools under Apache License, Version 2.0 - asm under BSD-3-Clause - ASM based accessors helper used by json-smart under The Apache Software License, Version 2.0 - Bouncy Castle ASN.1 Extension and Utility APIs under Bouncy Castle Licence - Bouncy Castle PKIX, CMS, EAC, TSP, PKCS, OCSP, CMP, and CRMF APIs under Bouncy Castle Licence - Bouncy Castle Provider under Bouncy Castle Licence - btf under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0 - Checker Qual under The MIT License - ClassGraph under The MIT License (MIT) - Disruptor Framework under The Apache Software License, Version 2.0 - error-prone annotations under Apache 2.0 - FindBugs-jsr305 under The Apache Software License, Version 2.0 - Guava InternalFutureFailureAccess and InternalFutures under The Apache Software License, Version 2.0 - Guava ListenableFuture only under The Apache Software License, Version 2.0 - Guava: Google Core Libraries for Java under Apache License, Version 2.0 - Hamcrest Core under New BSD License - Internet Time Utility under Apache License, Version 2.0 - istack common utility code runtime under Eclipse Distribution License - v 1.0 - J2ObjC Annotations under The Apache Software License, Version 2.0 - Jackson datatype: JSR310 under The Apache Software License, Version 2.0 - Jackson-annotations under The Apache Software License, Version 2.0 - Jackson-core under The Apache Software License, Version 2.0 - jackson-coreutils under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0 - jackson-coreutils-equivalence under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0 - jackson-databind under The Apache Software License, Version 2.0 - Jackson-dataformat-YAML under The Apache Software License, Version 2.0 - Jakarta Activation under EDL 1.0 - Jakarta Activation API under EDL 1.0 - Jakarta Bean Validation API under Apache License 2.0 - Jakarta XML Binding API under Eclipse Distribution License - v 1.0 - Java Native Access under LGPL, version 2.1 or Apache License v2.0 - Java Native Access Platform under LGPL, version 2.1 or Apache License v2.0 - Java Servlet API under CDDL + GPLv2 with classpath exception - Java UUID Generator under The Apache Software License, Version 2.0 - JavaBeans Activation Framework API jar under CDDL/GPLv2+CE - JavaMail API (no providers) under CDDL/GPLv2+CE - JAXB Core under Eclipse Distribution License - v 1.0 - JAXB Runtime under Eclipse Distribution License - v 1.0 - jaxb-api under CDDL 1.1 or GPL2 w/ CPE - JCIP Annotations under Apache License under Apache License, Version 2.0 - jcommander under Apache License, Version 2.0 JLine under The BSD License - jmustache under The (New) BSD License - Joda-Time under Apache License, Version 2.0 - JOpt Simple under The MIT License - JSch under Revised BSD or Revised BSD or ISC - JSON Small and Fast Parser under The Apache Software License, Version 2.0 - json-patch under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0 - json-schema-core under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0 - json-schema-validator under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0 - json-unit-core under The Apache Software License, Version 2.0 - JSON.simple under The Apache Software License, Version 2.0 - JsonSchemaValidator under Apache License Version 2.0 - JSpecify annotations under The Apache License, Version 2.0 JSR 353 (JSON Processing) Default Provider under Dual license consisting of the CDDL v1.1 and GPL v2 - JUnit under Eclipse Public License 1.0 - JUnit Jupiter API under Eclipse Public License v2.0 - JUnit Jupiter Engine under Eclipse Public License v2.0 - JUnit Platform Commons under Eclipse Public License v2.0 - JUnit Platform Engine API under Eclipse Public License v2.0 - JUnit Platform Launcher under Eclipse Public License v2.0 - JUnit Platform Surefire Provider