oss-licenses-plugin does not pick up licenses from parent POMs, so some popular libraries (e.g. Apache Commons) don't have license info displayed

[ajburley]

I have a dependency on ZXing, which stores the license information in the parent POM and then cascades this down to child POMs.

Here's the latest (at time of writing) version of the child POM: https://repo1.maven.org/maven2/com/google/zxing/core/3.4.1/core-3.4.1.pom

Example Gradle dependency:

implementation 'com.google.zxing:core:3.4.1'

The license information is not shown in the generated third_party_licenses data (nor in the activity for the play services library).

I suspect this is because it stores the information through the parent POM:

<parent>
    <groupId>com.google.zxing</groupId>
    <artifactId>zxing-parent</artifactId>
    <version>3.4.1</version>
</parent>

and then in the parent:

<groupId>com.google.zxing</groupId>
<artifactId>zxing-parent</artifactId>
<version>3.4.1</version>
<packaging>pom</packaging>
...
<licenses>
    <license>
        <name>The Apache Software License, Version 2.0</name>
        <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
        <distribution>repo</distribution>
    </license>
</licenses>

The MVNRepository entry is able to show the license information even though it's in the parent POM; is it possible for oss-licenses-plugin to support this too?

[ajburley]

The same happens with Apache Commons libraries, and these are resolved through two parent POMs, e.g.

org.apache.commons:commons-collections4:4.1 -> org.apache.commons:commons-parent:38 -> org.apache:apache:16

The license information is stored in org.apache:apache, not in the child POMs. Once again, the oss-licenses-plugin is not able to pick this up and hence none of the licenses for Apache Commons libraries (which are quite widely used) are shown within the license files generated by this plugin.