Sanitize licenses in core image packages

[dmcilvaney]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./SPECS/LICENSES-AND-NOTICES/data/licenses.json, ./SPECS/LICENSES-AND-NOTICES/LICENSES-MAP.md, ./SPECS/LICENSES-AND-NOTICES/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• If you are adding/removing a .spec file that has multiple-versions supported, please add @microsoft/cbl-mariner-multi-package-reviewers team as reviewer (Eg. golang has 2 versions 1.18, 1.21+)
• Ready to merge

---

Summary

As part of #8776 we would like to disable documentation on specific size-constrained images. However, there is a complication: many packages do not use the %license tag in their %files section to accurately tag license files. If such an image was distributed it would run afoul of open source licensing requirements (ie it would not include the required license files with the corresponding binary files). A tool was created that attempts to detect these cases (early draft here: #9060) and will be integrated into the normal build flow in the future.

In the mean time, to unblock the configurable documentation PR, the packages which both apear in the no-documentation images, and have critical license issues, are fixed in this PR.

• cmake: cmake contains licenses from several sub-projects. Move all these license files out of /usr/doc/cmake-3.28/<subproject>/* into the already used Licenses folder. It turns out these license files were the only documentation included in our package, so remove the empty dir.
• cyrus-sasl: COPYING was being manually copied/renamed into /usr/share/licenses/%{name}/LICENSE during install, and was marked as a normal file. The package already uses the %license tag on the original file directly.
• ethtool: Split COPYING out of the %doc section into %license.
• libdb: Also manually installed both license and readme files, use %doc and %license on the originals instead.
• librdkafka: The make install step places a concatenated license file into /usr/share/docs/librdkafka/LICENSES.txt, clean that up and use the %license macro instead.
• lmdb: Don't manually install files, don't duplicate LICENSE in the base package, lmdb-libs is a requirement and already had them. Use %license.
• qemu: Don't manually install license files, use %license instead. Add them to qemu-guest-agent, qemu-common already has all of them listed.
• userspace-rcu: make install places a LICENSE file, use the local copy with %license instead. It should be in the core package, not userspace-rcu-devel as well.

Change Log

• Sanitize license files for packages used in core images.

Does this affect the toolchain?

YES

Associated issues

• https://microsoft.visualstudio.com/DefaultCollection/OS/_workitems/edit/50220148
• https://microsoft.visualstudio.com/OS/_workitems/edit/50982283

Test Methodology

• Local builds checked against the tool in Add new license validator tool #9060
• Full build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=571671&view=results

[sameluch]

Looks good!