fix [Bug]: gremlin-console.sh fails on Mac M4 (Apple Silicon)#3031

[vaijosh]

What I changed

• Added runtime dependency org.fusesource.jansi:jansi:2.4.0 in hugegraph-server/hugegraph-dist/pom.xml.
• Updated release docs:
  • install-dist/release-docs/LICENSE
  • install-dist/release-docs/NOTICE
  • install-dist/release-docs/licenses/LICENSE-jansi-2.4.0.txt

Validation performed

 ✘ vjoshi@DNWW7WJ4LJ  ~/SourceCode/HUGEGRAPH/hugegraph   3031-AppleSiliconFix  export RUNNER_TEMP="$(mktemp -d)"     
VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
SERVER_DIR="hugegraph-server/apache-hugegraph-server-${VERSION}"
printf "println \"gremlin-console-smoke-ok\"\n" > "$RUNNER_TEMP/gremlin-console-smoke.groovy"
"${SERVER_DIR}/bin/gremlin-console.sh" -- -e "$RUNNER_TEMP/gremlin-console-smoke.groovy"

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.codehaus.groovy.reflection.CachedClass (file:/Users/vjoshi/SourceCode/HUGEGRAPH/hugegraph/hugegraph-server/apache-hugegraph-server-1.7.0/lib/groovy-2.5.14-indy.jar) to method java.lang.Object.finalize()
WARNING: Please consider reporting this to the maintainers of org.codehaus.groovy.reflection.CachedClass
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
gremlin-console-smoke-ok

Manually checked if we can launch gremlin console.

[imbajin]

Blocking: yes. Summary: the new packaged dependency is missing required release/dependency inventory updates and a distro regression guard. Evidence: dependency-check reports +jansi-2.4.0.jar, dependency:tree shows the new runtime jar, and the added license file is only a short summary.

---

🔗 Please also check the latest failed dependency-check job: https://github.com/apache/hugegraph/actions/runs/26973199772/job/79593480638

[imbajin]

‼️ Update the known dependency inventory

Evidence: this PR adds org.fusesource.jansi:jansi:2.4.0, and the dependency-check job diffs the generated inventory with install-dist/scripts/dependency/known-dependencies.txt; the failed job shows +jansi-2.4.0.jar, while the tracked file has no such entry.

Impact: the release dependency gate will keep failing for this PR, and the newly bundled jar is not recorded in the deterministic dependency inventory.

Requested fix: regenerate and commit install-dist/scripts/dependency/known-dependencies.txt, or add the missing jansi-2.4.0.jar entry in the correct sorted position.

[imbajin]

‼️ Vendor the full license text

Evidence: this new file is a 16-line summary with URLs, but the surrounding install-dist/release-docs/licenses/LICENSE-*.txt files vendor complete upstream license texts. The new LICENSE entry also points readers here for license details, which this summary does not provide.

Impact: the release docs for the newly bundled jar are incomplete, which is an ASF release/legal risk even if the runtime dependency is correct.

Requested fix: replace this file with the full upstream license text for the license option HugeGraph is relying on for distribution, and align the LICENSE/NOTICE wording with that choice.

[imbajin]

⚠️ Add a distro regression check

Evidence: the fix is purely in distro packaging, so the normal unit/core/api suites do not exercise the gremlin-console.sh classpath. I could not find an automated check that launches the packaged console or at least asserts the tarball contains lib/jansi-*.jar.

Impact: this exact classpath regression can silently return after a dependency or assembly change and only be caught by users starting the packaged console.

Requested fix: add a distro-level smoke check, for example launching bin/gremlin-console.sh -- -e <script> from the assembled server, or at minimum asserting the packaged archive contains the Jansi jar.