From c68decba7f74beadade4ae155de61ab775984a64 Mon Sep 17 00:00:00 2001
From: Sun Cao <sun.cao+data@databricks.com>
Date: Tue, 20 Oct 2026 12:06:43 -0700
Subject: [PATCH 1/7] Add Maven Central metadata and a release profile that
 builds sources and javadoc jars and signs them.

---
 server/pom.xml | 111 ++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 110 insertions(+), 1 deletion(-)

diff --git a/server/pom.xml b/server/pom.xml
index 287199aa..4eb49ae7 100644
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project xmlns="http://maven.apache.org/POM/4.0.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"
+         child.project.url.inherit.append.path="false">
   <modelVersion>4.0.0</modelVersion>
 
   <groupId>io.opensharing</groupId>
@@ -11,6 +12,7 @@
 
   <name>OpenSharing</name>
   <description>Reference implementation of the OpenSharing protocol</description>
+  <url>https://github.com/OpenSharing-IO/OpenSharing</url>
 
   <modules>
     <module>opensharing-server-core</module>
@@ -21,9 +23,41 @@
     <license>
       <name>Apache License, Version 2.0</name>
       <url>https://www.apache.org/licenses/LICENSE-2.0</url>
+      <distribution>repo</distribution>
     </license>
   </licenses>
 
+  <developers>
+    <developer>
+      <id>chakankardb</id>
+      <name>Abhijit Chakankar</name>
+      <url>https://github.com/chakankardb</url>
+    </developer>
+    <developer>
+      <id>hueyhuilonghan</id>
+      <name>Huey Han</name>
+      <url>https://github.com/hueyhuilonghan</url>
+    </developer>
+    <developer>
+      <id>linzhou-db</id>
+      <name>Lin Zhou</name>
+      <url>https://github.com/linzhou-db</url>
+    </developer>
+    <developer>
+      <id>littlegrasscao</id>
+      <name>Sun Cao</name>
+      <url>https://github.com/littlegrasscao</url>
+    </developer>
+  </developers>
+
+  <scm child.scm.connection.inherit.append.path="false"
+       child.scm.developerConnection.inherit.append.path="false"
+       child.scm.url.inherit.append.path="false">
+    <connection>scm:git:https://github.com/OpenSharing-IO/OpenSharing.git</connection>
+    <developerConnection>scm:git:git@github.com:OpenSharing-IO/OpenSharing.git</developerConnection>
+    <url>https://github.com/OpenSharing-IO/OpenSharing</url>
+  </scm>
+
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <maven.compiler.release>21</maven.compiler.release>
@@ -117,7 +151,82 @@
           <artifactId>maven-shade-plugin</artifactId>
           <version>3.6.0</version>
         </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-jar-plugin</artifactId>
+          <version>3.4.2</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-source-plugin</artifactId>
+          <version>3.3.1</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-javadoc-plugin</artifactId>
+          <version>3.11.2</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-gpg-plugin</artifactId>
+          <version>3.2.7</version>
+        </plugin>
       </plugins>
     </pluginManagement>
   </build>
+
+  <profiles>
+    <!-- Maven Central requires sources and javadoc jars and a GPG signature for every file. -->
+    <profile>
+      <id>release</id>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-source-plugin</artifactId>
+            <executions>
+              <execution>
+                <id>attach-sources</id>
+                <goals>
+                  <goal>jar-no-fork</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-javadoc-plugin</artifactId>
+            <executions>
+              <execution>
+                <id>attach-javadocs</id>
+                <goals>
+                  <goal>jar</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+          <!-- Signs with the default key; -Dgpg.skip builds without one. -->
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-gpg-plugin</artifactId>
+            <executions>
+              <execution>
+                <id>sign-artifacts</id>
+                <phase>verify</phase>
+                <goals>
+                  <goal>sign</goal>
+                </goals>
+                <configuration>
+                  <gpgArguments>
+                    <arg>--pinentry-mode</arg>
+                    <arg>loopback</arg>
+                  </gpgArguments>
+                </configuration>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+  </profiles>
 </project>

From 353e3d9d30bfa27b36375ec355fa3d06dcc1221a Mon Sep 17 00:00:00 2001
From: Sun Cao <sun.cao+data@databricks.com>
Date: Tue, 20 Oct 2026 12:25:59 -0700
Subject: [PATCH 2/7] Keep the runnable jar out of release builds, and pin the
 versions plugin used to set the release version.

