Maven Central publishes the parent POM, core, CLI, Maven plugin, and Gradle plugin artifact families. The Gradle Plugin Portal publishes the plugin and marker. Published POMs, main JARs, source JARs, and Javadocs retain detached OpenPGP signatures. The Gradle plugin bundles core and resolves its remaining runtime dependencies; the executable CLI bundles all runtime dependencies.
For version VERSION, GitHub has exactly these seven files and a detached .asc
signature for each, for a total of 14 assets:
| File | Contents |
|---|---|
cognitive-java-VERSION.jar |
Executable CLI, identical to the Central CLI JAR |
cognitive-java-core-VERSION.cdx.json |
Core runtime dependencies |
cognitive-java-cli-VERSION.cdx.json |
Bundled core and CLI runtime dependencies |
cognitive-java-maven-plugin-VERSION.cdx.json |
Plugin runtime dependencies, including core |
cognitive-java-gradle-plugin-VERSION.cdx.json |
Resolved runtime dependencies and embedded core |
SHA256SUMS |
SHA-256 digests of the JAR and four SBOMs |
SHA512SUMS |
SHA-512 digests of the same five payloads |
SBOMs use CycloneDX 1.6 JSON, generated by Maven plugin 2.9.3 and Gradle plugin 3.4.1. Provided Maven APIs, compile-only annotations, and test/build dependencies are outside the shipped runtime inventory. Each SBOM identifies its main JAR's SHA-256 digest. The Gradle SBOM also identifies the exact embedded core JAR and links its dependencies to the resolved inventory.
The release commit timestamp sets Maven archive timestamps and SBOM timestamps. Gradle archives use fixed timestamps and stable entry order. SBOM identities are deterministic UUIDs derived from normalized content. CI compares all unsigned archives, SBOMs, and checksum manifests from two clean builds.
Import the committed public key and verify its primary fingerprint:
gpg --import .github/release-signing-key.asc
gpg --fingerprint E6BB1FB6EE83EEAB7B408C6B5CA409BD8EE61724
gpg --verify SHA256SUMS.asc SHA256SUMS
gpg --verify SHA512SUMS.asc SHA512SUMS
sha256sum --check --strict SHA256SUMS
sha512sum --check --strict SHA512SUMS
gpg --verify cognitive-java-VERSION.jar.asc cognitive-java-VERSION.jarVerify each SBOM's detached signature before consuming it. GitHub build
provenance and SBOM attestations cover all four main JARs. Verification must bind
the artifact digest to fabian-barney/cognitive-java, .github/workflows/release.yml,
and the tagged source commit; the release runbook provides the exact commands.
The project is Apache-2.0. JToon is MIT; stax2-api is BSD-2-Clause; Jackson 2/3 and Woodstox are Apache-2.0. Their resolved versions and available license metadata appear in the SBOMs. Jackson also bundles FastDoubleParser and Schubfach code, whose license files and notices must survive shading.
The curated license copies come from the tagged JToon 2.0.4 license and stax2-api 4.3.0 license. The latter provides the full BSD terms missing from its packaged license stub.
All binary, source, and Javadoc artifact families include the project license. The CLI retains uniquely named JToon and stax2-api license copies, the three Jackson parser license resources, and merged Jackson 2/3 notices. CI checks license bytes, required attributions, and duplicate legal entries rather than relying solely on POM metadata.
Run the same archive audit locally after building all release artifacts:
java .github/scripts/VerifyLegalContents.java