under The Apache License, Version 2.0 - JUnit Vintage Engine under Eclipse Public License v2.0 - JZlib under BSD - libphonenumber under The Apache Software License, Version 2.0 - MockServer & Proxy Netty under The Apache Software License, Version 2.0 - MockServer Core under The Apache Software License, Version 2.0 - MockServer Java Client under The Apache Software License, Version 2.0 + JSch under ISC or Revised BSD + JSpecify annotations under The Apache License, Version 2.0 + Jackson BOM under Apache License, Version 2.0 or The Apache Software License, Version 2.0 + Jackson-annotations under The Apache Software License, Version 2.0 + Jackson-core under Apache License, Version 2.0 or The Apache Software License, Version 2.0 + Java Native Access Platform under Apache License v2.0 or LGPL, version 2.1 + Java Native Access under Apache License v2.0 or LGPL, version 2.1 Module awt-color-factory under GNU General Public License, version 2, with the Classpath Exception Module text-io under The Apache Software License, Version 2.0 - Mozilla Rhino under Mozilla Public License, Version 2.0 - msg-simple under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0 - Netty/Buffer under Apache License, Version 2.0 - Netty/Codec under Apache License, Version 2.0 - Netty/Codec/HTTP under Apache License, Version 2.0 - Netty/Codec/HTTP2 under Apache License, Version 2.0 - Netty/Codec/Socks under Apache License, Version 2.0 - Netty/Common under Apache License, Version 2.0 - Netty/Handler under Apache License, Version 2.0 - Netty/Handler/Proxy under Apache License, Version 2.0 - Netty/Resolver under Apache License, Version 2.0 - Netty/TomcatNative [BoringSSL - Static] under The Apache Software License, Version 2.0 - Netty/TomcatNative [OpenSSL - Classes] under The Apache Software License, Version 2.0 - Netty/Transport under Apache License, Version 2.0 - Netty/Transport/Native/Unix/Common under Apache License, Version 2.0 - Nimbus JOSE+JWT under The Apache Software License, Version 2.0 - Old JAXB Core under Eclipse Distribution License - v 1.0 - Old JAXB Runtime under Eclipse Distribution License - v 1.0 - org.apiguardian:apiguardian-api under The Apache License, Version 2.0 - org.opentest4j:opentest4j under The Apache License, Version 2.0 - org.xmlunit:xmlunit-core under The Apache Software License, Version 2.0 - org.xmlunit:xmlunit-placeholders under The Apache Software License, Version 2.0 - oshi-core under MIT License - oshi-json under MIT License - project ':json-path' under The Apache Software License, Version 2.0 - Project Lombok under The MIT License - Prometheus Java Simpleclient under The Apache Software License, Version 2.0 - Prometheus Java Simpleclient Common under The Apache Software License, Version 2.0 - Prometheus Java Simpleclient Httpserver under The Apache Software License, Version 2.0 - Prometheus Java Span Context Supplier - Common under The Apache Software License, Version 2.0 - Prometheus Java Span Context Supplier - OpenTelemetry under The Apache Software License, Version 2.0 - Prometheus Java Span Context Supplier - OpenTelemetry Agent under The Apache Software License, Version 2.0 - semver4j under The MIT License - Shared Java 5 Provider Base under Apache License, Version 2.0 SLF4J 1 Binding for Log4j API under Apache-2.0 SLF4J API Module under MIT License SnakeYAML under Apache License, Version 2.0 - Support Diagnostics Utilities under Elastic License - SureFire API under Apache License, Version 2.0 - SureFire Logger API under Apache License, Version 2.0 - swagger-annotations under Apache License 2.0 - swagger-compat-spec-parser under Apache License 2.0 - swagger-core under Apache License 2.0 - swagger-models under Apache License 2.0 - swagger-parser under Apache License 2.0 - swagger-parser-v2-converter under Apache