I had the same problem with this commit, but I remember that Robert said, there was actually a problem with RAT running from <ivy:cachepath/>. I would also really prefer to have this one only in cache, as we dont ship with this tool, so we dont have to take care of license,... We use all tasks from cachepatch (pegdown for converting markdown->HTML, cpptasks,...).
Side note: I am thinking about adding clover, too. The required license file can be shipped together with our src package in the tools directory (Atlassian allowed this to the ASF, because the license only allows to check org.apache.* packages) and clover-2.6.1.jar can be downloaded via Ivy.