I got another look at this, and maybe it isn't as bad as we thought. The piccolo jars in external/lib/ do not contain compiled .class files, but only .java source files. The xmlbeans build unpacks them to build/private/piccolo/src, changes the package to org.apache.xmlbeans.impl.piccolo, and then compiles them.
There are still a few jar files with compiled classes (junit, saxon, jsr173, oldxbean) but they aren't used to build the package. So this is more a matter of cleaning the upstream tarball of unnecessary files than fixing a severe policy violation. Emmanuel Bourg
