The source code packages (-sources.jar) for version 1.84 of bcutil-jdk18onandbcpkix-jdk18onhosted on Maven Central do not contain any embedded license information. Neither a rootLICENSE` text file nor individual file-level license headers/SPDX identifiers are present within the source distributions.
Impacted Artifacts:
org.bouncycastle:bcutil-jdk18on:1.84org.bouncycastle:bcpkix-jdk18on:1.84
Impact :
Automated open-source software (OSS) compliance, legal, and security scanning tools flag these source packages as "Unlicensed" or "Unknown License" during legal checks. This breaks automated continuous integration (CI) build pipelines for teams using these packages.
Note : This issue is seen for all the versions of bcutil-jdk18on and bcpkix-jdk18on
The source code packages (
-sources.jar) for version 1.84 of bcutil-jdk18onandbcpkix-jdk18onhosted on Maven Central do not contain any embedded license information. Neither a rootLICENSE` text file nor individual file-level license headers/SPDX identifiers are present within the source distributions.Impacted Artifacts:
org.bouncycastle:bcutil-jdk18on:1.84org.bouncycastle:bcpkix-jdk18on:1.84Impact :
Automated open-source software (OSS) compliance, legal, and security scanning tools flag these source packages as "Unlicensed" or "Unknown License" during legal checks. This breaks automated continuous integration (CI) build pipelines for teams using these packages.
Note : This issue is seen for all the versions of bcutil-jdk18on and bcpkix-jdk18on