Re: [orbit-dev] Sources for plugins to fulfil OSS obligations

[Roland Grunberg <rgrunber@xxxxxxxxxx>]

On Fri, 2019-11-01 at 07:17 +0000, Ranjana Radhakrishnan (RBEI/EMT2)
wrote:
> Hello,
>  
> We have integrated the below plugins into our products and we were unable to find the sources for the same.
> The plugin sources are required to fulfil OSS obligations.

For a little background, I believe contributing the sources in addition
to the binary would have been optional since at least in this case, all
3 are just redistributing bundles under their original license (Apache
Software License 2.0), which as far as I understand doesn't require it.

The sources were of course used to approve the bundle so if any of your
team is a committer on an Eclipse project, I believe you should be able
to browse the contents of https://dev.eclipse.org/ipzilla/ which makes
it easier to get that info. With that said, for the bundles you
mentioned, I see the following :

> 1.      org.apache.xml.resolver_1.2.0.v201005080400.jar

According to the CQ, this should just be :
https://archive.apache.org/dist/xml/commons/xml-commons-resolver-1.2.zip


> 2.      org.apache.xml.serializer_2.7.1.v201005080400.jar

According to the CQ, they used the sources to all of xerces, and
mentioned that the part needed is specifically what's under
src\org\apache\xml\serialize . It looks like they referenced the 2.9.0
sources, but the 2.7.1 ones on the same path would be :
https://archive.apache.org/dist/xml/xerces-j/Xerces-J-src.2.7.1.zip


> 3.      javax.xml_1.3.4.v201005080400.jar

According to the CQ, this should just be :
https://archive.apache.org/dist/xml/commons/xml-commons-external-1.3.04-src.zip


> 4.      org.hamcrest.core_1.3.0.v201303031735.jar

The sources for this exact version/qualifier can be found at :

https://download.eclipse.org/tools/orbit/downloads/drops/R20180330011457/
(specifically http://download.eclipse.org/tools/orbit/downloads/drops/R20170303204511/repository/plugins/org.hamcrest.core.source_1.3.0.v201303031735.jar )

Please not that this is the Oxygen.3a Orbit repository, and that
hamcrest.core 1.3.0 has been updated (hence the newer qualifier)

More recently, it's much easier to simply contribute the sources, so
not seeing them is a bit of a rarity because the process is mostly
automated.

Hope this helps,
-- 
Roland Grunberg