The following Apache XML Security files in the JDK source (used by JSR 105/XMLDSig) have
a Sun GPL+classpath copyright but do not have Apache copyrights:

src/share/classes/com/sun/org/apache/xml/internal/security/resource/config.dtd
src/share/classes/com/sun/org/apache/xml/internal/security/resource/config.xml

The following files have neither a Sun GPL copyright nor an Apache copyright (they have
no copyrights):

src/share/classes/com/sun/org/apache/xml/internal/security/resource/log4j.properties
src/share/classes/com/sun/org/apache/xml/internal/security/resource/package.html
src/share/classes/com/sun/org/apache/xml/internal/security/resource/xmlsecurity_de.properties
src/share/classes/com/sun/org/apache/xml/internal/security/resource/xmlsecurity_en.properties

as well as other package.html files scattered throughout the src/share/classes/com/sun/org/apache/xml/internal/security tree.

These files are from Apache. But they do not have Apache copyrights. I am not sure why,
but it may just be an oversight. But now they have no copyrights or only have a Sun
GPL copyright which may be wrong.
The following additional Apache xml security files may have copyright issues.

These files have a Sun GPL+Classpath copyright and NO Apache copyright:

src/share/classes/com/sun/org/apache/xml/internal/security/resource/schema/etsi.xsd
src/share/classes/com/sun/org/apache/xml/internal/security/resource/schema/xenc-schema.xsd

These files have neither a Sun GPL copyright nor an Apache copyright (it has no copyrights):

src/share/classes/com/sun/org/apache/xml/internal/security/resource/schema/xenc-schema.rng
src/share/classes/com/sun/org/apache/xml/internal/security/resource/schema/xmldsig-core-schema.rng

These files have a W3C copyright:

src/share/classes/com/sun/org/apache/xml/internal/security/resource/schema/xmldsig-core-schema.dtd
src/share/classes/com/sun/org/apache/xml/internal/security/resource/schema/xmldsig-core-schema.xsd