fix(licenses): support Java license designations (#636)

Signed-off-by: Kristina Pathak <kpathak@nvidia.com>

Author: kristinapathak

dependencies.md

@@ -647,6 +647,7 @@ Generated by `go run ./tools/collect-dependencies`. Refresh: `go run ./tools/col
 - `Java`: `net.javacrumbs.shedlock:shedlock-core:7.7.0` (net.javacrumbs.shedlock:shedlock-core; http://nexus.sonatype.org/oss-repository-hosting.html)
 - `Java`: `net.javacrumbs.shedlock:shedlock-provider-cassandra:7.7.0` (net.javacrumbs.shedlock:shedlock-provider-cassandra; http://nexus.sonatype.org/oss-repository-hosting.html)
 - `Java`: `net.javacrumbs.shedlock:shedlock-spring:7.7.0` (net.javacrumbs.shedlock:shedlock-spring; http://nexus.sonatype.org/oss-repository-hosting.html)
+- `Java`: `net.logstash.logback:logstash-logback-encoder:8.1` (Logstash Logback Encoder; https://github.com/logfellow/logstash-logback-encoder)
 - `Java`: `net.minidev:accessors-smart:2.6.0` (ASM based accessors helper used by json-smart; https://urielch.github.io/)
 - `Java`: `net.minidev:json-smart:2.6.0` (JSON Small and Fast Parser; https://urielch.github.io/)
 - `Java`: `org.apache.cassandra:java-driver-core:4.19.3` (Apache Cassandra Java Driver - core; https://github.com/datastax/java-driver)
@@ -671,13 +672,15 @@ Generated by `go run ./tools/collect-dependencies`. Refresh: `go run ./tools/col
 - `Java`: `org.apache.tomcat:tomcat-annotations-api:11.0.24` (tomcat-annotations-api; https://tomcat.apache.org/)
 - `Java`: `org.bitbucket.b_c:jose4j:0.9.6` (jose4j; https://bitbucket.org/b_c/jose4j/)
 - `Java`: `org.hibernate.validator:hibernate-validator:9.0.1.Final` (Hibernate Validator Engine; https://hibernate.org/validator)
+- `Java`: `org.javassist:javassist:3.28.0-GA` (Javassist; http://www.javassist.org/)
 - `Java`: `org.jboss.logging:jboss-logging:3.6.3.Final` (JBoss Logging 3; https://www.jboss.org)
 - `Java`: `org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.2.21` (Kotlin Stdlib Jdk7; https://kotlinlang.org/)
 - `Java`: `org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.2.21` (Kotlin Stdlib Jdk8; https://kotlinlang.org/)
 - `Java`: `org.jetbrains.kotlin:kotlin-stdlib:2.2.21` (Kotlin Stdlib; https://kotlinlang.org/)
 - `Java`: `org.jetbrains:annotations:17.0.0` (JetBrains Java Annotations; https://github.com/JetBrains/java-annotations)
 - `Java`: `org.jspecify:jspecify:1.0.0` (JSpecify annotations; http://jspecify.org/)
 - `Java`: `org.mapstruct:mapstruct:1.5.2.Final` (MapStruct Core; http://mapstruct.org/mapstruct/)
+- `Java`: `org.reflections:reflections:0.10.2` (Reflections; http://github.com/ronmamo/reflections)
 - `Java`: `org.springdoc:springdoc-openapi-starter-common:3.0.3` (springdoc-openapi-starter-common; https://springdoc.org/)
 - `Java`: `org.springdoc:springdoc-openapi-starter-webflux-api:3.0.3` (springdoc-openapi-starter-webflux-api; https://springdoc.org/)
 - `Java`: `org.springdoc:springdoc-openapi-starter-webmvc-api:3.0.3` (springdoc-openapi-starter-webmvc-api; https://springdoc.org/)
@@ -849,10 +852,6 @@ Generated by `go run ./tools/collect-dependencies`. Refresh: `go run ./tools/col
 - `Rust`: `stargate-tls`
 - `Rust`: `sync_wrapper 1`
 
-## Apache-2.0 / LGPL 2.1 / MPL-1.1
-
-- `Java`: `org.javassist:javassist:3.28.0-GA` (Javassist; http://www.javassist.org/)
-
 ## Apache-2.0 / LGPL-3.0-or-later
 
 - `Java`: `com.github.java-json-tools:btf:1.3` (btf; https://github.com/java-json-tools/btf)
@@ -862,13 +861,8 @@ Generated by `go run ./tools/collect-dependencies`. Refresh: `go run ./tools/col
 
 ## Apache-2.0 / MIT
 
-- `Java`: `net.logstash.logback:logstash-logback-encoder:8.1` (Logstash Logback Encoder; https://github.com/logfellow/logstash-logback-encoder)
 - `Rust`: `flume =0.12.0`
 
-## Apache-2.0 / WTFPL
-
-- `Java`: `org.reflections:reflections:0.10.2` (Reflections; http://github.com/ronmamo/reflections)
-
 ## Apache-2.0 OR ISC OR MIT
 
 - `Rust`: `rustls` (`rustls 0.23.18`, `rustls =0.23.41`)

license-compliance.md

@@ -246,6 +246,25 @@ deduplicated across components.
 `NOTICE`, runtime inventory, and OSRB delta outputs remain the component-level
 compliance evidence. None of these outputs replaces legal review.
 
