Details
Description
In the commons-net-2.0.zip binary release, find commons-net-2.0.jar
This JAR contains "org.apache.commons.net.nntp.ThreadContainer.class" which has no counterpart in any of the released source archives (I checked commons-net-2.0-sources.jar which is included in the binary dist as well as the original source dist). Looking in SVN, the source is also not there: http://svn.apache.org/viewvc/commons/proper/net/trunk/src/java/org/apache/commons/net/nntp/
I find this issue problematic, because if I am unable to check the provenience of that binary file, I might be introducing license problems. Just assume that the problematic "ThreadContainer.class" contains GPL'd code, I might end up running into severe issues.