License 2.0 - swagger-parser-v3 under Apache License 2.0 - TXW2 Runtime under Eclipse Distribution License - v 1.0 - uri-template under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0 - + jackson-databind under Apache License, Version 2.0 or The Apache Software License, Version 2.0 + jcommander under Apache License, Version 2.0 + oshi-core under MIT License + oshi-json under MIT License + semver4j under The MIT License From fff2f9854719313596db50fd3526c001db9a0e03 Mon Sep 17 00:00:00 2001 From: Chris Earle Date: Tue, 17 Feb 2026 17:29:17 -0700 Subject: [PATCH 6/7] Sort case insensitively --- .../main/kotlin/co/elastic/support/gradle/NoticeRenderer.kt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/buildSrc/src/main/kotlin/co/elastic/support/gradle/NoticeRenderer.kt b/buildSrc/src/main/kotlin/co/elastic/support/gradle/NoticeRenderer.kt index a946b16e..306ceeda 100644 --- a/buildSrc/src/main/kotlin/co/elastic/support/gradle/NoticeRenderer.kt +++ b/buildSrc/src/main/kotlin/co/elastic/support/gradle/NoticeRenderer.kt @@ -5,7 +5,7 @@ import com.github.jk1.license.ModuleData import com.github.jk1.license.ProjectData import com.github.jk1.license.render.ReportRenderer import java.io.File -import java.util.TreeSet +import java.util.* /** * Custom renderer for the jk1 license-report plugin that generates a NOTICE.txt @@ -30,7 +30,7 @@ class NoticeRenderer( throw IllegalStateException("NOTICE template not found: ${templateFile.absolutePath}") } - val entries = TreeSet() + val entries = TreeSet(String.CASE_INSENSITIVE_ORDER) data.allDependencies.forEach { module -> val name = resolveModuleName(module) From f96da2f1e05b903e4cdc7c4951481babc7eb316b Mon Sep 17 00:00:00 2001 From: Chris Earle Date: Tue, 17 Feb 2026 17:30:23 -0700 Subject: [PATCH 7/7] Re-run notices --- NOTICE.txt | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/NOTICE.txt b/NOTICE.txt index 78bd57ac..ed651e2c 100644 --- a/NOTICE.txt +++ b/NOTICE.txt @@ -19,22 +19,22 @@ Third party libraries used by the Support Diagnostics Utilities: Apache Log4j API under Apache-2.0 Apache Log4j Commons Logging Bridge under Apache-2.0 Apache Log4j Core under Apache-2.0 - JLine under The BSD License - JSR 353 (JSON Processing) Default Provider under Dual license consisting of the CDDL v1.1 and GPL v2 - JSch under ISC or Revised BSD - JSpecify annotations under The Apache License, Version 2.0 Jackson BOM under Apache License, Version 2.0 or The Apache Software License, Version 2.0 Jackson-annotations under The Apache Software License, Version 2.0 Jackson-core under Apache License, Version 2.0 or The Apache Software License, Version 2.0 + jackson-databind under Apache License, Version 2.0 or The Apache Software License, Version 2.0 Java Native Access Platform under Apache License v2.0 or LGPL, version 2.1 Java Native Access under Apache License v2.0 or LGPL, version 2.1 + jcommander under Apache License, Version 2.0 + JLine under The BSD License + JSch under ISC or Revised BSD + JSpecify annotations under The Apache License, Version 2.0 + JSR 353 (JSON Processing) Default Provider under Dual license consisting of the CDDL v1.1 and GPL v2 Module awt-color-factory under GNU General Public License, version 2, with the Classpath Exception Module text-io under The Apache Software License, Version 2.0 - SLF4J 1 Binding for Log4j API under Apache-2.0 - SLF4J API Module under MIT License - SnakeYAML under Apache License, Version 2.0 - jackson-databind under Apache License, Version 2.0 or The Apache Software License, Version 2.0 - jcommander under Apache License, Version 2.0 oshi-core under MIT License oshi-json under MIT License semver4j under The MIT License + SLF4J 1 Binding for Log4j API under Apache-2.0 + SLF4J API Module under MIT License + SnakeYAML under Apache License, Version 2.0