Missing license files/ headers to Maven source packages (bcutil / bcpkix 1.84 )

[meghananirmith]

The source code packages (-sources.jar) for version 1.84 of bcutil-jdk18onandbcpkix-jdk18onhosted on Maven Central do not contain any embedded license information. Neither a rootLICENSE` text file nor individual file-level license headers/SPDX identifiers are present within the source distributions.

Impacted Artifacts:

• org.bouncycastle:bcutil-jdk18on:1.84
• org.bouncycastle:bcpkix-jdk18on:1.84

Impact :
Automated open-source software (OSS) compliance, legal, and security scanning tools flag these source packages as "Unlicensed" or "Unknown License" during legal checks. This breaks automated continuous integration (CI) build pipelines for teams using these packages.

Note : This issue is seen for all the versions of bcutil-jdk18on and bcpkix-jdk18on

[dghgit]

Thanks for the report. This information is actually in the POM file, so I would raise this as a bug with whoever wrote the tool. There's been a specific stanza in a maven POM for license information for as long as I can remember and the URL with the license does resolve to a simple html file.

That said, we'll organize for a LICENSE.md to be included in the source jars in the META-INF directory (putting it anywhere else is also likely to break things)