The OSMF Visibility Gap: Your License Scanner Can’t See the Fee

Описание и применение

Автоматические сканеры лицензий не видят скрытые сборы Open Source Maintenance Fee, которые находятся только в содержимом пакета, а не в метаданных реестра.

Задача

Automated license scanners miss Open Source Maintenance Fee (OSMF) terms that are only present in package contents, not registry metadata.

Результат

Registry‑only scans miss OSMF fees; full package audits catch only one of two adopters, revealing a 0/2 registry visibility and 1/2 package visibility gap.

Рабочий процесс

• Query NuGet V3 registration API for licenseExpression, licenseUrl, tags, description.
• Download the latest .nupkg from NuGet flat container.
• Inspect package contents for OsmfEula.txt or fee references.
• Compare registry metadata across versions (e.g., Excelsior 4.0.0 vs 5.0.0).

Доказательства

For each confirmed adopter we asked two questions, each at a different depth: 1) Registry‑only audit – what does the package registry's metadata say? 2) Full package audit – download the latest nupkg, list every file, grep for fee/OSMF/sponsor/EULA signals.

Источник

Excelsior 6.5.0 – Fee in registry metadata? NO – licenseExpression = "" (empty), licenseUrl = the deprecated placeholder aka.ms/deprecateLicenseUrl, no OSMF in tags/description.

Источник

Excelsior 6.5.0 – Fee in package contents? YES – OsmfEula.txt shipped in the package; nuspec declares <license type="file">OsmfEula.txt</license> + requireLicenseAcceptance=true + SponsorCheck buildTransitive files.

Источник

Polly 8.8.0 – Fee in registry metadata? NO – actively misleading: licenseExpression = "BSD-3-Clause".

Источник

Polly 8.8.0 – Fee in package contents? NO – 20 files, zero mentions of fee/OSMF/sponsor.

Источник

Score: registry-level visibility 0/2 (0%); full-package visibility 1/2 (50%).

Источник