jakartaee / jakartaee/servlet

License oddities in `jakarta.servlet-api-6.0.0.jar`

Open
#526 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
325
Forks
112
PR merge metrics
No merged PRs in 30d

Description

I was looking closely at https://repo1.maven.org/maven2/jakarta/servlet/jakarta.servlet-api/6.0.0/jakarta.servlet-api-6.0.0.jar

I was expecting a `NOTICE.md` or a `LICENSE.md` in the root (or the `META-INF/` directory) but didn't find any.

The `META-INF/MANIFEST.MF` has the following ...
```
Bundle-License: http://www.eclipse.org/legal/epl-2.0, https://www.gnu.or
g/software/classpath/license.html
```
This `META-INF/MANIFEST.MF` indicates the only licenses are EPL/2.0 or GPL/2+Classpath Exception.

But the contents of the `jakarta.servlet-api-6.0.0.jar` also has a few Apache Licensed files.
```
$ grep -RHin "Apache License"
jakarta/servlet/LocalStrings_fr.properties:6:# Licensed under the Apache License, Version 2.0 (the "License");
jakarta/servlet/LocalStrings.properties:6:# Licensed under the Apache License, Version 2.0 (the "License");
jakarta/servlet/http/LocalStrings_fr.properties:6:# Licensed under the Apache License, Version 2.0 (the "License");
jakarta/servlet/http/LocalStrings.properties:6:# Licensed under the Apache License, Version 2.0 (the "License");
jakarta/servlet/http/LocalStrings_es.properties:6:# Licensed under the Apache License, Version 2.0 (the "License");
jakarta/servlet/http/package.html:7: Licensed under the Apache License, Version 2.0 (the "License");
jakarta/servlet/http/LocalStrings_ja.properties:6:# Licensed under the Apache License, Version 2.0 (the "License");
jakarta/servlet/package.html:7: Licensed under the Apache License, Version 2.0 (the "License");
jakarta/servlet/LocalStrings_ja.properties:6:# Licensed under the Apache License, Version 2.0 (the "License");
```

There's also no `SPDX-License-Identifier` declared anywhere, which I thought was a requirement of Eclipse Foundation now.

Contributor guide

Open the contributing guide

Research direction

Inspect the downloaded jakarta.servlet-api-6.0.0.jar, beginning with META-INF/MANIFEST.MF and the listed LocalStrings.properties and package.html files. Compare the declared EPL/GPL licenses with the Apache-licensed file contents and determine how the project’s packaged license and SPDX metadata should represent them; done means the artifact’s licensing information is consistent and complete.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
documentation
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.