[SiddharthMaheshB]

Summary (required):

MLCP builds did not produce an SBOM or a legal notice file in deliverable/. This adds both to the existing make_deliverable step, so mvn clean package -DskipTests=true produces them next to the zips. It also commits the Black Duck-generated SBOM (SBOM.spdx.json, 12.1.0). It affects the MLCP build and release artifacts.

Type of Change (required):

• New feature
• Bug fix
• Refactor / code improvement
• Library upgrade
• Test additions or updates
• Documentation updates
• Build / CI changes
• Product notice / release related
• Other (Please explain)

Approach / Implementation Notes (optional):

• In the make_deliverable antrun execution (package phase), after the zip copy, SBOM.spdx.json is copied to deliverable/mlcp-${project.version}.spdx.json. NOTICE.txt is copied to deliverable/Legal_Notice_File_for_Progress_MarkLogic_Content_Pump_${project.version}.txt.
• Both copies use overwrite="true" and no failonerror override, so a missing source fails the build. Ant chmod then sets mode 644 on both outputs.
• Names use ${project.version}, so they match the zips and pick up the dated version that the nightly sets with versions:set.
• SBOM.spdx.json must be committed in the repo root next to NOTICE.txt. This is why it is in the same commit.

Backward Incompatibility (optional):

None for users or the zip contents. The build now requires SBOM.spdx.json in the repo root and fails at the package step if it is missing.

Build Validation (required):

• make successful
• make checkin successful
• Not applicable (Please explain)

MLCP is built with Maven, not make. Validated with mvn clean package -DskipTests=true (JDK 11, Maven 3.9.12); see Manual validation below.

Tests Covered (required):

• Manual validation

  mvn clean package -DskipTests=true produced the two zips, mlcp-12.2.spdx.json and Legal_Notice_File_for_Progress_MarkLogic_Content_Pump_12.2.txt. Both new files are mode 644. cmp shows each output identical to its source, and python3 -m json.tool accepts the SBOM. mvn clean removes deliverable/. With the SBOM missing, the build fails with "Could not find file .../SBOM.spdx.json to copy".

• Existing regression suites

• New regression tests

• Not applicable (Please explain)

Additional Notes (optional):

• The committed SBOM is generated for 12.1.0. The develop build is 12.2, so the output is named mlcp-12.2.spdx.json.
• No performance impact is expected. Two small file copies are added to the package phase.

References (optional):

• MLE-32254, MLE-32257: Similar changes to XDMP and XCC make commands

[Copilot]

🟡 Changes recommended

Source-archive packaging lacks the newly required SBOM input, and the published inventory contains identities that do not match the build.

3 open issues

• Include SBOM.spdx.json in source distribution assembly · New
• Regenerate SBOM for current XCC and MLCP 12.2 artifacts · New
• Correct commons-logging-api package URL and component metadata · New

What changed in this PR

Adds SBOM and legal notice artifacts to MLCP’s existing Maven packaging step, placing them alongside the distribution ZIPs in deliverable/.

Changes:

• Commits a Black Duck-generated SPDX SBOM for MLCP 12.1.0.
• Copies the SBOM and existing notice to versioned output filenames and sets permissions to 644.
• Updates the project and shared XCC version properties to 12.2.

File	Description
SBOM.spdx.json	Adds the dependency and license inventory used for the SBOM deliverable.
pom.xml	Adds artifact copies and permissions; updates build version properties.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The packaging changes include the required source-distribution update, and no new blocking issues remain.

1 open issue

• Correct commons-logging-api package URL and component metadata

2 resolved since last review

• Include SBOM.spdx.json in source distribution assembly
• Regenerate SBOM for current XCC and MLCP 12.2 artifacts

_{Review effort: Balanced}

[SameeraPriyathamTadikonda]

Overall this looks good. Please address the inline comment requesting removal of SBOM.spdx.json from the generated source ZIP; the standalone sidecar can remain.

[SameeraPriyathamTadikonda]

@SiddharthMaheshB I assigned copilot to fix copyright errors, but it seems wrong. Can you please update the files accordingly

[SiddharthMaheshB]

@SiddharthMaheshB I assigned copilot to fix copyright errors, but it seems wrong. Can you please update the files accordingly

Fixed in force push.

[SameeraPriyathamTadikonda]

Please check inline comments