{"action":"opened","issue":{"url":"https://api.github.com/repos/sbt/sbt/issues/2001","labels_url":"https://api.github.com/repos/sbt/sbt/issues/2001/labels{/name}","comments_url":"https://api.github.com/repos/sbt/sbt/issues/2001/comments","events_url":"https://api.github.com/repos/sbt/sbt/issues/2001/events","html_url":"https://github.com/sbt/sbt/issues/2001","id":73477244,"number":2001,"title":"withSources() flag incorrectly exports source code","user":{"login":"htmldoug","id":663139,"avatar_url":"https://avatars.githubusercontent.com/u/663139?v=3","gravatar_id":"","url":"https://api.github.com/users/htmldoug","html_url":"https://github.com/htmldoug","followers_url":"https://api.github.com/users/htmldoug/followers","following_url":"https://api.github.com/users/htmldoug/following{/other_user}","gists_url":"https://api.github.com/users/htmldoug/gists{/gist_id}","starred_url":"https://api.github.com/users/htmldoug/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/htmldoug/subscriptions","organizations_url":"https://api.github.com/users/htmldoug/orgs","repos_url":"https://api.github.com/users/htmldoug/repos","events_url":"https://api.github.com/users/htmldoug/events{/privacy}","received_events_url":"https://api.github.com/users/htmldoug/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-06T00:52:05Z","updated_at":"2015-05-06T00:52:05Z","closed_at":null,"body":"The sbt `withSources()` flag incorrectly exposes source code as a classpath dependency of the artifact.\r\n\r\n## Steps\r\n1. git clone https://github.com/htmldoug/sbt-withSources-bug1.git\r\n2. sbt publishLocal\r\n3. open ~/.ivy2/local/default/sbt-withsources-bug1_2.10/0.1-SNAPSHOT/poms/sbt-withsources-bug1_2.10.pom\r\n4. observe that sources are exported as classpath dependencies\r\n```scala\r\n<dependency>\r\n    <groupId>com.typesafe</groupId>\r\n    <artifactId>config</artifactId>\r\n    <version>1.2.1</version>\r\n    <classifier>sources</classifier>\r\n</dependency>\r\n```\r\n\r\n## Problems\r\nUsing withSources()...\r\n```\r\nlibraryDependencies += \"com.typesafe\" % \"config\" % \"1.2.1\" withSources()\r\n```\r\n... causes the sources to be **exported in the pom**.\r\n\r\n```xml\r\n<dependency>\r\n    <groupId>com.typesafe</groupId>\r\n    <artifactId>config</artifactId>\r\n    <version>1.2.1</version>\r\n    <classifier>sources</classifier>\r\n</dependency>\r\n```\r\n\r\n1. This behavior is undocumented, surprising, and a security risk. In our play projects, sbt-native-packager happily gobbles up these classpath dependencies and **deploys our source code to our prod servers!** \r\n2. In downstream dependencies, I've seen sbt evict the classes dependency, e.g. `\"com.typesafe\" % \"config\" % \"1.2.1\"`, in favor of the sources jar! Example not included here (since sources shouldn't be exported in the first place), but I can create one if needed.\r\n\r\n## Expectations\r\nFrom [Download Sources](http://www.scala-sbt.org/0.13/docs/Library-Management.html#Download+Sources):\r\n\r\n> To have sbt download the dependency’s sources without using an IDE plugin, add withSources() to the dependency definition.\r\n\r\nThere is no mention of exposing the source code as a classpath dependency. I expect that this is not the correct behavior.\r\n\r\n## Notes\r\nExample here: https://github.com/htmldoug/sbt-withSources-bug1\r\n"}}