Fork me on GitHub
#announcements
<
2023-09-29
>
tcrawley11:09:35

Clojars now requires a license in the POM for new projects or projects that already specify a license Hi all! Clojars (https://clojars.org - the community repository for open source Clojure libraries) will now require a license to be specified in the POM file for: - newly uploaded versions for new projects - newly uploaded versions for existing projects where the prior version had a license We will then start requiring a license for all newly uploaded versions on or after 2024-01-01. Note that this will not impact any existing versions; existing versions that don't have a license in the POM file will remain unchanged. For more details, see https://github.com/clojars/clojars-web/issues/873 for discussion of the change, and the https://github.com/clojars/clojars-web/wiki/Pushing#licenses for how to add a license to your POM. Why is Clojars making this change? We are making this change: - to better support auditing from java ecosystem tools that use the POM as the source of truth for the license - enforce better hygiene; all open source projects should have a license How does this change impact me? If you only consume projects from Clojars and do not release libraries, you don't need to do anything. If you publish projects to Clojars, you will need to: - include a license with any new projects - continue to include a license with new versions of projects where you already provide a license - update any projects that don't provide a license to provide one before the end of the year if you plan to release a new version If Clojars rejects your deploy, you will see a message like:

Could not transfer metadata org.clojars.tcrawley:deploytest/maven-metadata.xml from/to clojars (): authorization failed for , status: 403 Forbidden - the POM file does not include a license. See 
Most versions already have licenses in their POM files since https://leiningen.org/ includes one by default, and prints a warning when you try to deploy without one. But newer tooling built on the https://clojure.org/guides/deps_and_cli doesn't have this warning (however, https://github.com/seancorfield/clj-new will generate a pom.xml that does include a license if you use it to template your project). Thank you Thanks to Peter Monks for suggesting this change, and Daniel Compton for discussing a solution. Supporting this work This work was done as part of an ongoing maintenance contract from https://www.clojuriststogether.org/ https://www.clojuriststogether.org/. You can also sponsor me directly on https://github.com/sponsors/tobias if you would like to directly fund my maintenance of Clojars. Please reply here or on the issue if you have any concerns or questions. - Toby

👍 21
thanks3 2
2
1
🎉 1
seancorfield16:09:22

Note: lib projects created via deps-new have a license in the generated pom.xml files, just like lib projects created via clj-new -- but this may not be true of third-party templates you use with either tool so you'll still need to check, if you're using a third-party template.

tcrawley17:09:17

Thanks @U04V70XH6! I forgot about deps-new. I change the Clojars wiki to point to it instead of clj-new.

1