---
 server/opensharing-server/pom.xml | 22 ++++++++++++++++++++++
 server/pom.xml                    |  5 +++++
 2 files changed, 27 insertions(+)

diff --git a/server/opensharing-server/pom.xml b/server/opensharing-server/pom.xml
index f5f18da6..54a1aa38 100644
--- a/server/opensharing-server/pom.xml
+++ b/server/opensharing-server/pom.xml
@@ -82,6 +82,7 @@
         </configuration>
         <executions>
           <execution>
+            <id>exec-jar</id>
             <phase>package</phase>
             <goals>
               <goal>shade</goal>
@@ -91,4 +92,25 @@
       </plugin>
     </plugins>
   </build>
+
+  <profiles>
+    <!-- Maven Central gets the library jar only; the runnable jar ships separately. -->
+    <profile>
+      <id>release</id>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-shade-plugin</artifactId>
+            <executions>
+              <execution>
+                <id>exec-jar</id>
+                <phase>none</phase>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+  </profiles>
 </project>
diff --git a/server/pom.xml b/server/pom.xml
index 4eb49ae7..d160db36 100644
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -171,6 +171,11 @@
           <artifactId>maven-gpg-plugin</artifactId>
           <version>3.2.7</version>
         </plugin>
+        <plugin>
+          <groupId>org.codehaus.mojo</groupId>
+          <artifactId>versions-maven-plugin</artifactId>
+          <version>2.23.0</version>
+        </plugin>
       </plugins>
     </pluginManagement>
   </build>

From a1f640561557882000590f35968a3aeef1c11662 Mon Sep 17 00:00:00 2001
From: Sun Cao <sun.cao+data@databricks.com>
Date: Tue, 20 Oct 2026 13:11:29 -0700
Subject: [PATCH 3/7] Add a NOTICE, a license check that writes
 THIRD-PARTY.txt, and a release tarball for the server.

---
 NOTICE                                        |  8 ++
 server/opensharing-server/pom.xml             | 82 ++++++++++++++++++-
 .../src/assembly/tarball.xml                  | 47 +++++++++++
 .../src/bin/start-opensharing-server          | 11 +++
 server/pom.xml                                | 23 ++++++
 5 files changed, 170 insertions(+), 1 deletion(-)
 create mode 100644 NOTICE
 create mode 100644 server/opensharing-server/src/assembly/tarball.xml
 create mode 100755 server/opensharing-server/src/bin/start-opensharing-server

