WrenSecurity/wrensec-parent

Versions 2.0.6 and later don't generate source JARs

Closed this issue · 0 comments

Kortanul commented

looks like FR stopped including the <executions> tag for the maven-source-plugin starting in version 2.0.6 of forgerock-parent. the commit that made this change was 268d9fc.

it looks like the assumption the author was making is incorrect; the commit message was "Use the execution from the maven super pom for source plugin", but the super pom should not come into play because:

  1. The maven-source-plugin is only defined to be executed by the Super POM when the release-profile profile is active.
  2. The release-profile profile is deprecated.

so, the commit author was either wrong, or this was intentionally and nefariously designed to stop source JAR generation a few versions before FR cut off access to the trunk, to curtail how many copies are floating out there.

the linked ticket is AME-9491, but that's only accessible by FR Backstage customers with a subscription. with access to the ticket we can't confirm motivation behind the change.