chore: add binary license collector helper for LICENSE-binary maintenance

tools/licensing/README.md

@@ -0,0 +1,93 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Binary distribution licensing tools
+
+Helper script for maintaining `LICENSE-binary` and the per-license text
+files under `licenses/`. Modeled after Apache Flink's
+[`tools/releasing/collect_license_files.sh`](https://github.com/apache/flink/blob/master/tools/releasing/collect_license_files.sh).
+
+## collect_binary_licenses.sh
+
+Walks every `.jar` in a given directory and extracts each jar's
+`META-INF/LICENSE` and `META-INF/NOTICE` into a staging directory.
+Produces a concatenated `NOTICE-skeleton` from all extracted NOTICE files.
+
+Only requires `bash` and `unzip` (standard on any Unix system).
+
+### Usage
+
+```bash
+./tools/licensing/collect_binary_licenses.sh <jar-dir> [<out-dir>]
+```
+
+### Typical flow (from sbt dist output)
+
+```bash
+# 1. Build the dist zip
+sbt 'project WorkflowExecutionService' dist
+
+# 2. Unzip it
+unzip amber/target/universal/amber-*.zip -d /tmp/dist
+
+# 3. Collect licensing artefacts from the bundled jars
+./tools/licensing/collect_binary_licenses.sh /tmp/dist/amber-*/lib /tmp/license-staging
+
+# 4. Review the output
+ls /tmp/license-staging/bundled/
+cat /tmp/license-staging/NOTICE-skeleton
+```
+
+### What it produces
+
+```
+<out-dir>/
+  bundled/
+    <jar-basename>/
+      LICENSE          # extracted from jar's META-INF/LICENSE (if present)
+      NOTICE           # extracted from jar's META-INF/NOTICE (if present)
+  NOTICE-skeleton      # all extracted NOTICE files concatenated
+```
+
+### How to use the output
+
+- **`bundled/<jar>/LICENSE`** — read the upstream license text verbatim
+  when drafting attribution entries in `LICENSE-binary`.
+- **`bundled/<jar>/NOTICE`** — ASF policy requires carrying forward
+  upstream NOTICE content for Apache-licensed deps. Use this as the raw
+  source when updating the binary NOTICE file.
+- **Jars with no output directory** — the script prints these to stdout.
+  They need manual investigation (check the project's website or Maven
+  Central for license info).
+
+### When to run it
+
+- **At release time**: verify that `LICENSE-binary` and `NOTICE` still
+  match the actual set of bundled jars.
+- **When dependencies change**: re-run and diff the output against the
+  previous run to identify what licensing entries need to be added or
+  removed from `LICENSE-binary`.
+
+### Limitations
+
+- Many jars omit `META-INF/LICENSE` or `META-INF/NOTICE`. Their license
+  is typically declared in the POM on Maven Central — this script does
+  not fetch POMs.
+- The `NOTICE-skeleton` is a raw concatenation with no deduplication.
+  Human curation is required before shipping.

tools/licensing/collect_binary_licenses.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# ---------------------------------------------------------------------------
+# Collect licensing artefacts from bundled jars.
+#
+# Walks every .jar in a given directory and extracts each jar's
+# META-INF/LICENSE and META-INF/NOTICE into a staging directory.
+# Also produces a concatenated NOTICE-skeleton from all extracted
+# NOTICE files. Output is a starting point for human review when
+# assembling or verifying LICENSE-binary.
+#
+# Modeled after Apache Flink's tools/releasing/collect_license_files.sh
+#
+# Usage:
+#   ./tools/licensing/collect_binary_licenses.sh <jar-dir> [<out-dir>]
+#
+# Example (from sbt dist output):
+#   sbt 'project WorkflowExecutionService' dist
+#   unzip amber/target/universal/amber-*.zip -d /tmp/dist
+#   ./tools/licensing/collect_binary_licenses.sh /tmp/dist/amber-*/lib /tmp/license-staging
+# ---------------------------------------------------------------------------
+
+set -euo pipefail
+
+JAR_DIR="${1:?Usage: $0 <jar-dir> [<out-dir>]}"
+OUT_DIR="${2:-license-staging}"
+
+if [ ! -d "$JAR_DIR" ]; then
+  echo "error: $JAR_DIR is not a directory" >&2
+  exit 1
+fi
+
+TMPDIR_ROOT=$(mktemp -d)
+trap 'rm -rf "$TMPDIR_ROOT"' EXIT
+
+mkdir -p "$OUT_DIR/bundled"
+
+total=0
+has_license=0
+has_notice=0
+
+for jar in "$JAR_DIR"/*.jar; do
+  [ -f "$jar" ] || continue
+  total=$((total + 1))
+
+  jar_basename=$(basename "$jar" .jar)
+  tmp_extract="$TMPDIR_ROOT/$jar_basename"
+  mkdir -p "$tmp_extract"
+
+  # Extract META-INF/LICENSE* and META-INF/NOTICE* (case-insensitive)
+  unzip -q -o -j "$jar" 'META-INF/LICENSE*' 'META-INF/NOTICE*' \
+    -d "$tmp_extract" 2>/dev/null || true
+
+  jar_out="$OUT_DIR/bundled/$jar_basename"
+  found_anything=false
+
+  # Copy LICENSE if extracted
+  for f in "$tmp_extract"/LICENSE* "$tmp_extract"/license*; do
+    if [ -f "$f" ]; then
+      mkdir -p "$jar_out"
+      cp "$f" "$jar_out/LICENSE"
+      has_license=$((has_license + 1))
+      found_anything=true
+      break
+    fi
+  done
+
+  # Copy NOTICE if extracted
+  for f in "$tmp_extract"/NOTICE* "$tmp_extract"/notice*; do
+    if [ -f "$f" ]; then
+      mkdir -p "$jar_out"
+      cp "$f" "$jar_out/NOTICE"
+      has_notice=$((has_notice + 1))
+      found_anything=true
+      break
+    fi
+  done
+
+  if [ "$found_anything" = false ]; then
+    echo "  (no META-INF license artefacts) $jar_basename"
+  fi
+done
+
+# Assemble NOTICE skeleton by concatenating all extracted NOTICE files
+{
+  echo "# NOTICE-skeleton"
+  echo "# Generated by tools/licensing/collect_binary_licenses.sh"
+  echo "# Manually curate before shipping: de-duplicate, group sensibly,"
+  echo "# prepend the Apache Texera NOTICE header."
+  echo ""
+  for notice in "$OUT_DIR"/bundled/*/NOTICE; do
+    [ -f "$notice" ] || continue
+    jar_name=$(basename "$(dirname "$notice")")
+    echo ""
+    echo "# ---- from $jar_name ----"
+    cat "$notice"
+  done
+} > "$OUT_DIR/NOTICE-skeleton"
+
+echo ""
+echo "Done. Scanned $total jars."
+echo "  with META-INF/LICENSE: $has_license"
+echo "  with META-INF/NOTICE:  $has_notice"
+echo ""
+echo "Output:"
+echo "  per-jar extracts:  $OUT_DIR/bundled/<jar-name>/{LICENSE,NOTICE}"
+echo "  NOTICE skeleton:   $OUT_DIR/NOTICE-skeleton"