it is bad, because it doesn’t mention about Saxon
It's an unauthorised copy, and it's also bad because
(a) whoever put it there didn't read the license conditions, which
say that when you distribute the JAR file, you also have to
distribute various notices acknowledging third-party components.
We're still working out how best to do that.
(b) whoever put it there didn't accept that there was a
responsibility to keep it up to date.