On Mon, Dec 18, 2017 at 12:49 PM, Ivan Kelly <iv...@apache.org> wrote:
> >> Isn't this ASFv2? > >> https://mvnrepository.com/artifact/com.google.code.findbugs/jsr305 > No, check out the pom. > > http://central.maven.org/maven2/com/google/code/ > findbugs/jsr305/2.0.3/jsr305-2.0.3.pom > > The pom says ASL, but the pom points to a site where you can get the > original source. It can only be downloaded from a zip from there. The > zip, which is the only source for this that I could find, is BSD 3 > clause. > We do not bundle the source. We bundle the published jar, which is under ASLv2 in maven central. > > It looks like findbugs repackaged the jar, and pushed to maven, but > ignored the license stuff. > > > It is ASLv2. Please check maven: > > https://mvnrepository.com/artifact/com.twitter/libthrift/0.5.0-7 > > Again, check the pom, > http://central.maven.org/maven2/com/twitter/libthrift/ > 0.5.0-7/libthrift-0.5.0-7.pom > > "Thrift is a software framework for scalable cross-language services > development. > This fork is due to a concurrency issue in 0.5.0 that we didn't get > upstreamed." > > So where is the source? This one I assume is a ASL, but the source is > not available anywhere. > There is no public source about this. We have to use the license in maven as the source-of-truth. > > -Ivan >
