Published artifacts contain invalid META-INF information

[NielsDoucet]

Jar packages published to maven central contain invalid META-INF information relating to Gradle's Develocity.
This is getting flagged in our legal compliance system as problematic.

As I don't believe these notices should be part of your published deliverables, could the following files be removed?

• META-INF/LICENSE.txt
• META-INF/NOTICE.txt

I verified for the following packages:

• org.springframework.pulsar:spring-pulsar-reactive:1.2.8
• org.springframework.pulsar:spring-pulsar-cache-provider:1.2.7
• org.springframework.pulsar:spring-pulsar-cache-provider:1.2.8

[onobc]

Hi @NielsDoucet ,

All of the Spring projects publish these files in their META-INF directories (e.g. spring-core).

This is getting flagged in our legal compliance system as problematic.

Do you mind sharing some details about what the tool is flagging as problematic? Is it something in the files or the files themselves?

Thanks

[NielsDoucet]

The spring-core library contains the correct license and notice information.
The spring-pulsar artifacts contain license and notice information related to Develocity. So somehow you end up with the wrong contents in yours.
For instance, this is verbatim the contents of the META-INF/LICENSE.txt file extracted from the spring-pulsar-reactive-1.2.8.jar file downloaded from mvn central.

Develocity Gradle Plugin
========================
Copyright (c) 2025 Gradle Inc.
All rights reserved.

Use of this software is subject to the Develocity Software Agreement
located at https://gradle.com/help/legal-terms-of-use

Our tool (https://fossa.com/) is flagging this, because now we're subject to the terms of https://gradle.com/help/legal-terms-of-use, instead of whichever license you intend to attach to the spring-pulsar project, which should be apache 2.0, according to your own license file: https://github.com/spring-projects/spring-pulsar/blob/main/LICENSE.txt.

[onobc]

Oh yeh, that is not suppose to be the case 😄 . Thank you for catching this @NielsDoucet . We will get it updated and it will be corrected in this months release trains on August 19.