DistTar task ships source code

[szunami]

The DistTar task will include source jars (files off the form *-sources.jar). This is dangerous if you are pulling in source jars, as you might accidentally be distributing proprietary source code.

[markelliot]

This would only include source jars that are showing up as dependencies but not labeled as source jars.

Any chance you have a proposal for how one would exclude those jars? (Do we need an exclusion pattern?)

Would also love a sample problem-inducing configuration so we can write a rest.

[markelliot]

I'd add that you can add filters that you like to configurations.main.runtime in order to remove deps you don't want.

[markelliot]

Going to close this out, I verified that we don't arbitrarily pull source jars, but do include jars that are not correctly tagged in Ivy/Maven as source, and that this behavior is expected.