chore: licence compliance for published artifacts

ASM-LICENSE.txt → ASM-LICENSE

@@ -1,42 +1,42 @@
-------------------------------------------------------------------------------
-
-MVEL's Built-in JIT (Just-in-Time) Compiler relies on the "ASM" library for
-generating bytecode in the Java Class File Format.
-
-The "ASM" library is subject to a third-party license henceforth described.
-
-
------------------------------ [LICENSE BEGINS]-------------------------------
-
-ASM Bytecode Manipulation Framework
-
-Copyright (c) 2000-2005 INRIA, France Telecom
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-
-3. Neither the name of the copyright holders nor the names of its
-   contributors may be used to endorse or promote products derived from
-   this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
-THE POSSIBILITY OF SUCH DAMAGE.
-
+------------------------------------------------------------------------------
+
+MVEL's Built-in JIT (Just-in-Time) Compiler relies on the "ASM" library for
+generating bytecode in the Java Class File Format.
+
+The "ASM" library is subject to a third-party license henceforth described.
+
+
+----------------------------- [LICENSE BEGINS]-------------------------------
+
+ASM Bytecode Manipulation Framework
+
+Copyright (c) 2000-2011 INRIA, France Telecom
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holders nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+THE POSSIBILITY OF SUCH DAMAGE.
+

README.md

@@ -0,0 +1,11 @@
+# TBEL
+
+TBEL (ThingsBoard Expression Language) is the expression language behind user-defined functions in the ThingsBoard platform. It is a fork of [MVEL 2](https://github.com/mvel/mvel) adding sandboxing, execution limits, and a few language constructs.
+
+Published as `org.thingsboard:tbel`.
+
+## Licensing
+
+TBEL is licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) for the full license text.
+
+It also contains a vendored copy of the ASM bytecode library under `org/mvel2/asm`, inherited from MVEL and licensed under BSD-3-Clause — see `ASM-LICENSE`.

apache-license-header-template.txt

@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: Copyright ${project.inceptionYear} ${owner}
+SPDX-License-Identifier: Apache-2.0

pom.xml

@@ -5,7 +5,7 @@
     <groupId>org.thingsboard</groupId>
     <artifactId>tbel</artifactId>
     <packaging>jar</packaging>
-    <version>1.2.10</version>
+    <version>1.2.11</version>
 
     <name>tbel</name>
     <url>https://thingsboard.io/</url>
@@ -15,8 +15,8 @@
     </description>
     <licenses>
         <license>
-            <name>The Apache Software License, Version 2.0</name>
-            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
+            <name>Apache License 2.0</name>
+            <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
             <distribution>repo</distribution>
         </license>
     </licenses>
@@ -27,8 +27,8 @@
     </organization>
 
     <scm>
-        <connection>scm:git:git@github.com:thingsboard/tbel.git</connection>
-        <url>scm:git:git@github.com:thingsboard/tbel.git</url>
+        <connection>scm:git:https://github.com/thingsboard/tbel.git</connection>
+        <url>https://github.com/thingsboard/tbel</url>
         <developerConnection>scm:git:git@github.com:thingsboard/tbel.git</developerConnection>
     </scm>
     <issueManagement>
@@ -114,17 +114,57 @@
                 </configuration>
             </plugin>
 
