I believe this is well understood and in hand now. However, I did promise to send an email to tck-dev about this issue, so here it is.
At the
2025-02-04
Jakarta EE Platform project call, Ed Bratt, in his capacity
as member of the Jakarta EE Steering and Specification Committees, clarified some important matters regarding TCK license files, and the .zip files.
-
The SHA of the .zip of the TCK is what matters for certification. The place from which you download it does not matter.
-
If the SHA sum of the bits of the TCK from the normative location (download, or maven central) match the SHA sum of the bits of the TCK used to run the tests and obtain the results, the certification can be valid.
-
In other words, the download location is immaterial as long as the SHA sums match.
-
Maven central has no prohibition on including EFTL license in binary artifacts included in maven central.
-
As long as the TCK binary includes all the project license(s)
and the EFTL license, the license requirements are met. The TCK will implement this requirement by ensuring there is a single LICENSE.md file which includes the union of all the LICENSE* files in
https://github.com/jakartaee/platform-tck .
-
The ordering of contents in the LICENSE file is irrelevant.
-
The top level TCK .zip file, and each .jar file within the .zip file, must have the LICENSE.md file.