+### Java alternative license designations
+
+Java component `notice_metadata.json` files retain the upstream `licenses`
+list. When an approved choice exists for a versioned dependency with
+alternative licenses, add `designated_license` with the chosen SPDX identifier.
+The generator accepts a listed license name or an alias in
+`tools/bazel/java/license_aliases.json`.
+
+The generated component `NOTICE` records the designated license and the
+normalized upstream alternatives. The runtime inventory retains the alternatives
+in `declared_licenses` and reports the choice in `designated_license`. Its
+existing `licenses` field reports the designated license so dependency review
+uses the applicable choice.
+
+Only record a designation supported by the dependency's license material and
+the required compliance review. Do not add private approval identifiers to
+public metadata. `--update-metadata` preserves an existing designation for the
+same coordinate and version, but does not carry it to a new version.
+
 Use it when:
 
 - imported trees or dependency manifests changed

src/control-plane-services/instance-cluster-management/NOTICE

@@ -126,15 +126,15 @@ Lists of 293 third-party dependencies.
      (Apache License 2.0) swagger-annotations (io.swagger:swagger-annotations:1.6.16 - https://github.com/swagger-api/swagger-core)
      (EDL 1.0) Jakarta Activation API (jakarta.activation:jakarta.activation-api:2.1.4 - https://github.com/jakartaee/jaf-api)
      (EPL 2.0) (GPL2 w/ CPE) Jakarta Annotations API (jakarta.annotation:jakarta.annotation-api:3.0.0 - https://projects.eclipse.org/projects/ee4j.ca)
-     (EPL 2.0) (GPL2 w/ CPE) Jakarta Servlet (jakarta.servlet:jakarta.servlet-api:6.1.0 - https://projects.eclipse.org/projects/ee4j.servlet)
+     (Designated: EPL-2.0; upstream: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0) Jakarta Servlet (jakarta.servlet:jakarta.servlet-api:6.1.0 - https://projects.eclipse.org/projects/ee4j.servlet)
      (Apache License 2.0) Jakarta Validation API (jakarta.validation:jakarta.validation-api:3.1.1 - https://beanvalidation.org)
      (Eclipse Distribution License - v 1.0) Jakarta XML Binding API (jakarta.xml.bind:jakarta.xml.bind-api:4.0.5 - https://github.com/jakartaee/jaxb-api)
      (CDDL + GPLv2 with classpath exception) javax.annotation API (javax.annotation:javax.annotation-api:1.3.2 - http://jcp.org/en/jsr/detail?id=250)
      (Apache 2) Joda-Time (joda-time:joda-time:2.8.1 - http://www.joda.org/joda-time/)
      (The Apache Software License, Version 2.0) net.javacrumbs.shedlock:shedlock-core (net.javacrumbs.shedlock:shedlock-core:7.7.0 - http://nexus.sonatype.org/oss-repository-hosting.html)
      (The Apache Software License, Version 2.0) net.javacrumbs.shedlock:shedlock-provider-cassandra (net.javacrumbs.shedlock:shedlock-provider-cassandra:7.7.0 - http://nexus.sonatype.org/oss-repository-hosting.html)
      (The Apache Software License, Version 2.0) net.javacrumbs.shedlock:shedlock-spring (net.javacrumbs.shedlock:shedlock-spring:7.7.0 - http://nexus.sonatype.org/oss-repository-hosting.html)
-     (Apache License, Version 2.0) (MIT License) Logstash Logback Encoder (net.logstash.logback:logstash-logback-encoder:8.1 - https://github.com/logfellow/logstash-logback-encoder)
+     (Designated: Apache-2.0; upstream: Apache-2.0 OR MIT) Logstash Logback Encoder (net.logstash.logback:logstash-logback-encoder:8.1 - https://github.com/logfellow/logstash-logback-encoder)
      (The Apache Software License, Version 2.0) ASM based accessors helper used by json-smart (net.minidev:accessors-smart:2.6.0 - https://urielch.github.io/)
      (The Apache Software License, Version 2.0) JSON Small and Fast Parser (net.minidev:json-smart:2.6.0 - https://urielch.github.io/)
      (Apache 2) Apache Cassandra Java Driver - core (org.apache.cassandra:java-driver-core:4.19.3 - https://github.com/datastax/java-driver)
@@ -164,7 +164,7 @@ Lists of 293 third-party dependencies.
      (Bouncy Castle Licence) Bouncy Castle ASN.1 Extension and Utility APIs (org.bouncycastle:bcutil-jdk18on:1.80.2 - https://www.bouncycastle.org/download/bouncy-castle-java/)
      (Public Domain, per Creative Commons CC0) (BSD-2-Clause) HdrHistogram (org.hdrhistogram:HdrHistogram:2.2.2 - http://hdrhistogram.github.io/HdrHistogram/)
      (Apache License 2.0) Hibernate Validator Engine (org.hibernate.validator:hibernate-validator:9.0.1.Final - https://hibernate.org/validator)
-     (MPL 1.1) (LGPL 2.1) (Apache License 2.0) Javassist (org.javassist:javassist:3.28.0-GA - http://www.javassist.org/)
+     (Designated: Apache-2.0; upstream: Apache-2.0 OR LGPL 2.1 OR MPL 1.1) Javassist (org.javassist:javassist:3.28.0-GA - http://www.javassist.org/)
      (Apache License 2.0) JBoss Logging 3 (org.jboss.logging:jboss-logging:3.6.3.Final - https://www.jboss.org)
      (Apache-2.0) Kotlin Stdlib (org.jetbrains.kotlin:kotlin-stdlib:2.2.21 - https://kotlinlang.org/)
      (Apache-2.0) Kotlin Stdlib Jdk7 (org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.2.21 - https://kotlinlang.org/)
@@ -179,7 +179,7 @@ Lists of 293 third-party dependencies.
      (BSD-3-Clause) asm-tree (org.ow2.asm:asm-tree:9.9 - http://asm.ow2.io/)
      (BSD-3-Clause) asm-util (org.ow2.asm:asm-util:9.9 - http://asm.ow2.io/)
      (MIT-0) reactive-streams (org.reactivestreams:reactive-streams:1.0.4 - http://www.reactive-streams.org/)
-     (WTFPL) (The Apache Software License, Version 2.0) Reflections (org.reflections:reflections:0.10.2 - http://github.com/ronmamo/reflections)
+     (Designated: Apache-2.0; upstream: Apache-2.0 OR WTFPL) Reflections (org.reflections:reflections:0.10.2 - http://github.com/ronmamo/reflections)
      (MIT) JUL to SLF4J bridge (org.slf4j:jul-to-slf4j:2.0.18 - http://www.slf4j.org)
      (MIT) SLF4J API Module (org.slf4j:slf4j-api:2.0.18 - http://www.slf4j.org)
      (The Apache License, Version 2.0) springdoc-openapi-starter-common (org.springdoc:springdoc-openapi-starter-common:3.0.3 - https://springdoc.org/)

