I looked for licenses/notice/crypto stuff in the Jar by unzipping it, and looking at the top level and within META-INF directory for LICENSE*, NOTICE*, README* (anycase).
On another note - another RAT check might be also to check that the Jars that your project is building have LICENSE/NOTICE files in one of these spots. I'm not sure about the need to check Jars you're depending on but not building for the existence of LICENSE/NOTICE files. One more complication: some builds create OSGi bundles which are a kind of Jar file. One style of packaging for these bundles includes within the outer Jar (bundle), a directory (typically called lib/ but could be called anything), which contains Jar files. For this, the outer Jar file ought to have LICENSE/NOTICE/crypto stuff which includes the amalgamation of all the Jars contained within. -Marshall On 8/15/2011 1:08 AM, Stefan Bodewig wrote: > On 2011-08-15, Marshall Schor wrote: > >> yes, it's entirely manual at the moment. > OK, thanks. > > Can you describe what you've done, where you've looked for licenses, > notices, cryprto notices et al? META-INF or in other places as well? > > Stefan >
