Hello guys, let's continue the tradition of manual inspection of nb-javac sources[1][2].
NetBeans project downloads both nb-javac JAR files from Maven central - the standard Java way of distributing, using and archiving Java libraries/ artifacts. Essential part of that system is `pom.xml` file with a mandatory `<license>` element. In case of nb-javac@16.0.0.0 it says: https://search.maven.org/artifact/com.dukescript.nbjavac/nb-javac/16.0.0.0/jar "Licenses: GPLv2-CPE". As that license comes directly from the Oracle's nb- javac project: https://github.com/oracle/nb-javac/blob/release124/make/langtools/netbeans/nb-javac/pom-nb-javac.xml#L18 and the intention of that element is to state the license of the uploaded Maven central artifacts, it is natural for a Java developer to conclude that "nb-javac (as uploaded to Maven central) is fully licensed under GPLv2-CPE". In addition to the above evidence, let's do a manual verification: ```bash $ wget https://repo1.maven.org/maven2/com/dukescript/nbjavac/nb-javac/ 16.0.0.0/nb-javac-16.0.0.0-sources.jar $ unzip nb-javac-16.0.0.0-sources.jar $ rm nb-javac-16.0.0.0-sources.jar ``` now one can build the two nb-javac JARs successfully with: ```bash $ JAVA_HOME=/jdk-8/ ant -f ./make/langtools/netbeans/nb-javac/build.xml ``` but let's rather inspect the sources: ```bash $ grep -r "GNU General Public License" . -l | wc -l 747 $ grep -r "GNU General Public License" . -l | while read X; do grep Classpath.*exception "$X" || echo Missing $X; done | grep Missing Missing ./LICENSE.txt Missing ./src/jdk.jdeps/share/man/jdeprscan.1 Missing ./src/jdk.jdeps/share/man/jdeps.1 Missing ./src/jdk.jdeps/share/man/javap.1 Missing ./src/jdk.compiler/share/man/serialver.1 Missing ./src/jdk.compiler/share/man/javac.1 ``` e.g. there is 747 files that contain "GPL" header and all of them but license and manual pages (not used in the nb-javac JARs) contain the "Classpath exception" header. The manual inspection confirms that Maven central licensing information at https://search.maven.org/artifact/com.dukescript.nbjavac/nb-javac/16.0.0.0/jar is correct and both nb-javac@16.0.0.0 binary JAR files are covered by GPLv2-CPE license. Thanks in advance for checking my conclusion. -jt [1] https://lists.apache.org/thread.html/ r821d9e9fdc8d9fd5663e7c326d25e4626e1a27eb13e45f4d639ea199%40%3Cdev.netbeans.apache.org%3E [2] https://lists.apache.org/thread.html/ rb5d091662f88dafb2fd878a0acc5e5bdb80ddfb17b47bfbff248b4d7%40%3Cdev.netbeans.apache.org%3E --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@netbeans.apache.org For additional commands, e-mail: dev-h...@netbeans.apache.org For further information about the NetBeans mailing lists, visit: https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