src/control-plane-services/instance-cluster-management/notice_metadata.json

@@ -274,6 +274,7 @@
       "url": "https://github.com/swagger-api/swagger-core"
     },
     "jakarta.servlet:jakarta.servlet-api:6.1.0": {
+      "designated_license": "EPL-2.0",
       "licenses": [
         "EPL 2.0",
         "GPL2 w/ CPE"
@@ -317,6 +318,7 @@
       "url": "http://nexus.sonatype.org/oss-repository-hosting.html"
     },
     "net.logstash.logback:logstash-logback-encoder:8.1": {
+      "designated_license": "Apache-2.0",
       "licenses": [
         "Apache License, Version 2.0",
         "MIT License"
@@ -430,6 +432,7 @@
       "url": "https://www.bouncycastle.org/download/bouncy-castle-java/"
     },
     "org.javassist:javassist:3.28.0-GA": {
+      "designated_license": "Apache-2.0",
       "licenses": [
         "MPL 1.1",
         "LGPL 2.1",
@@ -460,6 +463,7 @@
       "url": "http://mapstruct.org/mapstruct/"
     },
     "org.reflections:reflections:0.10.2": {
+      "designated_license": "Apache-2.0",
       "licenses": [
         "WTFPL",
         "The Apache Software License, Version 2.0"

tools/bazel/java/generate_notice.py

@@ -131,6 +131,32 @@ def normalized_licenses(licenses, aliases):
     return sorted({aliases.get(license_name, license_name) for license_name in licenses})
 