diff --git a/NOTICE b/NOTICE
new file mode 100644
index 00000000..3b8d10ab
--- /dev/null
+++ b/NOTICE
@@ -0,0 +1,8 @@
+Copyright (2026) Databricks, Inc.
+
+This Software includes software developed at Databricks (https://www.databricks.com/) and its use
+is subject to the included LICENSE file.
+---
+
+The server distributions bundle open source dependencies. THIRD-PARTY.txt in each distribution
+lists every bundled dependency and its license.
diff --git a/server/opensharing-server/pom.xml b/server/opensharing-server/pom.xml
index 54a1aa38..70ee5777 100644
--- a/server/opensharing-server/pom.xml
+++ b/server/opensharing-server/pom.xml
@@ -78,6 +78,18 @@
           <transformers>
             <transformer
               implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
+            <!-- Dependency licenses are listed in THIRD-PARTY.txt; their NOTICE files are merged. -->
+            <transformer
+              implementation="org.apache.maven.plugins.shade.resource.ApacheLicenseResourceTransformer"/>
+            <transformer
+              implementation="org.apache.maven.plugins.shade.resource.IncludeResourceTransformer">
+              <resource>META-INF/LICENSE</resource>
+              <file>${project.basedir}/../../LICENSE</file>
+            </transformer>
+            <transformer
+              implementation="org.apache.maven.plugins.shade.resource.ApacheNoticeResourceTransformer">
+              <addHeader>false</addHeader>
+            </transformer>
           </transformers>
         </configuration>
         <executions>
@@ -90,11 +102,59 @@
           </execution>
         </executions>
       </plugin>
+      <!-- Fails the build on a runtime dependency whose license is missing or not allowed, and
+           writes THIRD-PARTY.txt listing every dependency the distributions bundle. -->
+      <plugin>
+        <groupId>org.codehaus.mojo</groupId>
+        <artifactId>license-maven-plugin</artifactId>
+        <configuration>
+          <excludedScopes>test,provided,system</excludedScopes>
+          <failOnMissing>true</failOnMissing>
+          <failOnBlacklist>true</failOnBlacklist>
+          <includedLicenses>
+            <includedLicense>Apache-2.0</includedLicense>
+            <includedLicense>BSD-2-Clause</includedLicense>
+            <includedLicense>BSD-3-Clause</includedLicense>
+            <includedLicense>CC0-1.0</includedLicense>
+            <includedLicense>EDL-1.0</includedLicense>
+            <includedLicense>EPL-1.0</includedLicense>
+            <includedLicense>EPL-2.0</includedLicense>
+            <includedLicense>MIT</includedLicense>
+            <includedLicense>MIT-0</includedLicense>
+            <includedLicense>MPL-2.0</includedLicense>
+          </includedLicenses>
+          <licenseMerges>
+            <licenseMerge>
+              Apache-2.0 | Apache License, Version 2.0 | The Apache Software License, Version 2.0
+              | Apache License 2.0 | The Apache License, Version 2.0 | Apache 2
+              | Apache Software License - Version 2.0
+            </licenseMerge>
+            <licenseMerge>BSD-2-Clause | BSD 2-Clause License</licenseMerge>
+            <licenseMerge>CC0-1.0 | Public Domain, per Creative Commons CC0</licenseMerge>
+            <licenseMerge>EDL-1.0 | Eclipse Distribution License v. 1.0</licenseMerge>
+            <licenseMerge>
+              EPL-1.0 | Eclipse Public License - v 1.0 | Eclipse Public License - Version 1.0
+            </licenseMerge>
+            <licenseMerge>EPL-2.0 | Eclipse Public License v. 2.0</licenseMerge>
+            <licenseMerge>LGPL-2.1 | GNU Lesser General Public License</licenseMerge>
+            <licenseMerge>MIT | The MIT License (MIT)</licenseMerge>
+          </licenseMerges>
+        </configuration>
+        <executions>
+          <execution>
+            <id>third-party</id>
+            <goals>
+              <goal>add-third-party</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
     </plugins>
   </build>
 
   <profiles>
-    <!-- Maven Central gets the library jar only; the runnable jar ships separately. -->
+    <!-- Maven Central gets the library jar only; the server ships as the tarball, which is built
+         into target/ but not deployed. -->
     <profile>
       <id>release</id>
       <build>
@@ -109,6 +169,26 @@
               </execution>
             </executions>
           </plugin>
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-assembly-plugin</artifactId>
+            <executions>
+              <execution>
+                <id>tarball</id>
+                <phase>package</phase>
+                <goals>
+                  <goal>single</goal>
+                </goals>
+                <configuration>
+                  <descriptors>
+                    <descriptor>src/assembly/tarball.xml</descriptor>
+                  </descriptors>
+                  <appendAssemblyId>false</appendAssemblyId>
+                  <attach>false</attach>
+                </configuration>
+              </execution>
+            </executions>
+          </plugin>
         </plugins>
       </build>
     </profile>
diff --git a/server/opensharing-server/src/assembly/tarball.xml b/server/opensharing-server/src/assembly/tarball.xml
new file mode 100644
index 00000000..600fb624
--- /dev/null
+++ b/server/opensharing-server/src/assembly/tarball.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- opensharing-server-<version>.tar.gz: jars/ holds the server and its runtime dependencies,
+     bin/ the start script, and etc/conf editable copies of the settings in the jar. -->
+<assembly xmlns="http://maven.apache.org/ASSEMBLY/2.2.0"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://maven.apache.org/ASSEMBLY/2.2.0
+                              https://maven.apache.org/xsd/assembly-2.2.0.xsd">
+  <id>tarball</id>
+  <formats>
+    <format>tar.gz</format>
+  </formats>
+  <includeBaseDirectory>false</includeBaseDirectory>
+
+  <dependencySets>
+    <dependencySet>
+      <outputDirectory>jars</outputDirectory>
+      <scope>runtime</scope>
+    </dependencySet>
+  </dependencySets>
+
+  <fileSets>
+    <fileSet>
+      <directory>${project.basedir}/../..</directory>
+      <outputDirectory/>
+      <includes>
+        <include>LICENSE</include>
+        <include>NOTICE</include>
+      </includes>
+    </fileSet>
+    <fileSet>
+      <directory>${project.build.directory}/generated-sources/license</directory>
+      <outputDirectory/>
+      <includes>
+        <include>THIRD-PARTY.txt</include>
+      </includes>
+    </fileSet>
+    <fileSet>
+      <directory>src/bin</directory>
+      <outputDirectory>bin</outputDirectory>
+      <fileMode>0755</fileMode>
+    </fileSet>
+    <fileSet>
+      <directory>src/main/resources</directory>
+      <outputDirectory>etc/conf</outputDirectory>
+    </fileSet>
+  </fileSets>
+</assembly>
diff --git a/server/opensharing-server/src/bin/start-opensharing-server b/server/opensharing-server/src/bin/start-opensharing-server
new file mode 100755
index 00000000..adea268c
--- /dev/null
+++ b/server/opensharing-server/src/bin/start-opensharing-server
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Starts the server from the unpacked tarball. Files in etc/conf take precedence over the copies
+# in the jars, and JAVA_OPTS passes JVM options such as -Dserver.port=9090.
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+# JAVA_OPTS is left unquoted so that it splits into separate options.
+# shellcheck disable=SC2086
+exec java ${JAVA_OPTS:-} -cp "$ROOT_DIR/etc/conf:$ROOT_DIR/jars/*" \
+  io.opensharing.OpenSharingServer "$@"
diff --git a/server/pom.xml b/server/pom.xml
index d160db36..5617c082 100644
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -129,6 +129,19 @@
   </dependencyManagement>
 
