[SiddharthMaheshB]

Summary (required):

MLCP builds did not produce an SBOM or a legal notice file in deliverable/. This adds both to the existing make_deliverable step, so mvn clean package -DskipTests=true produces them next to the zips. It also commits the Black Duck-generated SBOM (SBOM.spdx.json, 12.1.0). It affects the MLCP build and release artifacts.

Type of Change (required):

• New feature
• Bug fix
• Refactor / code improvement
• Library upgrade
• Test additions or updates
• Documentation updates
• Build / CI changes
• Product notice / release related
• Other (Please explain)

Approach / Implementation Notes (optional):

• In the make_deliverable antrun execution (package phase), after the zip copy, SBOM.spdx.json is copied to deliverable/mlcp-${project.version}.spdx.json. NOTICE.txt is copied to deliverable/Legal_Notice_File_for_Progress_MarkLogic_Content_Pump_${project.version}.txt.
• Both copies use overwrite="true" and no failonerror override, so a missing source fails the build. Ant chmod then sets mode 644 on both outputs.
• Names use ${project.version}, so they match the zips and pick up the dated version that the nightly sets with versions:set.
• SBOM.spdx.json must be committed in the repo root next to NOTICE.txt. This is why it is in the same commit.

Backward Incompatibility (optional):

None for users or the zip contents. The build now requires SBOM.spdx.json in the repo root and fails at the package step if it is missing.

Build Validation (required):

• make successful
• make checkin successful
• Not applicable (Please explain)

MLCP is built with Maven, not make. Validated with mvn clean package -DskipTests=true (JDK 11, Maven 3.9.12); see Manual validation below.

Tests Covered (required):

• Manual validation

  mvn clean package -DskipTests=true produced the two zips, mlcp-12.2.spdx.json and Legal_Notice_File_for_Progress_MarkLogic_Content_Pump_12.2.txt. Both new files are mode 644. cmp shows each output identical to its source, and python3 -m json.tool accepts the SBOM. mvn clean removes deliverable/. With the SBOM missing, the build fails with "Could not find file .../SBOM.spdx.json to copy".

• Existing regression suites

• New regression tests

• Not applicable (Please explain)

Additional Notes (optional):

• The committed SBOM is generated for 12.1.0. The develop build is 12.2, so the output is named mlcp-12.2.spdx.json.
• No performance impact is expected. Two small file copies are added to the package phase.

References (optional):

• MLE-32254, MLE-32257: Similar changes to XDMP and XCC make commands

[Copilot]

🟡 Changes recommended

Source-archive packaging lacks the newly required SBOM input, and the published inventory contains identities that do not match the build.

3 open issues

• Include SBOM.spdx.json in source distribution assembly · New
• Regenerate SBOM for current XCC and MLCP 12.2 artifacts · New
• Correct commons-logging-api package URL and component metadata · New

What changed in this PR

Adds SBOM and legal notice artifacts to MLCP’s existing Maven packaging step, placing them alongside the distribution ZIPs in deliverable/.

Changes:

• Commits a Black Duck-generated SPDX SBOM for MLCP 12.1.0.
• Copies the SBOM and existing notice to versioned output filenames and sets permissions to 644.
• Updates the project and shared XCC version properties to 12.2.

File	Description
SBOM.spdx.json	Adds the dependency and license inventory used for the SBOM deliverable.
pom.xml	Adds artifact copies and permissions; updates build version properties.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The packaging changes include the required source-distribution update, and no new blocking issues remain.

1 open issue

• Correct commons-logging-api package URL and component metadata

2 resolved since last review

• Include SBOM.spdx.json in source distribution assembly
• Regenerate SBOM for current XCC and MLCP 12.2 artifacts

_{Review effort: Balanced}

[SameeraPriyathamTadikonda]

Please keep SBOM.spdx.json out of generated ZIP/JARs. This assembly entry puts it in the source ZIP; please remove this <file> entry. The standalone SBOM sidecar in deliverable/ can remain.

[SiddharthMaheshB]

Doing this would keep the SBOM out of the source ZIP, and since the mvn package command requires the SBOM file going forward, we will not be able to build the code from the source ZIP anymore. Is that fine?

[SiddharthMaheshB]

Addressed in force push

[SameeraPriyathamTadikonda]

Overall this looks good. Please address the inline comment requesting removal of SBOM.spdx.json from the generated source ZIP; the standalone sidecar can remain.

[SameeraPriyathamTadikonda]

Because the source ZIP now omits SBOM.spdx.json, a build from that archive reaches this copy with no source file and fails (<copy> fails on a missing source by default). Please make this SBOM sidecar copy conditional for source-archive builds, or otherwise preserve that build path while keeping the SBOM out of the ZIP.