+            <!--
+                Scoped deliberately to ThingsBoard-authored files only. The rest of this tree is
+                upstream MVEL (Apache-2.0) and vendored ASM (BSD-3), whose headers must be preserved
+                verbatim; an unscoped run of license:format would overwrite them.
+                Add new ThingsBoard-authored files to the include list below.
+            -->
             <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-jar-plugin</artifactId>
-                <version>3.3.0</version>
+                <groupId>com.mycila</groupId>
+                <artifactId>license-maven-plugin</artifactId>
+                <version>5.1.1</version>
+                <configuration>
+                    <licenseSets>
+                        <licenseSet>
+                            <header>${basedir}/apache-license-header-template.txt</header>
+                            <includes>
+                                <include>src/main/java/org/mvel2/ExecutionContext.java</include>
+                                <include>src/main/java/org/mvel2/SandboxedClassLoader.java</include>
+                                <include>src/main/java/org/mvel2/SandboxedParserConfiguration.java</include>
+                                <include>src/main/java/org/mvel2/ScriptExecutionStoppedException.java</include>
+                                <include>src/main/java/org/mvel2/ScriptMemoryOverflowException.java</include>
+                                <include>src/main/java/org/mvel2/ast/BreakNode.java</include>
+                                <include>src/main/java/org/mvel2/ast/HasStatement.java</include>
+                                <include>src/main/java/org/mvel2/ast/SwitchNode.java</include>
+                                <include>src/main/java/org/mvel2/execution/**</include>
+                                <include>src/main/java/org/mvel2/util/ArgsRepackUtil.java</include>
+                                <include>src/main/java/org/mvel2/util/TriFunction.java</include>
+                            </includes>
+                        </licenseSet>
+                    </licenseSets>
+                    <properties>
+                        <owner>ThingsBoard, Inc.</owner>
+                    </properties>
+                    <mapping>
+                        <java>JAVADOC_STYLE</java>
+                    </mapping>
+                </configuration>
                 <executions>
                     <execution>
+                        <id>check-license-headers</id>
+                        <phase>validate</phase>
                         <goals>
-                            <goal>test-jar</goal>
+                            <goal>check</goal>
                         </goals>
                     </execution>
                 </executions>
+            </plugin>
+
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-jar-plugin</artifactId>
+                <version>3.3.0</version>
                 <configuration>
                     <archive>
                         <manifestFile>META-INF/MANIFEST.MF</manifestFile>
@@ -143,7 +183,6 @@
                     <execution>
                         <goals>
                             <goal>jar</goal>
-                            <goal>test-jar</goal>
                         </goals>
                     </execution>
                 </executions>
@@ -160,10 +199,41 @@
                         </goals>
                     </execution>
                 </executions>
+                <!--
+                    maven-javadoc-plugin does not package project resources, so the licence texts are
+                    staged into the javadoc output directory by maven-resources-plugin below.
+                -->
                 <configuration>
                     <doclint>-accessibility,-missing</doclint>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-resources-plugin</artifactId>
+                <version>3.3.1</version>
+                <executions>
+                    <!-- Runs before javadoc:jar (package), so the texts are inside the javadoc jar too. -->
+                    <execution>
+                        <id>copy-licences-into-javadoc</id>
+                        <phase>prepare-package</phase>
+                        <goals>
+                            <goal>copy-resources</goal>
+                        </goals>
+                        <configuration>
+                            <outputDirectory>${project.build.directory}/apidocs/META-INF</outputDirectory>
+                            <resources>
+                                <resource>
+                                    <directory>${basedir}</directory>
+                                    <includes>
+                                        <include>LICENSE</include>
+                                        <include>ASM-LICENSE</include>
+                                    </includes>
+                                </resource>
+                            </resources>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
@@ -254,6 +324,14 @@
                     <include>build.properties</include>
                 </includes>
             </resource>
+            <resource>
+                <directory>${basedir}</directory>
+                <targetPath>META-INF</targetPath>
+                <includes>
+                    <include>LICENSE</include>
+                    <include>ASM-LICENSE</include>
+                </includes>
+            </resource>
             <resource>
               <directory>src/main/resources</directory>
             </resource>

src/main/java/org/mvel2/CompileException.java

@@ -16,6 +16,11 @@
  * limitations under the License.
  */
 
+/*
+ * SPDX-FileCopyrightText: Modifications Copyright (C) 2022-present ThingsBoard, Inc.
+ * This file has been modified from the original MVEL source.
+ * See the project's Git history for details of the changes.
+ */
 package org.mvel2;
 
 import org.mvel2.util.StringAppender;

src/main/java/org/mvel2/DataTypes.java

@@ -17,6 +17,11 @@
  */
 
 
+/*
+ * SPDX-FileCopyrightText: Modifications Copyright (C) 2022-present ThingsBoard, Inc.
+ * This file has been modified from the original MVEL source.
+ * See the project's Git history for details of the changes.
+ */
 package org.mvel2;
 