   <build>
+    <resources>
+      <resource>
+        <directory>src/main/resources</directory>
+      </resource>
+      <resource>
+        <directory>${project.basedir}/../..</directory>
+        <targetPath>META-INF</targetPath>
+        <includes>
+          <include>LICENSE</include>
+          <include>NOTICE</include>
+        </includes>
+      </resource>
+    </resources>
     <pluginManagement>
       <plugins>
         <plugin>
@@ -176,6 +189,16 @@
           <artifactId>versions-maven-plugin</artifactId>
           <version>2.23.0</version>
         </plugin>
+        <plugin>
+          <groupId>org.codehaus.mojo</groupId>
+          <artifactId>license-maven-plugin</artifactId>
+          <version>2.5.0</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-assembly-plugin</artifactId>
+          <version>3.7.1</version>
+        </plugin>
       </plugins>
     </pluginManagement>
   </build>

From d39276b5f7032e35c441fd4235154e669da1b65c Mon Sep 17 00:00:00 2001
From: Sun Cao <sun.cao+data@databricks.com>
Date: Tue, 20 Oct 2026 13:48:38 -0700
Subject: [PATCH 4/7] Accept the license spellings and reviewed LGPL and
 GPL-with-exception dependencies the server stack brings.

---
 server/opensharing-server/pom.xml | 32 +++++++++++++++++++++++++++----
 1 file changed, 28 insertions(+), 4 deletions(-)

