cloudstack-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From David Nalley <>
Subject Re: dependencies on prohibited license components
Date Mon, 02 Jul 2012 16:58:15 GMT
On Mon, Jul 2, 2012 at 3:20 AM, Murali Reddy <> wrote:
> Currently CloudStack has dependencies on third party software that are under 'excluded
license' [1] or does not fall under category A/B licenses. While effort in underway [2] to
remove the dependencies, I want to bring to the discussion on what is the best approach for
CloudStack to remove the dependencies. As a orchestration software CloudStack deals/designed
to deal with diverse set of Hypervisors, networking devices and file systems etc. While the
core orchestration software can be made not to depend on the third party software which are
not under ASF license, support for hypervisor etc might require dependency on thirty party
software that are not under ASF friendly license. For e.g. in order to  manage Vmware and
Kvm hypervisors CloudStack is using Vmware and libvirt libraries. While support software for
the Vmware/Kvm can treated as optional components of CloudStack, critical value comes from
these optional components. Given this, following seems to some obvious options.
>  *   Keep CloudStack code that integrates with third party libraries in the repo. But
exclude it from the default build targets. Expect the users/developers to download the compile
dependencies and modify the build settings to include the code. But this will take out the
critical support for Vmware etc in the default build.
>  *   Have the compile tasks pull the dependent components from non-asf repo's. Apache
Cassandra, Hadoop projects seems to have maven/ivy tasks to pull the compile dependencies
on build from remote maven repos. Can third-party software that are not under ASF license
can be hosted on remote repo?
> Perhaps mentors or any one who has knowledge of how other apache projects deal with such
dependencies can share the knowledge.
> [1]<>l
> [2]


Thanks for bringing this topic to the list.
While I think we need to figure out a general rule, I don't know that
we can apply it universally.  I worry that because there are so many
potential issues - and the potential outcome has not yet been decided
for each that we will end up needing to discuss them specifically.

For instance, we removed jnetpcap altogether as we weren't using it;
do we continue with a dependency on the VMware SDK or do we instead
rip it out and replace it entirely with something else? Is Paramiko
really used or not?


View raw message