Misleading License Information for `com.google.ar:core` library

2 min read Original article ↗

SPECIFIC ISSUE ENCOUNTERED

According to the POM file published for the Android library com.google.ar:core and according to the LICENSE file in this repository, the library, including all the source files, (i.e. not anything of the ARCore app itself) are published under the Apache License 2.0:

Section 2: ARCore SDK source files
Except as indicated in sections 1 above and section 3 below, files in this SDK
are licensed as follows:
Copyright 2017 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");

The actual source files are not provided in this repository but are only available via the google maven repository:

https://dl.google.com/dl/android/maven2/com/google/ar/core/1.32.0/core-1.32.0-sources.jar

However, contradictory to the license statement made in the POM and in the LICENSE file in this repository, not all but some of the *.java files contained in the published source JAR contain the following comment at the top:

/*
 * Copyright 2017 Google LLC
 * CONFIDENTIAL. AUTHORIZED USE ONLY. DO NOT REDISTRIBUTE.
 */

, e.g. Trackable.java. Edit: Additionally, many/all? actual implementation has been removed and replaced with comments like // Method contents removed..

Such contradictory information makes this library problematic to use as an open source library as it introduces legal uncertainty. Noone wants to risk legal uncertainty towards Google.

VERSIONS USED

com.google.ar:core:1.32.0
Edit: persists in 1.33.0

SOLUTION

Make sure any contradictory license information is removed and all code in object form is also provided in source form in at least the source JAR published in the maven repository or better even in this git repository.