diff --git a/server/opensharing-server/pom.xml b/server/opensharing-server/pom.xml
index 70ee5777..aa3383d9 100644
--- a/server/opensharing-server/pom.xml
+++ b/server/opensharing-server/pom.xml
@@ -122,22 +122,46 @@
             <includedLicense>MIT</includedLicense>
             <includedLicense>MIT-0</includedLicense>
             <includedLicense>MPL-2.0</includedLicense>
+            <!-- Allowed as unmodified dependencies; reviewed per artifact, as listed below. -->
+            <includedLicense>LGPL-2.1-or-later</includedLicense>
+            <includedLicense>GPL-2.0-with-classpath-exception</includedLicense>
+            <includedLicense>GPL-2.0-with-universal-FOSS-exception</includedLicense>
           </includedLicenses>
           <licenseMerges>
             <licenseMerge>
               Apache-2.0 | Apache License, Version 2.0 | The Apache Software License, Version 2.0
               | Apache License 2.0 | The Apache License, Version 2.0 | Apache 2
-              | Apache Software License - Version 2.0
+              | Apache Software License - Version 2.0 | Apache 2.0 | Apache License, version 2.0
+              | Apache License Version 2.0
             </licenseMerge>
             <licenseMerge>BSD-2-Clause | BSD 2-Clause License</licenseMerge>
+            <licenseMerge>BSD-3-Clause | BSD New license | Go License</licenseMerge>
             <licenseMerge>CC0-1.0 | Public Domain, per Creative Commons CC0</licenseMerge>
-            <licenseMerge>EDL-1.0 | Eclipse Distribution License v. 1.0</licenseMerge>
+            <licenseMerge>
+              EDL-1.0 | Eclipse Distribution License v. 1.0 | Eclipse Distribution License - v 1.0
+              | EDL 1.0
+            </licenseMerge>
             <licenseMerge>
               EPL-1.0 | Eclipse Public License - v 1.0 | Eclipse Public License - Version 1.0
+              | EPL 1.0
             </licenseMerge>
-            <licenseMerge>EPL-2.0 | Eclipse Public License v. 2.0</licenseMerge>
+            <licenseMerge>EPL-2.0 | Eclipse Public License v. 2.0 | EPL 2.0</licenseMerge>
             <licenseMerge>LGPL-2.1 | GNU Lesser General Public License</licenseMerge>
-            <licenseMerge>MIT | The MIT License (MIT)</licenseMerge>
+            <!-- hibernate-core, hibernate-hikaricp -->
+            <licenseMerge>
+              LGPL-2.1-or-later | GNU Library General Public License v2.1 or later
+            </licenseMerge>
+            <!-- jakarta.transaction-api, javax.annotation-api -->
+            <licenseMerge>
+              GPL-2.0-with-classpath-exception | GPL2 w/ CPE | CDDL + GPLv2 with classpath exception
+            </licenseMerge>
+            <!-- mysql-connector-j -->
+            <licenseMerge>
+              GPL-2.0-with-universal-FOSS-exception
+              | The GNU General Public License, v2 with Universal FOSS Exception, v1.0
+            </licenseMerge>
+            <licenseMerge>MIT | The MIT License (MIT) | The MIT License | MIT license</licenseMerge>
+            <licenseMerge>MPL-2.0 | MPL 2.0</licenseMerge>
           </licenseMerges>
         </configuration>
         <executions>

From f9d725fa64061450be4f43910d41bac0ee03aae4 Mon Sep 17 00:00:00 2001
From: Sun Cao <sun.cao+data@databricks.com>
Date: Tue, 20 Oct 2026 13:56:21 -0700
Subject: [PATCH 5/7] Publish only the two modules, with flattened poms that do
 not refer to the parent.

---
 server/pom.xml | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/server/pom.xml b/server/pom.xml
index 5617c082..92a07c85 100644
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -199,6 +199,16 @@
           <artifactId>maven-assembly-plugin</artifactId>
           <version>3.7.1</version>
         </plugin>
+        <plugin>
+          <groupId>org.codehaus.mojo</groupId>
+          <artifactId>flatten-maven-plugin</artifactId>
+          <version>1.8.0</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-install-plugin</artifactId>
+          <version>3.1.4</version>
+        </plugin>
       </plugins>
     </pluginManagement>
   </build>
@@ -253,6 +263,36 @@
               </execution>
             </executions>
           </plugin>
+          <!-- Only the modules are published, so each pom carries the parent's metadata and
+               dependency versions instead of referring to it. -->
+          <plugin>
+            <groupId>org.codehaus.mojo</groupId>
+            <artifactId>flatten-maven-plugin</artifactId>
+            <configuration>
+              <flattenMode>ossrh</flattenMode>
+              <pomElements>
+                <dependencyManagement>resolve</dependencyManagement>
+              </pomElements>
+              <outputDirectory>${project.build.directory}</outputDirectory>
+            </configuration>
+            <executions>
+              <execution>
+                <id>flatten</id>
+                <phase>process-resources</phase>
+                <goals>
+                  <goal>flatten</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-install-plugin</artifactId>
+            <inherited>false</inherited>
+            <configuration>
+              <skip>true</skip>
+            </configuration>
+          </plugin>
         </plugins>
       </build>
     </profile>

From d523be3dae7c7bd18fad8d0ef5e0b01a4c1f1cfb Mon Sep 17 00:00:00 2001
From: Sun Cao <sun.cao+data@databricks.com>
Date: Tue, 20 Oct 2026 15:08:29 -0700
Subject: [PATCH 6/7] Drop the tarball, THIRD-PARTY.txt in the jar, and the
 LICENSE and NOTICE handling Maven Central does not need.

