[littlegrasscao]

Summary

• add the project metadata Maven Central requires to the parent pom: url, scm, and developers, plus <distribution>repo</distribution> on the license; both modules inherit them without Maven appending their artifact ids to the URLs
• publish only opensharing-server-core and opensharing-server: the release profile flattens each module's pom (flatten-maven-plugin, ossrh mode) so it carries the parent's metadata, dependency versions, and resolved dependency management instead of a <parent> reference, and skips installing and deploying opensharing-parent
• add a release profile (-Prelease) that attaches sources and javadoc jars to every jar module and GPG-signs every artifact at verify, with loopback pinentry; the passphrase comes from MAVEN_GPG_PASSPHRASE, and -Dgpg.skip builds unsigned
• follow OSS Unity Catalog in publishing library jars only: the release profile skips the shaded -exec jar
• add a top-level NOTICE, like Unity Catalog's
• add a license check to every build, like Unity Catalog's licenseCheck in CI: license-maven-plugin fails verify on a runtime dependency whose license is missing or outside Apache, BSD, MIT, EPL/EDL, MPL, and CC0; like Unity Catalog, it also accepts the LGPL Hibernate jars, MySQL Connector/J (GPL with the Universal FOSS Exception), and jakarta.transaction-api and javax.annotation-api (GPL with the classpath exception), which the server stack brings, so the stack passes once rebased
• pin the jar, source, javadoc, gpg, versions, license, flatten, install, and deploy plugin versions
• publishing itself runs in the release-engineering repo, following the OSS Unity Catalog pattern: check out a server-vX.Y.Z tag (the spec keeps vX.Y.Z), mvn versions:set -DnewVersion=X.Y.Z, mvn -Prelease clean install, then collect, scan, and publish ~/.m2/repository/io/opensharing/

Testing

• mvn clean install: 65 tests passed, and the license check passes
• removing Apache from the allowed licenses makes the license check fail mvn verify
• mvn -Prelease -Dgpg.skip clean install installs only the flattened pom and the main, sources, and javadoc jars for opensharing-server-core and opensharing-server, which is what the Central publish scripts check for; no opensharing-parent or -exec jar is installed
• mvn -Prelease -Dgpg.skip deploy into a local staging repository deploys only the two modules
• a scratch project depending on opensharing-server resolves it and opensharing-server-core with no opensharing-parent in the local repository
• with a throwaway GPG key, mvn -Prelease clean install writes a .asc for every pom and jar, including the flattened poms, and gpg --verify accepts them
• the release profile also builds javadoc on the top of the server stack (protocol: Query Table Changes (Change Data Feed) #115)
• merged into the top of the server stack (protocol: Query Table Changes (Change Data Feed) #115), the license check passes
• mvn versions:set -DnewVersion=0.1.0 updates the parent and both modules