You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@maven.apache.org by Florent Biville <fl...@gmail.com> on 2024/02/29 12:30:31 UTC
Publishing to Maven Central and non-OSS plugin dependencies
Hello,
I'm working on an open-source project that we want to release to Maven
Central in the coming weeks.
The project currently includes a plugin dependency that is NOT open-source
(nor in a public GitHub repository). Is that a blocker for releases to
Maven Central? I know it would be for regular dependencies and plugins, but
I'm not 100% sure about plugin dependencies in particular (although I would
guess it's the same).
Any input would be appreciated,
Best regards,
Florent
Re: Publishing to Maven Central and non-OSS plugin dependencies
Posted by Tomo Suzuki <su...@google.com.INVALID>.
(I’m just a Maven user)
It seems that, for consuming the artifact, the closed-source plugin seems
not a dependency. I believe it just works fine. Your company’s support team
might get questions like “I tried to build your library myself but the
build failed.”
Maven has a capability to replace pom.xml content when packaging a project.
The flatten Maven plugin uses it
https://www.mojohaus.org/flatten-maven-plugin/
.
Regards,
Tomo
On Thu, Feb 29, 2024 at 07:40 Florent Biville <fl...@gmail.com>
wrote:
> Yes, to clarify, our project has something like this:
>
> <plugin>
> <groupId>com.acme.plugin</groupId>
> <artifactId>plugin</artifactId><!-- <- this is already on maven
> central -->
> <version>4.2.42</version>
> <dependencies>
> <dependency>
> <groupId>com.acme.plugin</groupId>
> <artifactId>plugin-dep</artifactId><!-- <- this is NOT OSS -->
> <version>42.4.2</version>
> </dependency>
> </dependencies>
> </plugin>
>
>
> On Thu, Feb 29, 2024 at 1:33 PM Tamás Cservenák <ta...@cservenak.net>
> wrote:
>
> > Howdy,
> >
> > You would need to ask Sonatype about that, and check here:
> > https://central.sonatype.org/publish/requirements/
> >
> > IMHO best to ask them about it: IIUC you want to deploy artifacts to
> > central that has dependencies not available from Central
> > (nor any other public repository?)
> >
> > Thanks
> > T
> >
> >
> >
> > On Thu, Feb 29, 2024 at 1:31 PM Florent Biville <
> florent.biville@gmail.com
> > >
> > wrote:
> >
> > > Hello,
> > >
> > > I'm working on an open-source project that we want to release to Maven
> > > Central in the coming weeks.
> > >
> > > The project currently includes a plugin dependency that is NOT
> > open-source
> > > (nor in a public GitHub repository). Is that a blocker for releases to
> > > Maven Central? I know it would be for regular dependencies and plugins,
> > but
> > > I'm not 100% sure about plugin dependencies in particular (although I
> > would
> > > guess it's the same).
> > >
> > > Any input would be appreciated,
> > >
> > > Best regards,
> > > Florent
> > >
> >
>
Re: Publishing to Maven Central and non-OSS plugin dependencies
Posted by Manfred Moser <ma...@simpligility.ca>.
The documentation for publishing to Central is very comprehensive. I
suggest you take a closer look. Specifically
https://central.sonatype.org/register/central-portal/
https://central.sonatype.org/publish/producer-terms/
https://repo1.maven.org/terms.html
And maybe contact a lawyer and Sonatype if unclear.
Manfred
On 2/29/2024 8:44 PM, Stanimir Stamenkov wrote:
> Fri, 1 Mar 2024, /Olivier Lamy/:
>
>> users will not be able to rebuild from sources.
>> is it a requirement? No real idea as already said in this thread, you
>> need to ask Sonatype.
>> But it breaks the concept of opensource as you cannot build from the
>> sources :)
>
> The sources uploaded to Maven Central are generally not sufficient for
> a rebuild. They are convenient for debugging and quick look up,
> however one almost always need to go to the project's website, and
> download full sources necessary for a complete build. The project's
> website could be just a source repository with a top-level README.
>
> I don't think Sonatype has or can have a requirement of "online
> project site available". There are older artifacts people still rely
> on, that may never be rebuilt because the original sites are long
> gone. Does it mean they should be removed from Maven Central, for
> example? I think it should be mainly up to the users to decide
> whether they want to use a particular artifact.