---
 NOTICE                                        |  4 --
 server/opensharing-server/pom.xml             | 40 ++--------------
 .../src/assembly/tarball.xml                  | 47 -------------------
 .../src/bin/start-opensharing-server          | 11 -----
 server/pom.xml                                | 18 -------
 5 files changed, 4 insertions(+), 116 deletions(-)
 delete mode 100644 server/opensharing-server/src/assembly/tarball.xml
 delete mode 100755 server/opensharing-server/src/bin/start-opensharing-server

diff --git a/NOTICE b/NOTICE
index 3b8d10ab..602ace2d 100644
--- a/NOTICE
+++ b/NOTICE
@@ -2,7 +2,3 @@ Copyright (2026) Databricks, Inc.
 
 This Software includes software developed at Databricks (https://www.databricks.com/) and its use
 is subject to the included LICENSE file.
----
-
-The server distributions bundle open source dependencies. THIRD-PARTY.txt in each distribution
-lists every bundled dependency and its license.
diff --git a/server/opensharing-server/pom.xml b/server/opensharing-server/pom.xml
index aa3383d9..18b9a631 100644
--- a/server/opensharing-server/pom.xml
+++ b/server/opensharing-server/pom.xml
@@ -78,18 +78,6 @@
           <transformers>
             <transformer
               implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
-            <!-- Dependency licenses are listed in THIRD-PARTY.txt; their NOTICE files are merged. -->
-            <transformer
-              implementation="org.apache.maven.plugins.shade.resource.ApacheLicenseResourceTransformer"/>
-            <transformer
-              implementation="org.apache.maven.plugins.shade.resource.IncludeResourceTransformer">
-              <resource>META-INF/LICENSE</resource>
-              <file>${project.basedir}/../../LICENSE</file>
-            </transformer>
-            <transformer
-              implementation="org.apache.maven.plugins.shade.resource.ApacheNoticeResourceTransformer">
-              <addHeader>false</addHeader>
-            </transformer>
           </transformers>
         </configuration>
         <executions>
@@ -102,8 +90,8 @@
           </execution>
         </executions>
       </plugin>
-      <!-- Fails the build on a runtime dependency whose license is missing or not allowed, and
-           writes THIRD-PARTY.txt listing every dependency the distributions bundle. -->
+      <!-- Fails the build on a runtime dependency whose license is missing or not allowed. It runs
+           after packaging so that the THIRD-PARTY.txt it writes stays out of the jar. -->
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>license-maven-plugin</artifactId>
@@ -167,6 +155,7 @@
         <executions>
           <execution>
             <id>third-party</id>
+            <phase>verify</phase>
             <goals>
               <goal>add-third-party</goal>
             </goals>
@@ -177,8 +166,7 @@
   </build>
 
   <profiles>
-    <!-- Maven Central gets the library jar only; the server ships as the tarball, which is built
-         into target/ but not deployed. -->
+    <!-- Maven Central gets the library jar only. -->
     <profile>
       <id>release</id>
       <build>
@@ -193,26 +181,6 @@
               </execution>
             </executions>
           </plugin>
-          <plugin>
-            <groupId>org.apache.maven.plugins</groupId>
-            <artifactId>maven-assembly-plugin</artifactId>
-            <executions>
-              <execution>
-                <id>tarball</id>
-                <phase>package</phase>
-                <goals>
-                  <goal>single</goal>
-                </goals>
-                <configuration>
-                  <descriptors>
-                    <descriptor>src/assembly/tarball.xml</descriptor>
-                  </descriptors>
-                  <appendAssemblyId>false</appendAssemblyId>
-                  <attach>false</attach>
-                </configuration>
-              </execution>
-            </executions>
-          </plugin>
         </plugins>
       </build>
     </profile>
diff --git a/server/opensharing-server/src/assembly/tarball.xml b/server/opensharing-server/src/assembly/tarball.xml
deleted file mode 100644
index 600fb624..00000000
--- a/server/opensharing-server/src/assembly/tarball.xml
+++ /dev/null
@@ -1,47 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- opensharing-server-<version>.tar.gz: jars/ holds the server and its runtime dependencies,
-     bin/ the start script, and etc/conf editable copies of the settings in the jar. -->
-<assembly xmlns="http://maven.apache.org/ASSEMBLY/2.2.0"
-          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-          xsi:schemaLocation="http://maven.apache.org/ASSEMBLY/2.2.0
-                              https://maven.apache.org/xsd/assembly-2.2.0.xsd">
-  <id>tarball</id>
-  <formats>
-    <format>tar.gz</format>
-  </formats>
-  <includeBaseDirectory>false</includeBaseDirectory>
-
-  <dependencySets>
-    <dependencySet>
-      <outputDirectory>jars</outputDirectory>
-      <scope>runtime</scope>
-    </dependencySet>
-  </dependencySets>
-
-  <fileSets>
-    <fileSet>
-      <directory>${project.basedir}/../..</directory>
-      <outputDirectory/>
-      <includes>
-        <include>LICENSE</include>
-        <include>NOTICE</include>
-      </includes>
-    </fileSet>
-    <fileSet>
-      <directory>${project.build.directory}/generated-sources/license</directory>
-      <outputDirectory/>
-      <includes>
-        <include>THIRD-PARTY.txt</include>
-      </includes>
-    </fileSet>
-    <fileSet>
-      <directory>src/bin</directory>
-      <outputDirectory>bin</outputDirectory>
-      <fileMode>0755</fileMode>
-    </fileSet>
-    <fileSet>
-      <directory>src/main/resources</directory>
-      <outputDirectory>etc/conf</outputDirectory>
-    </fileSet>
-  </fileSets>
-</assembly>
diff --git a/server/opensharing-server/src/bin/start-opensharing-server b/server/opensharing-server/src/bin/start-opensharing-server
deleted file mode 100755
index adea268c..00000000
--- a/server/opensharing-server/src/bin/start-opensharing-server
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-# Starts the server from the unpacked tarball. Files in etc/conf take precedence over the copies
-# in the jars, and JAVA_OPTS passes JVM options such as -Dserver.port=9090.
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-
-# JAVA_OPTS is left unquoted so that it splits into separate options.
-# shellcheck disable=SC2086
-exec java ${JAVA_OPTS:-} -cp "$ROOT_DIR/etc/conf:$ROOT_DIR/jars/*" \
-  io.opensharing.OpenSharingServer "$@"
diff --git a/server/pom.xml b/server/pom.xml
index 92a07c85..abe987cd 100644
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -129,19 +129,6 @@
   </dependencyManagement>
 
