The contents of the .csar file itself should not be modified, 

So the easiest approach is probably to include a reference in the top-level LICENSE.txt file for the repository. Something like, "All .csar files in this repository are also provided under Apache-2.0."