>
> As far as I'm aware there could be Free Open-source and Non-free
> Open-source. I don't know if complete build instructions are
> requirement for the latter, and Open-source in general?
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Publishing to Maven Central and non-OSS plugin dependencies
Posted by Stanimir Stamenkov <s7...@netscape.net.INVALID>.
Fri, 1 Mar 2024, /Olivier Lamy/:
> users will not be able to rebuild from sources.
> is it a requirement? No real idea as already said in this thread, you
> need to ask Sonatype.
> But it breaks the concept of opensource as you cannot build from the sources :)
The sources uploaded to Maven Central are generally not sufficient for a
rebuild. They are convenient for debugging and quick look up, however
one almost always need to go to the project's website, and download full
sources necessary for a complete build. The project's website could be
just a source repository with a top-level README.
I don't think Sonatype has or can have a requirement of "online project
site available". There are older artifacts people still rely on, that
may never be rebuilt because the original sites are long gone. Does it
mean they should be removed from Maven Central, for example? I think it
should be mainly up to the users to decide whether they want to use a
particular artifact.
As far as I'm aware there could be Free Open-source and Non-free
Open-source. I don't know if complete build instructions are
requirement for the latter, and Open-source in general?
--
Stanimir
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Publishing to Maven Central and non-OSS plugin dependencies
Posted by Olivier Lamy <ol...@apache.org>.
users will not be able to rebuild from sources.
is it a requirement? No real idea as already said in this thread, you
need to ask Sonatype.
But it breaks the concept of opensource as you cannot build from the sources :)
On Fri, 1 Mar 2024 at 02:25, Florent Biville <fl...@gmail.com> wrote:
>
> The real plugin is com.mycila:license-maven-plugin
> <https://github.com/mathieucarbou/license-maven-plugin> and the non-OSS
> dependency brings a bunch of extra resources (authorized licenses,
> headers...).
>
> On Thu, Feb 29, 2024 at 2:14 PM Slawomir Jaranowski <s....@gmail.com>
> wrote:
>
> > I can not fine mentioned plugin at all ...
> > https://repo.maven.apache.org/maven2/com/acme/
> >
> > What does it do ...?
> > Is it needed for the build project?
> > Can it be executed in profile?
> > Can it be replaced by something else ...?
> >
> > I will think about publishing projects which can not be build by outer
> > users, can not be a reproducible build check and so on ...
> >
> > So I would like to not publish something like this...
> >
> >
> >
> > czw., 29 lut 2024 o 13:41 Florent Biville <fl...@gmail.com>
> > napisał(a):
> >
> > > Yes, to clarify, our project has something like this:
> > >
> > > <plugin>
> > > <groupId>com.acme.plugin</groupId>
> > > <artifactId>plugin</artifactId><!-- <- this is already on maven
> > > central -->
> > > <version>4.2.42</version>
> > > <dependencies>
> > > <dependency>
> > > <groupId>com.acme.plugin</groupId>
> > > <artifactId>plugin-dep</artifactId><!-- <- this is NOT OSS
> > -->
> > > <version>42.4.2</version>
> > > </dependency>
> > > </dependencies>
> > > </plugin>
> > >
> > >
> > > On Thu, Feb 29, 2024 at 1:33 PM Tamás Cservenák <ta...@cservenak.net>
> > > wrote:
> > >
> > > > Howdy,
> > > >
> > > > You would need to ask Sonatype about that, and check here:
> > > > https://central.sonatype.org/publish/requirements/
> > > >
> > > > IMHO best to ask them about it: IIUC you want to deploy artifacts to
> > > > central that has dependencies not available from Central
> > > > (nor any other public repository?)
> > > >
> > > > Thanks
> > > > T
> > > >
> > > >
> > > >
> > > > On Thu, Feb 29, 2024 at 1:31 PM Florent Biville <
> > > florent.biville@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > Hello,
> > > > >
> > > > > I'm working on an open-source project that we want to release to
> > Maven
> > > > > Central in the coming weeks.
