[Build] Add Ability to update NOTICE.txt file

.github/workflows/check-notice.yml

@@ -0,0 +1,32 @@
+name: Check NOTICE.txt
+
+on:
+  pull_request:
+    paths:
+      - 'build.gradle.kts'
+      - 'NOTICE.template'
+      - 'NOTICE.txt'
+      - 'buildSrc/**'
+
+jobs:
+  check-notice:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+        with:
+          distribution: zulu
+          java-version: '25'
+          cache: gradle
+
+      - name: Generate NOTICE.txt
+        run: ./gradlew generateLicenseReport
+
+      - name: Check NOTICE.txt is up to date
+        run: |
+          if ! git diff --exit-code NOTICE.txt; then
+            echo "::error::NOTICE.txt is out of date. Run './gradlew generateLicenseReport' and commit the result."
+            exit 1
+          fi

NOTICE.txt

@@ -8,141 +8,33 @@ Foundation (http://www.apache.org/).
 Third party libraries used by the Support Diagnostics Utilities:
 ================================================================
 
-  Angus Activation Registries under EDL 1.0
-  Apache Commons BeanUtils under Apache License, Version 2.0
   Apache Commons Codec under Apache-2.0
-  Apache Commons Collections under Apache License, Version 2.0
   Apache Commons Compress under Apache-2.0
-  Apache Commons Digester under The Apache Software License, Version 2.0
   Apache Commons IO under Apache-2.0
   Apache Commons Lang under Apache-2.0
   Apache Commons Logging under Apache-2.0
-  Apache Commons Text under Apache License, Version 2.0
   Apache FreeMarker under Apache License, Version 2.0
   Apache HttpClient under Apache License, Version 2.0
   Apache HttpCore under Apache License, Version 2.0
   Apache Log4j API under Apache-2.0
   Apache Log4j Commons Logging Bridge under Apache-2.0
   Apache Log4j Core under Apache-2.0
-  Apache Velocity - Engine under Apache License, Version 2.0
-  Apache Velocity - JSR 223 Scripting under Apache License, Version 2.0
-  Apache Velocity Tools - Generic tools under Apache License, Version 2.0
-  asm under BSD-3-Clause
-  ASM based accessors helper used by json-smart under The Apache Software License, Version 2.0
-  Bouncy Castle ASN.1 Extension and Utility APIs under Bouncy Castle Licence
-  Bouncy Castle PKIX, CMS, EAC, TSP, PKCS, OCSP, CMP, and CRMF APIs under Bouncy Castle Licence
-  Bouncy Castle Provider under Bouncy Castle Licence
-  btf under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0
-  Checker Qual under The MIT License
-  ClassGraph under The MIT License (MIT)
-  Disruptor Framework under The Apache Software License, Version 2.0
-  error-prone annotations under Apache 2.0
-  FindBugs-jsr305 under The Apache Software License, Version 2.0
-  Guava InternalFutureFailureAccess and InternalFutures under The Apache Software License, Version 2.0
-  Guava ListenableFuture only under The Apache Software License, Version 2.0
-  Guava: Google Core Libraries for Java under Apache License, Version 2.0
-  Hamcrest Core under New BSD License
-  Internet Time Utility under Apache License, Version 2.0
-  istack common utility code runtime under Eclipse Distribution License - v 1.0
-  J2ObjC Annotations under The Apache Software License, Version 2.0
-  Jackson datatype: JSR310 under The Apache Software License, Version 2.0
+  Jackson BOM under Apache License, Version 2.0 or The Apache Software License, Version 2.0
   Jackson-annotations under The Apache Software License, Version 2.0
-  Jackson-core under The Apache Software License, Version 2.0
-  jackson-coreutils under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0
-  jackson-coreutils-equivalence under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0
-  jackson-databind under The Apache Software License, Version 2.0
-  Jackson-dataformat-YAML under The Apache Software License, Version 2.0
-  Jakarta Activation under EDL 1.0
-  Jakarta Activation API under EDL 1.0
-  Jakarta Bean Validation API under Apache License 2.0
-  Jakarta XML Binding API under Eclipse Distribution License - v 1.0
-  Java Native Access under LGPL, version 2.1 or Apache License v2.0
-  Java Native Access Platform under LGPL, version 2.1 or Apache License v2.0
-  Java Servlet API under CDDL + GPLv2 with classpath exception
-  Java UUID Generator under The Apache Software License, Version 2.0
-  JavaBeans Activation Framework API jar under CDDL/GPLv2+CE
-  JavaMail API (no providers) under CDDL/GPLv2+CE
-  JAXB Core under Eclipse Distribution License - v 1.0
-  JAXB Runtime under Eclipse Distribution License - v 1.0
-  jaxb-api under CDDL 1.1 or GPL2 w/ CPE
-  JCIP Annotations under Apache License under Apache License, Version 2.0
+  Jackson-core under Apache License, Version 2.0 or The Apache Software License, Version 2.0
+  jackson-databind under Apache License, Version 2.0 or The Apache Software License, Version 2.0
+  Java Native Access Platform under Apache License v2.0 or LGPL, version 2.1
+  Java Native Access under Apache License v2.0 or LGPL, version 2.1
