Fix license accuracy issues found during review - #1

Evidence for each fix

These are the issues found during review of apache#15449, with evidence for each change made in this PR. This review was generated from a discussion with Cursor and claude-4.6-opus-high.

1. Reactive Streams: license label MIT → MIT-0

Files changed: aws-bundle/LICENSE, azure-bundle/LICENSE, kafka-connect/.../main/LICENSE, kafka-connect/.../hive/LICENSE

The inlined text correctly says "MIT No Attribution", but the label said License: MIT. These are distinct SPDX identifiers:

• MIT (SPDX) requires: "The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software."
• MIT-0 (SPDX) omits that clause entirely — recipients have no attribution obligation.

The Reactive Streams project LICENSE file confirms MIT-0:
https://github.com/reactive-streams/reactive-streams-jvm/blob/master/LICENSE

MIT No Attribution

Copyright 2014 Reactive Streams

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software ... to deal in the Software without restriction ...
and to permit persons to whom the Software is furnished to do so.

Note the absence of any "include this notice" requirement — that is what makes it MIT-0, not MIT.

2. Findbugs jsr305: Apache 2.0 → BSD 3-Clause with inline text

Files changed: gcp-bundle/LICENSE, kafka-connect/.../main/LICENSE, kafka-connect/.../hive/LICENSE

The FindBugs project explicitly distributes jsr305 under the New BSD (BSD-3-Clause) license.

From the project's own license file at https://github.com/findbugsproject/findbugs/blob/master/findbugs/licenses/LICENSE-jsr305.txt:

The JSR-305 reference implementation (lib/jsr305.jar) is
distributed under the terms of the New BSD license:

  https://opensource.org/license/bsd-3-clause

The Apache 2.0 attribution comes from Maven POM metadata (com.google.code.findbugs:jsr305), which has historically misreported the license. The actual artifact is BSD-3-Clause.

Consistent with the PR's own approach for other BSD-licensed dependencies (e.g. Google protobuf, Stax2 API, ThreeTen), the BSD-3-Clause text is now included inline.

3. Google API Common / GAX / Auth Library: consistent BSD 3-Clause across bundles

Files changed: kafka-connect/.../main/LICENSE, kafka-connect/.../hive/LICENSE

These libraries are dual-licensed (Apache-2.0 + BSD-3-Clause). The gcp-bundle/LICENSE already correctly uses BSD 3-Clause with inline text, matching the actual repo LICENSE files:

• https://github.com/googleapis/api-common-java/blob/main/LICENSE → BSD 3-Clause
• https://github.com/googleapis/gax-java/blob/main/LICENSE → BSD 3-Clause
• https://github.com/googleapis/google-auth-library-java/blob/main/LICENSE → BSD 3-Clause

But the kafka-connect bundles listed them as Apache 2.0. Changed to BSD 3-Clause with inline text for consistency with gcp-bundle and the actual project LICENSE files.

4. Jackson: dead jackson.codehaus.org URL → github.com/FasterXML/jackson

Files changed: aws-bundle/LICENSE, flink/v{1.20,2.0,2.1}/flink-runtime/LICENSE

The URL http://jackson.codehaus.org/ has been dead since ~2013 when the Jackson project migrated from Codehaus to GitHub under the FasterXML organization.

Other bundles in the same PR already used the correct URL:

• azure-bundle/LICENSE → http://github.com/FasterXML/jackson
• gcp-bundle/LICENSE → https://github.com/FasterXML/jackson

The canonical project page is: https://github.com/FasterXML/jackson

5. Typo: "Caffeine bt Ben Manes" → "Caffeine by Ben Manes"

File changed: kafka-connect/.../main/LICENSE

Missing 'y' — "bt" should be "by". Other bundles spell it correctly, e.g. flink/v2.1/flink-runtime/LICENSE and kafka-connect/.../hive/LICENSE both say "Caffeine by Ben Manes".

6. Typo: "prodduct" → "product"

Files changed: flink/v{1.20,2.0,2.1}/flink-runtime/LICENSE

Double-'d'. Every other entry in every file uses the correct spelling "product".

7. Typo: "produt" → "product"

File changed: kafka-connect/.../hive/LICENSE

Missing 'c'. Every other entry in the file uses the correct spelling "product".

8. Empty section removed in azure-bundle

File changed: azure-bundle/LICENSE

Two consecutive separator lines with only a blank line between them and no dependency entry. Every other section in the file has content between separators. This was an editing artifact where a dependency was removed but the extra separator was left behind.

9. Duplicate "Animal Sniffer Annotations" entry removed

Files changed: flink/v{2.0,2.1}/flink-runtime/LICENSE

A stray "This product bundles Animal Sniffer Annotations." line appeared between the JSpecify entry and the separator, with no license information. The real Animal Sniffer entry followed after the separator with the MIT license text. The stray line was removed.