Are there maven-plugins that should not be used in opensource projects?
...
In other words: Is it save to ignore the plugins when looking for license restrictions?
Update: bmargulies's answer is what I feared but:
Q: Is there an actual plugin that I could not use in a non-open project distributed to customers ?
It's not really possible to answer the question about the existence of a maven plugin, somewhere, in some repository. Not all Maven plugins are even on Maven central.
A maven plugin could, certainly, plop a lump of IP into your project with a license that is incompatible with your needs. And no protocol in Maven forces a plugin to announce this in any obvious way.
In the absolute worst case, some jerk could hide some proprietary content in a plugin and deposit it in binary in your output, and then later come around and claim that what you've built is a derived work and you owe, you owe.
At the end of the day, you're never completely safe in the land of open source unless you, well, read the source. If you are going to use a Maven plugin that is not from one of the mainstream sources, you would be well-advised to take a gander at its source even if you aren't worried about some sort of unpleasant IP implant.
There's a sort of trivial example in the form of the maven-archetype-plugin. It generates source code from templates licensed under the terms of the Apache License. Someone could claim that this makes the generated code into a derived work of the template, and subject to the terms of the AL. Or, worse, someone could push a template with some troublesome license, and nothing in the archetype plugin warns you when you select an archetype as to what the licensing is.
The archetype plugin creates sources from an apache-licensed template. from an extreme viewpoint, that is an examples.
