findbugs-annotations
findbugs-annotations copied to clipboard
stephenc
publish 3.0.1-1 release
please publish the latest release artifacts in a way that gets them mirrored on maven central.
Hi, is there a reason why the version 3.0.1-1 still does not get published on maven central? This will be indeed very helpful
It has been almost 2 years since the original issue was created, anything we can do to help to get this out?
@iemejia well... it's Apache Licensed... you could fork it, and publish it yourself under a different namespace... it would just to be nice to have it being published from @stephenc himself, so we don't add to the clutter on maven central
Last time I checked there were issues with updating because of The use of javax package name for the base annotations without a published JSR
@stephenc thank for the info, and your efforts. Do I see correctly, that currently the best way of action is cloning this repo and deploying it to a company repository? There you (usually) don't have these kind of restrictions ;)
https://github.com/spotbugs/spotbugs/tree/release-3.1/spotbugs-annotations though it's LGPL
The issue, iirc, is that if you are using the 3.0.0 version of this library because you want Apache license, well you are SOoL because to get binary compat, we have to include a dependency on classes that we cannot put an Apache license on.
I need to cross check the latest spotbugs docs to see if they have removed those illegal javax package dependencies (as they are Category X - incompatible with Apache license)... so while in an internal repo you can do whatever you like, the legal effect is still the same... and the only reason to use this library in place of spotbugs is because you need Apache in place of LGPL... and that should be rare (it was the original GPL license that caused issues... plus the presence of this proves late binding substitution is possible, therefore preventing (IANAL) any claim of virality
Indeed we need to use Apache/BSD-licensed libraries, even if I personally do know that LGPL is not viral, at least in case of Java packages — as you've mentioned earlier, it's less problematic to side step a lawyer than to convince him.
Regarding the release — technically we miss the only thing in the current release @SuppressFBWarnings annotations.
