On Sat, May 15, 2010 at 4:56 PM, Benson Margulies <bimargul...@gmail.com> wrote: > I think that perhaps there's an important distinction being missed > here. Central doesn't vacuum up artifacts from unsuspecting authors. > Other people put them there. If the authors of code choose to deposit > jar files on central, then it's not central who is 'distributing' them > -- it's the authors. In this case, it's people who download from > central and then repackage on their own who are responsible for > worrying about tracking down and including licenses. > > The tricky case here is the non-author publishers, as with the > recently-announced mechanism. If I take a jar of OSS from its author's > distro, and push it to central without a license file, I am probably > violating the license. It's not clear to me that Sonatype is. > > Thus, what I take from this thread is that it would be a kindness for > Sonatype to add a feature to the new publication mechanism to upload > the actual license. It could then be added to META-INF or just > published as an accompanying artifact, either way, and then no one > would have anything to complain about. >
Yes, these are good ideas. We currently require that the license be specified in the pom but aren't validating that it is correct automatically. The vast majority of artifacts in Central come in over wide open rsyncs so garbage in the source repo = garbage in central. This gaping hole is slowly being closed by requiring projects to go through forges that have the proper validation procedures before getting into Central. What I meant by usually was that if someone wants to include the license text, it's done inside the archives. Take a look at any recent apache jar for example and you'll find LICENSE and NOTICE prominently included. Requiring this of all artifacts is probably a good idea. > It might be worth doing this just to avoid those voices in the wide > world who like to write alarmist postings about Maven distribution > (e.g. Saxon's author). > > --------------------------------------------------------------------- > To unsubscribe, e-mail: users-unsubscr...@maven.apache.org > For additional commands, e-mail: users-h...@maven.apache.org > > --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@maven.apache.org For additional commands, e-mail: users-h...@maven.apache.org