   <build>
-    <resources>
-      <resource>
-        <directory>src/main/resources</directory>
-      </resource>
-      <resource>
-        <directory>${project.basedir}/../..</directory>
-        <targetPath>META-INF</targetPath>
-        <includes>
-          <include>LICENSE</include>
-          <include>NOTICE</include>
-        </includes>
-      </resource>
-    </resources>
     <pluginManagement>
       <plugins>
         <plugin>
@@ -194,11 +181,6 @@
           <artifactId>license-maven-plugin</artifactId>
           <version>2.5.0</version>
         </plugin>
-        <plugin>
-          <groupId>org.apache.maven.plugins</groupId>
-          <artifactId>maven-assembly-plugin</artifactId>
-          <version>3.7.1</version>
-        </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>
           <artifactId>flatten-maven-plugin</artifactId>

From 6c07af5a042806feb48408bb40a23e60e416d5d2 Mon Sep 17 00:00:00 2001
From: Sun Cao <sun.cao+data@databricks.com>
Date: Tue, 20 Oct 2026 15:16:29 -0700
Subject: [PATCH 7/7] Describe opensharing-server as the standalone server, and
 keep the parent out of release deploys too.

---
 server/opensharing-server/pom.xml |  2 +-
 server/pom.xml                    | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/server/opensharing-server/pom.xml b/server/opensharing-server/pom.xml
index 18b9a631..16f7c204 100644
--- a/server/opensharing-server/pom.xml
+++ b/server/opensharing-server/pom.xml
@@ -13,7 +13,7 @@
   <artifactId>opensharing-server</artifactId>
 
   <name>OpenSharing Reference Server</name>
-  <description>Runnable OpenSharing server for standalone deployments</description>
+  <description>Standalone OpenSharing server built on opensharing-server-core</description>
 
   <dependencies>
     <dependency>
diff --git a/server/pom.xml b/server/pom.xml
index abe987cd..ccf4c97f 100644
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -191,6 +191,11 @@
           <artifactId>maven-install-plugin</artifactId>
           <version>3.1.4</version>
         </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-deploy-plugin</artifactId>
+          <version>3.1.4</version>
+        </plugin>
       </plugins>
     </pluginManagement>
   </build>
@@ -275,6 +280,14 @@
               <skip>true</skip>
             </configuration>
           </plugin>
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-deploy-plugin</artifactId>
+            <inherited>false</inherited>
+            <configuration>
+              <skip>true</skip>
+            </configuration>
+          </plugin>
         </plugins>
       </build>
     </profile>