> > > > >
> > > > > The project currently includes a plugin dependency that is NOT
> > > > open-source
> > > > > (nor in a public GitHub repository). Is that a blocker for releases
> > to
> > > > > Maven Central? I know it would be for regular dependencies and
> > plugins,
> > > > but
> > > > > I'm not 100% sure about plugin dependencies in particular (although I
> > > > would
> > > > > guess it's the same).
> > > > >
> > > > > Any input would be appreciated,
> > > > >
> > > > > Best regards,
> > > > > Florent
> > > > >
> > > >
> > >
> >
> >
> > --
> > Sławomir Jaranowski
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Publishing to Maven Central and non-OSS plugin dependencies
Posted by Florent Biville <fl...@gmail.com>.
The real plugin is com.mycila:license-maven-plugin
<https://github.com/mathieucarbou/license-maven-plugin> and the non-OSS
dependency brings a bunch of extra resources (authorized licenses,
headers...).
On Thu, Feb 29, 2024 at 2:14 PM Slawomir Jaranowski <s....@gmail.com>
wrote:
> I can not fine mentioned plugin at all ...
> https://repo.maven.apache.org/maven2/com/acme/
>
> What does it do ...?
> Is it needed for the build project?
> Can it be executed in profile?
> Can it be replaced by something else ...?
>
> I will think about publishing projects which can not be build by outer
> users, can not be a reproducible build check and so on ...
>
> So I would like to not publish something like this...
>
>
>
> czw., 29 lut 2024 o 13:41 Florent Biville <fl...@gmail.com>
> napisał(a):
>
> > Yes, to clarify, our project has something like this:
> >
> > <plugin>
> > <groupId>com.acme.plugin</groupId>
> > <artifactId>plugin</artifactId><!-- <- this is already on maven
> > central -->
> > <version>4.2.42</version>
> > <dependencies>
> > <dependency>
> > <groupId>com.acme.plugin</groupId>
> > <artifactId>plugin-dep</artifactId><!-- <- this is NOT OSS
> -->
> > <version>42.4.2</version>
> > </dependency>
> > </dependencies>
> > </plugin>
> >
> >
> > On Thu, Feb 29, 2024 at 1:33 PM Tamás Cservenák <ta...@cservenak.net>
> > wrote:
> >
> > > Howdy,
> > >
> > > You would need to ask Sonatype about that, and check here:
> > > https://central.sonatype.org/publish/requirements/
> > >
> > > IMHO best to ask them about it: IIUC you want to deploy artifacts to
> > > central that has dependencies not available from Central
> > > (nor any other public repository?)
> > >
> > > Thanks
> > > T
> > >
> > >
> > >
> > > On Thu, Feb 29, 2024 at 1:31 PM Florent Biville <
> > florent.biville@gmail.com
> > > >
> > > wrote:
> > >
> > > > Hello,
> > > >
> > > > I'm working on an open-source project that we want to release to
> Maven
> > > > Central in the coming weeks.
> > > >
> > > > The project currently includes a plugin dependency that is NOT
> > > open-source
> > > > (nor in a public GitHub repository). Is that a blocker for releases
> to
> > > > Maven Central? I know it would be for regular dependencies and
> plugins,
> > > but
> > > > I'm not 100% sure about plugin dependencies in particular (although I
> > > would
> > > > guess it's the same).
> > > >
> > > > Any input would be appreciated,
> > > >
> > > > Best regards,
> > > > Florent
> > > >
> > >
> >
>
>
> --
> Sławomir Jaranowski
>
Re: Publishing to Maven Central and non-OSS plugin dependencies
Posted by Slawomir Jaranowski <s....@gmail.com>.
I can not fine mentioned plugin at all ...
https://repo.maven.apache.org/maven2/com/acme/
What does it do ...?
Is it needed for the build project?
Can it be executed in profile?
Can it be replaced by something else ...?
I will think about publishing projects which can not be build by outer
users, can not be a reproducible build check and so on ...
