Maven Content Check Plugin — Keeping JARs under control

At HP and GoodData, we ran into a problem with the contents of our WARs, EARs and other distribution packages. New JARs would appear through a fairly uncontrolled process, which isn’t all that unusual when you use transitive dependencies in Maven. It was a problem for two reasons.

• Some open-source licenses can cause problems. If you bring a library with a viral license into your product, it may mean you have to release your own source under that same license. Other licenses have implications for intellectual property, especially patents. Depending on how a license addresses patents, using it could mean giving up patents you hold that relate to the library.
• Someone might decide to use library XYZ even though the rest of the product already uses a different library.

You can solve these problems fairly simply. Keep an authoritative list of the files allowed in a particular archive. The Maven Content Check Plugin checks the list. If the archive contains something else, the build fails with a detailed report identifying exactly which files don’t match. See the documentation for plugin configuration and the list format.

The plugin is fairly limited for now. Two features are worth mentioning.

• It can ignore JARs you produce yourself, based on their manifests.
• It can also report the reverse case, when something is missing.

Future versions are intended to generate the initial authoritative list from the archive contents, detect the license type of each JAR and report it.