Source release: ship only the top-level LICENSE and NOTICE, not the subdirectory copies #268

The 0.9.0-incubating-RC7 source release (apache-openserverless-0.9.0-incubating-src.tar.gz) contains the top-level LICENSE, NOTICE and DISCLAIMER, plus 85 more LICENSE/NOTICE/DISCLAIMER files in subdirectories. They come from the submodules and from each runtime image directory:

• one set per submodule: admin-api/, build/, cli/, devcontainer/, oplugins/, oplugins-op/, runtimes/, streamer/, testing/;
• one set per runtime image: runtimes/runtime/{go,java,nodejs,python}/*/ and runtimes/experimental/*/;
• build/openwhisk/LICENSE.txt, NOTICE.txt and licenses/LICENSE-spray.txt (from the vendored OpenWhisk sources);
• cli/tests/oplugins/LICENSE (test data).

Together they run to about 94,000 lines (runtimes/LICENSE alone is 37,204 lines).

Please ship only the top-level LICENSE and NOTICE in the source release, and leave the subdirectory ones out (e.g. via no-release.txt).

Why

For the source release, the top-level LICENSE and NOTICE are the ones that count. The subdirectory files mostly describe something else: the container images built from each directory, which bundle OS packages, language runtimes and dependencies that are not in the source release. Shipping them in the source tarball is confusing for users and reviewers, who cannot tell which file applies to what. It also means the same facts are maintained in many places, and they have already drifted apart. In RC7:

• oplugins/LICENSE and oplugins-op/LICENSE state that the source distribution "is licensed in its entirety under the Apache License, Version 2.0". The top-level LICENSE correctly lists MIT, ISC and BSD-3-Clause code in the source (the pre-built JavaScript bundles), and there is more that is not yet listed (Third-party files missing from LICENSE and carrying ASF headers #260).
• 20 of the subdirectory LICENSE/NOTICE files refer readers to a WARN file, but no-release.txt removes every WARN file from the source release.
• 19 of the subdirectory NOTICE files say Copyright 2024 The Apache Software Foundation; the top-level NOTICE and 8 others say Copyright 2024-2026.
• oplugins-op/LICENSE says the operator bundles gradlew/gradlew.bat and ConcurrentMapBackedCache.scala; neither exists under oplugins-op/.
• Third-party content that should be attributed (cert-manager cert-manager.yaml: upstream copyright header replaced with ASF header, and not in LICENSE #263, Kvrocks Apache Kvrocks kvrocks.conf is bundled but not attributed in LICENSE/NOTICE #262, Milvus Third-party files missing from LICENSE and carrying ASF headers #260) is missing from the subdirectory files as well as the top-level ones. So there are two places to fix instead of one, and no place that is complete.

With only the top-level files, there is one place to review and keep correct for each release.

Things to handle

1. Image builds use these files. 26 Dockerfiles COPY their directory's DISCLAIMER LICENSE NOTICE into the image (e.g. oplugins-op/Dockerfile:152, streamer/Dockerfile:30, admin-api/Dockerfile:47, every runtimes/runtime/*/*/Dockerfile, build/standalone/Dockerfile:47). The images do need their own LICENSE/NOTICE (as convenience binaries), so dropping the files from the source tarball needs one of:
   • generate the image LICENSE/NOTICE at image build time (they are largely derived from the image contents anyway); or
   • keep them in git but outside the source release, and have the image build (CI) supply them; or
   • if they must stay in the source tree, rename them (e.g. LICENSE-image, NOTICE-image) and add a first line saying they describe the container image, not the source, so they are not mistaken for the source release's licensing.
2. The top-level LICENSE points at build/openwhisk/licenses/LICENSE-spray.txt. Either keep that one file, or inline the Spray licence text in the top-level LICENSE. The Spray licence is Apache-2.0, already reproduced there.
3. build/openwhisk/LICENSE.txt / NOTICE.txt are the vendored OpenWhisk project's own files. The top-level NOTICE already carries the OpenWhisk attribution, so they can go too.
4. Optional: the same applies to the 27 subdirectory DISCLAIMER files, which duplicate the top-level DISCLAIMER.

Related: #260, #262, #263, #267.