Distribution Policy for Third-Party OSS vs. Commercial Tomcat Dependencies

Products

• VMware Tanzu Spring Essentials

Issue/Introduction

Customers may notice that while certain Spring components (such as spring-boot-starter-jetty) include transitive dependencies like tomcat-embed-el, these third-party Open Source Software (OSS) libraries are not always present in the Broadcom customer-facing repositories (packages.broadcom.com).

 

Environment

VMware Tanzu Spring Essentials

Cause

Broadcom distinguishes between standard third-party OSS dependencies and commercial builds provided under the Spring Enterprise subscription:

Standard OSS Dependencies: Dependencies managed by the Spring team but released by external projects (e.g., standard Apache Tomcat OSS releases) are typically not mirrored on Broadcom's private repositories.
Commercial Builds: Packages found under packages.broadcom.com/spring-enterprise are often commercial versions or specific builds tailored for enterprise support, rather than standard OSS artifacts.

Resolution

Dependency Sourcing
Standard OSS Libraries: For dependencies like org.apache.tomcat.embed:tomcat-embed-el, customers should continue to download these directly from Maven Central. These follow the standard OSS distribution model.
Enterprise Artifacts: Only commercial builds and specific enterprise-supported packages are distributed via the Broadcom authenticated repositories.

Managed Dependencies
Even if a dependency is "managed" by the Spring team (defined in the Spring Boot BOM), the physical artifact distribution remains with the original project's repository (Maven Central) unless it is a specific commercial offering.