   jcommander under Apache License, Version 2.0
   JLine under The BSD License
-  jmustache under The (New) BSD License
-  Joda-Time under Apache License, Version 2.0
-  JOpt Simple under The MIT License
-  JSch under Revised BSD or Revised BSD or ISC
-  JSON Small and Fast Parser under The Apache Software License, Version 2.0
-  json-patch under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0
-  json-schema-core under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0
-  json-schema-validator under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0
-  json-unit-core under The Apache Software License, Version 2.0
-  JSON.simple under The Apache Software License, Version 2.0
-  JsonSchemaValidator under Apache License Version 2.0
+  JSch under ISC or Revised BSD
   JSpecify annotations under The Apache License, Version 2.0
   JSR 353 (JSON Processing) Default Provider under Dual license consisting of the CDDL v1.1 and GPL v2
-  JUnit under Eclipse Public License 1.0
-  JUnit Jupiter API under Eclipse Public License v2.0
-  JUnit Jupiter Engine under Eclipse Public License v2.0
-  JUnit Platform Commons under Eclipse Public License v2.0
-  JUnit Platform Engine API under Eclipse Public License v2.0
-  JUnit Platform Launcher under Eclipse Public License v2.0
-  JUnit Platform Surefire Provider under The Apache License, Version 2.0
-  JUnit Vintage Engine under Eclipse Public License v2.0
-  JZlib under BSD
-  libphonenumber under The Apache Software License, Version 2.0
-  MockServer & Proxy Netty under The Apache Software License, Version 2.0
-  MockServer Core under The Apache Software License, Version 2.0
-  MockServer Java Client under The Apache Software License, Version 2.0
   Module awt-color-factory under GNU General Public License, version 2, with the Classpath Exception
   Module text-io under The Apache Software License, Version 2.0
-  Mozilla Rhino under Mozilla Public License, Version 2.0
-  msg-simple under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0
-  Netty/Buffer under Apache License, Version 2.0
-  Netty/Codec under Apache License, Version 2.0
-  Netty/Codec/HTTP under Apache License, Version 2.0
-  Netty/Codec/HTTP2 under Apache License, Version 2.0
-  Netty/Codec/Socks under Apache License, Version 2.0
-  Netty/Common under Apache License, Version 2.0
-  Netty/Handler under Apache License, Version 2.0
-  Netty/Handler/Proxy under Apache License, Version 2.0
-  Netty/Resolver under Apache License, Version 2.0
-  Netty/TomcatNative [BoringSSL - Static] under The Apache Software License, Version 2.0
-  Netty/TomcatNative [OpenSSL - Classes] under The Apache Software License, Version 2.0
-  Netty/Transport under Apache License, Version 2.0
-  Netty/Transport/Native/Unix/Common under Apache License, Version 2.0
-  Nimbus JOSE+JWT under The Apache Software License, Version 2.0
-  Old JAXB Core under Eclipse Distribution License - v 1.0
-  Old JAXB Runtime under Eclipse Distribution License - v 1.0
-  org.apiguardian:apiguardian-api under The Apache License, Version 2.0
-  org.opentest4j:opentest4j under The Apache License, Version 2.0
-  org.xmlunit:xmlunit-core under The Apache Software License, Version 2.0
-  org.xmlunit:xmlunit-placeholders under The Apache Software License, Version 2.0
   oshi-core under MIT License
   oshi-json under MIT License
-  project ':json-path' under The Apache Software License, Version 2.0
-  Project Lombok under The MIT License
-  Prometheus Java Simpleclient under The Apache Software License, Version 2.0
-  Prometheus Java Simpleclient Common under The Apache Software License, Version 2.0
-  Prometheus Java Simpleclient Httpserver under The Apache Software License, Version 2.0
-  Prometheus Java Span Context Supplier - Common under The Apache Software License, Version 2.0
-  Prometheus Java Span Context Supplier - OpenTelemetry under The Apache Software License, Version 2.0
-  Prometheus Java Span Context Supplier - OpenTelemetry Agent under The Apache Software License, Version 2.0
   semver4j under The MIT License
-  Shared Java 5 Provider Base under Apache License, Version 2.0
   SLF4J 1 Binding for Log4j API under Apache-2.0
   SLF4J API Module under MIT License
   SnakeYAML under Apache License, Version 2.0
-  Support Diagnostics Utilities under Elastic License
-  SureFire API under Apache License, Version 2.0
-  SureFire Logger API under Apache License, Version 2.0
-  swagger-annotations under Apache License 2.0
-  swagger-compat-spec-parser under Apache License 2.0
-  swagger-core under Apache License 2.0
-  swagger-models under Apache License 2.0
-  swagger-parser under Apache License 2.0
-  swagger-parser-v2-converter under Apache License 2.0
-  swagger-parser-v3 under Apache License 2.0
-  TXW2 Runtime under Eclipse Distribution License - v 1.0
-  uri-template under Lesser General Public License, version 3 or greater or Apache Software License, version 2.0
-