So I would like to not publish something like this...
czw., 29 lut 2024 o 13:41 Florent Biville <fl...@gmail.com>
napisał(a):
> Yes, to clarify, our project has something like this:
>
> <plugin>
> <groupId>com.acme.plugin</groupId>
> <artifactId>plugin</artifactId><!-- <- this is already on maven
> central -->
> <version>4.2.42</version>
> <dependencies>
> <dependency>
> <groupId>com.acme.plugin</groupId>
> <artifactId>plugin-dep</artifactId><!-- <- this is NOT OSS -->
> <version>42.4.2</version>
> </dependency>
> </dependencies>
> </plugin>
>
>
> On Thu, Feb 29, 2024 at 1:33 PM Tamás Cservenák <ta...@cservenak.net>
> wrote:
>
> > Howdy,
> >
> > You would need to ask Sonatype about that, and check here:
> > https://central.sonatype.org/publish/requirements/
> >
> > IMHO best to ask them about it: IIUC you want to deploy artifacts to
> > central that has dependencies not available from Central
> > (nor any other public repository?)
> >
> > Thanks
> > T
> >
> >
> >
> > On Thu, Feb 29, 2024 at 1:31 PM Florent Biville <
> florent.biville@gmail.com
> > >
> > wrote:
> >
> > > Hello,
> > >
> > > I'm working on an open-source project that we want to release to Maven
> > > Central in the coming weeks.
> > >
> > > The project currently includes a plugin dependency that is NOT
> > open-source
> > > (nor in a public GitHub repository). Is that a blocker for releases to
> > > Maven Central? I know it would be for regular dependencies and plugins,
> > but
> > > I'm not 100% sure about plugin dependencies in particular (although I
> > would
> > > guess it's the same).
> > >
> > > Any input would be appreciated,
> > >
> > > Best regards,
> > > Florent
> > >
> >
>
--
Sławomir Jaranowski
Re: Publishing to Maven Central and non-OSS plugin dependencies
Posted by Florent Biville <fl...@gmail.com>.
Yes, to clarify, our project has something like this:
<plugin>
<groupId>com.acme.plugin</groupId>
<artifactId>plugin</artifactId><!-- <- this is already on maven central -->
<version>4.2.42</version>
<dependencies>
<dependency>
<groupId>com.acme.plugin</groupId>
<artifactId>plugin-dep</artifactId><!-- <- this is NOT OSS -->
<version>42.4.2</version>
</dependency>
</dependencies>
</plugin>
On Thu, Feb 29, 2024 at 1:33 PM Tamás Cservenák <ta...@cservenak.net> wrote:
> Howdy,
>
> You would need to ask Sonatype about that, and check here:
> https://central.sonatype.org/publish/requirements/
>
> IMHO best to ask them about it: IIUC you want to deploy artifacts to
> central that has dependencies not available from Central
> (nor any other public repository?)
>
> Thanks
> T
>
>
>
> On Thu, Feb 29, 2024 at 1:31 PM Florent Biville <florent.biville@gmail.com
> >
> wrote:
>
> > Hello,
> >
> > I'm working on an open-source project that we want to release to Maven
> > Central in the coming weeks.
> >
> > The project currently includes a plugin dependency that is NOT
> open-source
> > (nor in a public GitHub repository). Is that a blocker for releases to
> > Maven Central? I know it would be for regular dependencies and plugins,
> but
> > I'm not 100% sure about plugin dependencies in particular (although I
> would
> > guess it's the same).
> >
> > Any input would be appreciated,
> >
> > Best regards,
> > Florent
> >
>
Re: Publishing to Maven Central and non-OSS plugin dependencies
Posted by Tamás Cservenák <ta...@cservenak.net>.
Howdy,
You would need to ask Sonatype about that, and check here:
https://central.sonatype.org/publish/requirements/
IMHO best to ask them about it: IIUC you want to deploy artifacts to
central that has dependencies not available from Central
(nor any other public repository?)
Thanks
T
On Thu, Feb 29, 2024 at 1:31 PM Florent Biville <fl...@gmail.com>
wrote:
> Hello,
>
> I'm working on an open-source project that we want to release to Maven
> Central in the coming weeks.
>
> The project currently includes a plugin dependency that is NOT open-source
> (nor in a public GitHub repository). Is that a blocker for releases to
> Maven Central? I know it would be for regular dependencies and plugins, but
> I'm not 100% sure about plugin dependencies in particular (although I would
> guess it's the same).
>
> Any input would be appreciated,
>
> Best regards,
> Florent
>