Add license details to published pom files

[yogurtearl]

Add license info to all the poms published by this repo.

e.g. (and an any other publish poms)

• https://plugins.gradle.org/m2/net/ltgt/errorprone/net.ltgt.errorprone.gradle.plugin/4.0.1/net.ltgt.errorprone.gradle.plugin-4.0.1.pom
• https://plugins.gradle.org/m2/net/ltgt/gradle/gradle-errorprone-plugin/4.0.1/gradle-errorprone-plugin-4.0.1.pom

See https://maven.apache.org/pom.html#Licenses

Else this gets flagged for having no license.

[tbroyer]

Out of curiosity, what tool will flag the plugin for having no license?

[yogurtearl]

Out of curiosity, what tool will flag the plugin for having no license?

any/all? depending on how the tool is configured, these OSS tools generally assume it is copyrighted and proprietary with no license granted for use.

some possible examples:

• https://github.com/cashapp/licensee
• https://www.scanoss.com/
• https://docs.snyk.io/scan-using-snyk/snyk-open-source/scan-open-source-libraries-and-licenses/open-source-license-compliance
• https://www.synopsys.com/software-integrity/software-composition-analysis-tools/black-duck-sca.html
• https://www.sonatype.com/products/sonatype-repository-firewall

[tbroyer]

Do they really check build dependencies by default? (the first one doesn't at least)
And is that really a global problem or more one for very strict environments? (or are you building and distributing a plugin that has this plugin as a dependency?)

(I mean, I'll do it as it should be easy, but am trying to understand the full story)

[yogurtearl]

The OSS license compliance solutions that operate at the repo proxy level will block unlicensed deps.

i.e. if you have a OSS compliance solution on an internal maven-proxy.mycorp.com it will block unknown licenses, denylist licenses and artifacts with no license.

The internal proxy doesn't know if the dep was a build dep or a production dep.

[tbroyer]

Fyi, plugin marker artifacts won't have license information no matter what projects do, until Gradle fixes gradle/plugin-portal-requests#212

[JakeWharton]

That's only true for those which are published to the portal. Ones on standard places like Maven central contain them like any other artifact.

[tbroyer]

Version 4.1.0 released with the change: https://plugins.gradle.org/m2/net/ltgt/gradle/gradle-errorprone-plugin/4.1.0/gradle-errorprone-plugin-4.1.0.pom

As noted above, this doesn't apply to the plugin marker artifact: https://plugins.gradle.org/m2/net/ltgt/errorprone/net.ltgt.errorprone.gradle.plugin/4.1.0/net.ltgt.errorprone.gradle.plugin-4.1.0.pom