LICENSE.txt and NOTICE.txt files have the wrong content in the latest releases

[zgagnon]

Since around version 3.4, spring-boot jars have been shipping with META-INF/LICENSE.txt and META-INF/NOTICE.txt from gradle

❯ cat META-INF/LICENSE.txt
Develocity Gradle Plugin
========================
Copyright (c) 2025 Gradle Inc.
All rights reserved.

Use of this software is subject to the Develocity Software Agreement
located at https://gradle.com/help/legal-terms-of-use

[ym0506]

Thanks for reporting this. To help with triage, could you share:

• Which exact Spring Boot artifact(s) and version(s) contain these files (e.g. groupId:artifactId:version and the jar filename)?
• Was the jar downloaded from Maven Central (or another repository) or built locally from source?

A minimal way to capture the evidence is:

jar tf <the-jar>.jar | grep -E 'META-INF/(LICENSE|NOTICE)\.txt'
unzip -p <the-jar>.jar META-INF/LICENSE.txt | head -n 30
unzip -p <the-jar>.jar META-INF/NOTICE.txt  | head -n 80

[wilkinsona]

Thanks, @zgagnon. The problem seems to be intermittent. For example https://repo.maven.apache.org/maven2/org/springframework/boot/spring-boot/4.0.2/spring-boot-4.0.2.jar is affected but https://repo.maven.apache.org/maven2/org/springframework/boot/spring-boot/4.0.0/spring-boot-4.0.0.jar is not.

[wilkinsona]

On further investigation, I don't think this is intermittent. The problem appears to be new in the most recent releases. 3.5.10, 4.0.2, and 4.1.0-M1 are all affected. 3.5.9 and 4.0.1 are not affected and neither is 3.4.13, the last 3.4.x release.

3.5.10 used Develocity plugin 4.2.2 whereas 3.5.9 used Develocity plugin 3.18.1. The former has NOTICE.txt and LICENSE.txt files in the root of its jar, whereas the latter does not. That appears to be the cause with the resources from the Develocity plugin's jar being preferred over those coming directly from buildSrc.