The OSMF Visibility Gap: Your License Scanner Can’t See the Fee

说明与用途

自动化许可证扫描器无法检测到仅存在于包内容而非注册表元数据中的开放源代码维护费。

问题

Automated license scanners miss Open Source Maintenance Fee (OSMF) terms that are only present in package contents, not registry metadata.

结果

Registry‑only scans miss OSMF fees; full package audits catch only one of two adopters, revealing a 0/2 registry visibility and 1/2 package visibility gap.

工作流

• Query NuGet V3 registration API for licenseExpression, licenseUrl, tags, description.
• Download the latest .nupkg from NuGet flat container.
• Inspect package contents for OsmfEula.txt or fee references.
• Compare registry metadata across versions (e.g., Excelsior 4.0.0 vs 5.0.0).

证据

For each confirmed adopter we asked two questions, each at a different depth: 1) Registry‑only audit – what does the package registry's metadata say? 2) Full package audit – download the latest nupkg, list every file, grep for fee/OSMF/sponsor/EULA signals.

来源

Excelsior 6.5.0 – Fee in registry metadata? NO – licenseExpression = "" (empty), licenseUrl = the deprecated placeholder aka.ms/deprecateLicenseUrl, no OSMF in tags/description.

来源

Excelsior 6.5.0 – Fee in package contents? YES – OsmfEula.txt shipped in the package; nuspec declares <license type="file">OsmfEula.txt</license> + requireLicenseAcceptance=true + SponsorCheck buildTransitive files.

来源

Polly 8.8.0 – Fee in registry metadata? NO – actively misleading: licenseExpression = "BSD-3-Clause".

来源

Polly 8.8.0 – Fee in package contents? NO – 20 files, zero mentions of fee/OSMF/sponsor.

来源

Score: registry-level visibility 0/2 (0%); full-package visibility 1/2 (50%).

来源