 
+def designated_license(entry, aliases):
+    designation = entry.get("designated_license")
+    if designation is None:
+        return ""
+    if not isinstance(designation, str) or not designation.strip():
+        raise ValueError("designated_license must be a non-empty string")
+
+    normalized_designation = aliases.get(designation, designation)
+    declared = normalized_licenses(entry.get("licenses", []), aliases)
+    if normalized_designation not in declared:
+        raise ValueError(
+            f"Designated license {designation!r} is not one of the upstream "
+            f"licenses: {', '.join(declared) or 'none'}"
+        )
+    return normalized_designation
+
+
+def notice_license_text(entry, aliases):
+    designation = designated_license(entry, aliases)
+    if not designation:
+        return " ".join(f"({license_name})" for license_name in entry.get("licenses", []))
+
+    declared = " OR ".join(normalized_licenses(entry.get("licenses", []), aliases))
+    return f"(Designated: {designation}; upstream: {declared})"
+
+
 def load_root_manifests(paths):
     roots = []
     for path in paths:
@@ -235,7 +261,7 @@ def runtime_jar_coordinates(paths, maven_install, first_party_groups):
     return sorted(coordinates)
 
 
-def generated_notice(coordinates, maven_install, metadata):
+def generated_notice(coordinates, maven_install, metadata, aliases):
     lines = ["", f"Lists of {len(coordinates)} third-party dependencies."]
     missing = []
     incomplete = []
@@ -254,7 +280,7 @@ def generated_notice(coordinates, maven_install, metadata):
         if not licenses or "UNKNOWN" in licenses:
             incomplete.append(versioned)
             continue
-        license_text = " ".join(f"({license_name})" for license_name in licenses)
+        license_text = notice_license_text(entry, aliases)
         name = entry.get("name") or artifact_id
         url = entry.get("url") or ""
         lines.append(f"     {license_text} {name} ({versioned} - {url})")
@@ -292,14 +318,18 @@ def generated_inventory(coordinates, maven_install, metadata, aliases):
         entry = metadata_artifacts(metadata).get(coordinate)
         if not entry:
             raise ValueError(f"Missing NOTICE metadata for {coordinate}")
-        dependencies.append(
-            {
-                "coordinate": coordinate,
-                "licenses": normalized_licenses(entry.get("licenses", []), aliases),
-                "name": entry.get("name") or artifact_id,
-                "url": entry.get("url") or "",
-            }
-        )
+        declared = normalized_licenses(entry.get("licenses", []), aliases)
+        designation = designated_license(entry, aliases)
+        dependency = {
+            "coordinate": coordinate,
+            "licenses": [designation] if designation else declared,
+            "name": entry.get("name") or artifact_id,
+            "url": entry.get("url") or "",
+        }
+        if designation:
+            dependency["declared_licenses"] = declared
+            dependency["designated_license"] = designation
+        dependencies.append(dependency)
     return {
         "generated_by": "tools/bazel/java/generate_notice.py",
         "dependencies": dependencies,
@@ -539,6 +569,7 @@ def update_metadata(
     maven_install,
     existing_metadata,
     shared_metadata=None,
+    aliases=None,
 ):
     resolver = PomMetadataResolver(maven_install)
     artifacts = dict(existing_metadata.get("artifacts", {}))
@@ -553,11 +584,16 @@ def update_metadata(
         if versioned in shared_artifacts:
             continue
         resolved = resolver.resolve(group_id, artifact_id, version)
-        artifacts[versioned] = {
+        updated_entry = {
             "licenses": resolved["licenses"],
             "name": resolved["name"],
             "url": resolved["url"],
         }
+        existing = artifacts.get(versioned, {})
+        if "designated_license" in existing:
+            updated_entry["designated_license"] = existing["designated_license"]
+        designated_license(updated_entry, aliases or {})
+        artifacts[versioned] = updated_entry
     return {
         "generated_by": "tools/bazel/java/generate_notice.py --update-metadata",
         "artifacts": {key: artifacts[key] for key in sorted(artifacts)},
@@ -667,19 +703,24 @@ def main():
     else:
         raise ValueError("At least one --root-manifest or --runtime-jar is required")
 
+    aliases = load_license_aliases(
+        pathlib.Path(args.license_aliases) if args.license_aliases else None
+    )
+
     if args.update_metadata:
         primary_metadata = update_metadata(
             coordinates,
             maven_install,
             primary_metadata,
             shared_metadata,
+            aliases,
         )
         metadata_path.write_text(
             json.dumps(primary_metadata, indent=2, sort_keys=True) + "\n"
         )
         metadata = merge_metadata(shared_documents, primary_metadata)
 
-    notice = generated_notice(coordinates, maven_install, metadata)
+    notice = generated_notice(coordinates, maven_install, metadata, aliases)
     output_path = pathlib.Path(args.output) if args.output else notice_path
     diff = compare_or_write(notice, output_path, args.write and not args.check)
     if diff:
@@ -695,11 +736,7 @@ def main():
             coordinates,
             maven_install,
             metadata,
-            load_license_aliases(
-                pathlib.Path(args.license_aliases)
-                if args.license_aliases
-                else None
-            ),
+            aliases,
         )
         pathlib.Path(args.inventory_output).write_text(
             json.dumps(inventory, indent=2, sort_keys=True) + "\n"