Dockerfile

@@ -10,6 +10,7 @@ RUN apt-get update \
 
 WORKDIR /app
 COPY --chown=qqq:qqq qqq-all-app/target/qqq-all-app.jar /app/qqq-all.jar
+COPY --chown=qqq:qqq LICENSE NOTICE /app/
 USER 10001:10001
 EXPOSE 8080
 ENV QQQ_ALL_DATA_DIR=/app/data

README.md

@@ -46,3 +46,8 @@ The [4.1.0 release procedure](docs/release.md) describes the separate Maven pare
 ## Contributing and license
 
 See [CONTRIBUTING.md](CONTRIBUTING.md), the [Code of Conduct](CODE_OF_CONDUCT.md), and the [security policy](SECURITY.md). Licensed under Apache-2.0; see [LICENSE](LICENSE) and [NOTICE](NOTICE).
+
+The application JAR includes exact copies of these project documents under
+`META-INF/qqq-all/`, separate from dependency notices. The container also includes
+them at `/app/LICENSE` and `/app/NOTICE`. `PackagedNoticesIT` checks the shaded JAR's
+project documents against the root files during the existing `mvn verify` lifecycle.

qqq-all-app/pom.xml

@@ -60,6 +60,20 @@
 
    <build>
       <finalName>qqq-all-app</finalName>
+      <resources>
+         <resource>
+            <directory>src/main/resources</directory>
+         </resource>
+         <resource>
+            <directory>${project.basedir}/..</directory>
+            <targetPath>META-INF/qqq-all</targetPath>
+            <filtering>false</filtering>
+            <includes>
+               <include>LICENSE</include>
+               <include>NOTICE</include>
+            </includes>
+         </resource>
+      </resources>
       <plugins>
          <plugin>
             <groupId>org.apache.maven.plugins</groupId>
@@ -93,6 +107,7 @@
             <configuration>
                <systemPropertyVariables>
                   <qqqAllJar>${project.build.directory}/${project.build.finalName}.jar</qqqAllJar>
+                  <qqqAllRoot>${project.basedir}/..</qqqAllRoot>
                </systemPropertyVariables>
             </configuration>
             <executions>

qqq-all-app/src/test/java/com/kingsrook/qqq/all/PackagedNoticesIT.java

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at https://www.apache.org/licenses/LICENSE-2.0
+ */
+package com.kingsrook.qqq.all;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.jar.JarFile;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+/** Verifies this project's notices in the actual shaded application archive. */
+class PackagedNoticesIT
+{
+   @ParameterizedTest
+   @ValueSource(strings = {"LICENSE", "NOTICE"})
+   void packagedProjectDocumentMatchesRoot(String document) throws Exception
+   {
+      Path rootDocument = Path.of(System.getProperty("qqqAllRoot"), document);
+      try(JarFile jar = new JarFile(System.getProperty("qqqAllJar")))
+      {
+         String name = "META-INF/qqq-all/" + document;
+         var entry = jar.getJarEntry(name);
+         assertNotNull(entry, "Missing project document: " + name);
+         assertEquals(1L, jar.stream().filter(candidate -> candidate.getName().equals(name)).count(),
+            "Project document must occur exactly once: " + name);
+         try(var input = jar.getInputStream(entry))
+         {
+            assertArrayEquals(Files.readAllBytes(rootDocument), input.readAllBytes(),
+               "Packaged document must preserve root bytes: " + document);
+         }
+      }
+   }
+}