cert-manager.yaml: upstream copyright header replaced with ASF header, and not in LICENSE #263

The 0.9.0-incubating-RC7 source release (apache-openserverless-0.9.0-incubating-src.tar.gz) ships a vendored copy of the cert-manager installation manifest whose upstream copyright notice has been replaced with the ASF header, and which is not attributed in LICENSE or NOTICE.

The file

oplugins-op/deploy/cert-manager/cert-manager.yaml (5,520 lines, from the openserverless-operator submodule) is the cert-manager v1.10.1 release manifest. Compared with the release asset, the body is identical (apart from one blank line changed to ---); only the header differs.

Upstream header:

# Copyright 2022 The cert-manager Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# ...

Shipped header:

#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# ...

The file has been in the operator repo since its first commit (da9cf86). It is still used: openserverless/certmanager.py applies it, the operator Dockerfile copies deploy/cert-manager into the image, and clusters/eks.yml and clusters/lks.yml apply it.

Why it matters

• cert-manager is Apache-2.0, so there is no licence conflict, but §4(c) of the Apache License requires retaining the copyright notices of the source: removing Copyright 2022 The cert-manager Authors. is not allowed.
• ASF policy is not to put the ASF header on third-party files: https://www.apache.org/legal/src-headers.html#3party
• Neither the top-level LICENSE/NOTICE nor oplugins-op/LICENSE/NOTICE mention cert-manager.

Suggested fix

Either:

1. Stop vendoring it. oplugins/util/opsfile.yml already downloads cert-manager from the upstream release at install time (CERTMANAGER: https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml), as does clusters/k3s.yml. The operator could do the same (or fetch it at image build time), and deploy/cert-manager/cert-manager.yaml could be deleted from the source tree. This fits the planned clean-up of vendored dependencies.

2. Or keep it and fix the attribution:

   • restore the upstream # Copyright 2022 The cert-manager Authors. header and remove the ASF header;

   • exclude the file in .licenserc.yaml / .rat-excludes so the header checks do not add the ASF header back;

   • add an entry to the top-level LICENSE (and oplugins-op/LICENSE), e.g.:

     cert-manager
       The file oplugins-op/deploy/cert-manager/cert-manager.yaml is the
       cert-manager v1.10.1 installation manifest.
       Licensed under the Apache License, Version 2.0.
       Copyright 2022 The cert-manager Authors.
     

This was first reported in #250 (while verifying RC5), where 5 copies existed; the 4 under oplugins/ have since been removed (c6482cc), leaving this one. Related: #260.