AspectJ Weaver published license clashes with license notice in source code

Question

I am using AspectJ Weaver 1.9.9.1 in a project. Regarding to https://mvnrepository.com/artifact/org.aspectj/aspectjweaver it is published under EPL 2.0, but when scanning the sources I found org\aspectj\apache\bcel\Constants.java which says:

/* ====================================================================
 * The Apache Software License, Version 1.1
 [...]
public interface Constants {

As the file Constants.java is part of AspectJ Weaver and not an external dependency, I wonder which of the two license notices is true.

Is the license a library published under the single point of truth for the complete library content, or can each file define its own license? So in consequence: Do I have to scan all the source code for license notices?

Answer 1

Files under the Apache Software License 1.1 are indeed compatible within projects under EPL 2.0. The Apache 1.1 license is rarely used nowadays, Version 2.0 is much more common.

Software packages can include other files which they imported from 3rd party projects. They can directly use (=copy) these files, it is not necessary to create a dependency. In the Maven Repository this is very often not declared, and it is not even mentioned in the AspectJ Weaver license file in the source code. I found a few files like this in the source code, they include the license language and copyright attribution in line with the requirements of the Apache 1.1 license. While this is completely legal, it is not fine and easy to manage for developers.

To create the LICENSES and NOTICES files for your entire project it is best practice to use a scanning tool for the entire source code such as FOSSology or the like. This will help you identify such "hidden treasures" in your source.