build.gradle.kts

@@ -4,6 +4,7 @@ plugins {
     java
     `maven-publish`
     signing
+    id("com.github.jk1.dependency-license-report")
 }
 
 group = property("group") as String
@@ -77,6 +78,15 @@ dependencies {
     testImplementation("org.wiremock:wiremock:3.13.2")
 }
 
+// ---------------------------------------------------------------------------
+// Generate NOTICE.txt from NOTICE.template + runtime dependency licenses
+// ---------------------------------------------------------------------------
+licenseReport {
+    configurations = arrayOf("runtimeClasspath")
+    renderers = arrayOf(co.elastic.support.gradle.NoticeRenderer("NOTICE.template", "NOTICE.txt"))
+    excludeOwnGroup = true
+}
+
 // ---------------------------------------------------------------------------
 // Jar
 // ---------------------------------------------------------------------------

buildSrc/build.gradle.kts

@@ -0,0 +1,12 @@
+plugins {
+    `kotlin-dsl`
+}
+
+repositories {
+    mavenCentral()
+    gradlePluginPortal()
+}
+
+dependencies {
+    implementation("com.github.jk1:gradle-license-report:3.1.1")
+}

buildSrc/src/main/kotlin/co/elastic/support/gradle/NoticeRenderer.kt

@@ -0,0 +1,93 @@
+package co.elastic.support.gradle
+
+import com.github.jk1.license.LicenseReportExtension
+import com.github.jk1.license.ModuleData
+import com.github.jk1.license.ProjectData
+import com.github.jk1.license.render.ReportRenderer
+import java.io.File
+import java.util.*
+
+/**
+ * Custom renderer for the jk1 license-report plugin that generates a NOTICE.txt
+ * from a NOTICE.template file. Each dependency is listed as:
+ *
+ *   Name under License
+ *
+ * The template must contain the placeholder `#GENERATED_NOTICES#` which
+ * will be replaced with the sorted dependency listing.
+ */
+class NoticeRenderer(
+    private val templatePath: String = "NOTICE.template",
+    private val outputFileName: String = "NOTICE.txt"
+) : ReportRenderer {
+
+    override fun render(data: ProjectData) {
+        val project = data.project
+        val config = project.extensions.getByType(LicenseReportExtension::class.java)
+
+        val templateFile = project.file(templatePath)
+        if (!templateFile.exists()) {
+            throw IllegalStateException("NOTICE template not found: ${templateFile.absolutePath}")
+        }
+
+        val entries = TreeSet(String.CASE_INSENSITIVE_ORDER)
+
+        data.allDependencies.forEach { module ->
+            val name = resolveModuleName(module)
+            val license = resolveModuleLicense(module)
+            entries.add("  $name under $license")
+        }
+
+        val template = templateFile.readText()
+        val notices = entries.joinToString("\n")
+        val outputFile = File(config.absoluteOutputDir, outputFileName)
+        outputFile.writeText(template.replace("#GENERATED_NOTICES#", notices) + "\n")
+
+        // Also write to project root so NOTICE.txt stays in sync
+        val rootNotice = project.file(outputFileName)
+        rootNotice.writeText(outputFile.readText())
+    }
+
+    companion object {
+        private fun resolveModuleName(module: ModuleData): String {
+            // Try POM name first
+            for (pom in module.poms) {
+                val name = pom.name?.trim()
+                if (!name.isNullOrEmpty()) return name
+            }
+            // Try manifest name
+            for (manifest in module.manifests) {
+                val name = manifest.name?.trim()
+                if (!name.isNullOrEmpty()) return name
+            }
+            // Fall back to group:name
+            return "${module.group}:${module.name}"
+        }
+
+        private fun resolveModuleLicense(module: ModuleData): String {
+            val licenseNames = linkedSetOf<String>()
+
+            // Check POM licenses
+            for (pom in module.poms) {
+                for (license in pom.licenses) {
+                    val name = license.name?.trim()
+                    if (!name.isNullOrEmpty()) {
+                        licenseNames.add(name)
+                    }
+                }
+            }
+
+            // Check manifest license
+            if (licenseNames.isEmpty()) {
+                for (manifest in module.manifests) {
+                    val name = manifest.license?.trim()
+                    if (!name.isNullOrEmpty()) {
+                        licenseNames.add(name)
+                    }
+                }
+            }
+
+            return if (licenseNames.isEmpty()) "Unknown" else licenseNames.joinToString(" or ")
+        }
+    }
+}