 

src/main/java/org/mvel2/ExecutionContext.java

@@ -1,3 +1,7 @@
+/**
+ * SPDX-FileCopyrightText: Copyright 2022 ThingsBoard, Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
 package org.mvel2;
 
 import org.mvel2.execution.ExecutionArrayList;

src/main/java/org/mvel2/MVEL.java

@@ -12,6 +12,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+/*
+ * SPDX-FileCopyrightText: Modifications Copyright (C) 2022-present ThingsBoard, Inc.
+ * This file has been modified from the original MVEL source.
+ * See the project's Git history for details of the changes.
+ */
 package org.mvel2;
 
 import java.io.File;

src/main/java/org/mvel2/MVELInterpretedRuntime.java

@@ -16,6 +16,11 @@
  * limitations under the License.
  */
 
+/*
+ * SPDX-FileCopyrightText: Modifications Copyright (C) 2022-present ThingsBoard, Inc.
+ * This file has been modified from the original MVEL source.
+ * See the project's Git history for details of the changes.
+ */
 package org.mvel2;
 
 import java.util.Map;

src/main/java/org/mvel2/MVELRuntime.java

@@ -16,6 +16,11 @@
  * limitations under the License.
  */
 
+/*
+ * SPDX-FileCopyrightText: Modifications Copyright (C) 2022-present ThingsBoard, Inc.
+ * This file has been modified from the original MVEL source.
+ * See the project's Git history for details of the changes.
+ */
 package org.mvel2;
 
 import org.mvel2.ast.ASTNode;

src/main/java/org/mvel2/Operator.java

@@ -15,6 +15,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+/*
+ * SPDX-FileCopyrightText: Modifications Copyright (C) 2022-present ThingsBoard, Inc.
+ * This file has been modified from the original MVEL source.
+ * See the project's Git history for details of the changes.
+ */
 package org.mvel2;
 
 /**

src/main/java/org/mvel2/ParserConfiguration.java

@@ -16,6 +16,11 @@
  * limitations under the License.
  */
 
+/*
+ * SPDX-FileCopyrightText: Modifications Copyright (C) 2022-present ThingsBoard, Inc.
+ * This file has been modified from the original MVEL source.
+ * See the project's Git history for details of the changes.
+ */
 package org.mvel2;
 
 import org.mvel2.ast.Proto;

src/main/java/org/mvel2/ParserContext.java

@@ -16,6 +16,11 @@
  * limitations under the License.
  */
 
+/*
+ * SPDX-FileCopyrightText: Modifications Copyright (C) 2022-present ThingsBoard, Inc.
+ * This file has been modified from the original MVEL source.
+ * See the project's Git history for details of the changes.
+ */
 package org.mvel2;
 
 import org.mvel2.ast.Function;

src/main/java/org/mvel2/PropertyAccessor.java

@@ -15,6 +15,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+/*
+ * SPDX-FileCopyrightText: Modifications Copyright (C) 2022-present ThingsBoard, Inc.
+ * This file has been modified from the original MVEL source.
+ * See the project's Git history for details of the changes.
+ */
 package org.mvel2;
 
 import org.mvel2.ast.*;

src/main/java/org/mvel2/SandboxedClassLoader.java

@@ -1,3 +1,7 @@
+/**
+ * SPDX-FileCopyrightText: Copyright 2022 ThingsBoard, Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
 package org.mvel2;
 
 import org.mvel2.compiler.AbstractParser;

src/main/java/org/mvel2/SandboxedParserConfiguration.java

@@ -1,3 +1,7 @@
+/**
+ * SPDX-FileCopyrightText: Copyright 2022 ThingsBoard, Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
 package org.mvel2;
 
 import org.mvel2.compiler.AbstractParser;

src/main/java/org/mvel2/ScriptExecutionStoppedException.java

@@ -1,3 +1,7 @@
+/**
+ * SPDX-FileCopyrightText: Copyright 2022 ThingsBoard, Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
 package org.mvel2;
 
 public class ScriptExecutionStoppedException extends ScriptRuntimeException {