GH-579: Add and fix LICENSE.txt and NOTICE.txt in the distributed artifacts

[jbonofre]

Fixes#579.

In our distributed artifacts, especially the shading ones, we have to provide LICENSE.txt and NOTICE.txt with all "bundled" dependencies.

@lidavidm@kou This is a draft PR as I have to fix the non-shading artifacts.

[jbonofre]

@kou@lidavidm if you have time, you can already take a look on the content. Please let me know if you have any question.

[lidavidm]

BTW, how were these generated? Or do they have to be assembled by hand?

[jbonofre]

BTW, how were these generated? Or do they have to be assembled by hand?

For this release, I did that "manually". After the release, I will add the maven tooling to at least check the content.

[kou]

+1

Thanks!

[wgtmac]

Is it required to include the specific version? It would be easily out of sync since the dependabot does not maintain this.

[jbonofre]

Unfortunately (or not 😄 ), yes, It's important to specify the version of the dependency as licenses sometimes change as product versions change.
Also the NOTICE can change from a version to another.
So, it's better to document to actual version bundled in our distributed jar.

So source distribution, we should document the version where the code has been copied from.

[wgtmac]

Thanks for the explanation! If we don't have good automation tools to keep them in sync, at least we need to make sure they are accurate in the release process.

[jbonofre]

I'm fixing the location and other jar resources.

[kou]

Should we merge PRs from Dependabot such as #584 after the next release?
I think that they may change dependency versions in binary artifacts.

[jbonofre]

Should we merge PRs from Dependabot such as #584 after the next release? I think that they may change dependency versions in binary artifacts.

We can merge dependabot PRs, I will update this PR accordingly. That's totally fine for me. I need ~ 1 day to fix the last "jar" creation.

[kou]

OK. I'll merge the following PRs that were opened in this week:

• MINOR: Bump com.puppycrawl.tools:checkstyle from 10.21.1 to 10.21.2 #580
• MINOR: Bump org.apache.commons:commons-pool2 from 2.12.0 to 2.12.1 #581
• MINOR: Bump commons-codec:commons-codec from 1.17.2 to 1.18.0 #582
• MINOR: Bump org.apache.commons:commons-text from 1.12.0 to 1.13.0 #583
• MINOR: Bump com.google.api.grpc:proto-google-common-protos from 2.50.1 to 2.51.0 #584

Our Dependabot configuration uses "weekly". So the next PRs from Dependabot will be opened in the next week.

[jbonofre]

@kou thanks ! I'm updating this PR accordingly.

[jbonofre]

I'm fixing the endline thing.

[kou]

@jbonofre Can we merge this?

[jbonofre]

@jbonofre Can we merge this?

Yes, we are good 👍

[jbonofre]

@lidavidm@kou thanks for the review and merge. I'm doing a quick new run but I think we are good for the release.

[kou]

Thanks! I'll create cut an RC.