Mailing-List: contact dev-help@geronimo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@geronimo.apache.org
Received-SPF: pass (nike.apache.org: domain of kevan.miller@gmail.com
 designates 209.85.220.169 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CALvfXiJTjY246Pf7b-eWJe2DF=e7Jc_XCxnXQjD5RxmMaJ73tw@mail.gmail.com>
References: 
 <CALvfXiJTjY246Pf7b-eWJe2DF=e7Jc_XCxnXQjD5RxmMaJ73tw@mail.gmail.com>
Date: Sun, 13 Jul 2014 19:36:19 -0700
Message-ID: 
 <CAM1oqKqGYevfJe2My-AJpVDcm4+crK7=QiFt=+GdGEbC3dLonA@mail.gmail.com>
Subject: Re: Your project uses a possibly LGPL dependency:
 com.icegreen.greenmail:greenmail
From: Kevan Miller <kevan.miller@gmail.com>
To: dev@geronimo.apache.org
Cc: dev@syncope.apache.org, dev@oodt.apache.org, dev@oozie.apache.org,
	java-dev@axis.apache.org
Content-Type: multipart/alternative; boundary=047d7b66f5fbf8c66f04fe1e27f0

--047d7b66f5fbf8c66f04fe1e27f0
Content-Type: text/plain; charset=ISO-8859-1

Thanks Steve. For clarity:

This message announces a license switch for Greenmail --
http://sourceforge.net/p/greenmail/mailman/message/58953/
However, some/most/all of the src license headers are still labeled as
LGPL. There would also be general questions about the license switch --
were all necessary copyrights properly held to make this license switch?
And subsequent to the switch were all changes/contributions made under ALv2?

Depending on the outcome of these questions, you may or may not want to
treat the greenmail dependency as LGPL. Assuming it is held to be LGPL,
then a question of how the dependency is used? Bundling an LGPL dependency
is bad. Direct source linkage to LGPL, likewise. Simple build / test maven
dependency would be OK from an ASF perspective...


On Sat, Jul 12, 2014 at 12:36 PM, Steve Rowe <sarowe@gmail.com> wrote:

> Hi, my name is Steve Rowe, and I'm a member of the Apache Lucene PMC.
>
> We recently discovered that the "greenmail" Java library, which declares
> its license as ASLv2 in its POM and elsewhere, has LGPL license headers in
> its source code files.  In response the Lucene project reverted a recent
> commit containing this depedency.
>
> I conducted a survey of current Apache releases and found that four Apache
> projects include source code that links to the "greenmail" library:
> Syncope, OODT, Oozie and Geronimo.  Additionally, Axis2 has a Maven POM
> that includes a "greenmail" dependency, though I couldn't find any current
> releases containing this dependency.  Details are posted on <
> https://issues.apache.org/jira/browse/LEGAL-206>; I would appreciate your
> project's involvement.
>
> An issue was filed with the greenmail project on Sourceforge earlier this
> year asking for clarification <http://sourceforge.net/p/greenmail/bugs/8/>,
> but there has been no response on that issue, or any other issue, for that
> matter - the project may be dead, as it has seen no activity for some time.
>
> Steve
>

--047d7b66f5fbf8c66f04fe1e27f0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Thanks Steve. For clarity:<div><br></div><div>This message=
 announces a license switch for Greenmail -- <a href=3D"http://sourceforge.=
net/p/greenmail/mailman/message/58953/">http://sourceforge.net/p/greenmail/=
mailman/message/58953/</a></div>
<div>However, some/most/all of the src license headers are still labeled as=
 LGPL. There would also be general questions about the license switch -- we=
re all necessary copyrights properly held to make this license switch? And =
subsequent to the switch were all changes/contributions made under ALv2?</d=
iv>
<div><br></div><div>Depending on the outcome of these questions, you may or=
 may not want to treat the greenmail dependency as LGPL. Assuming it is hel=
d to be LGPL, then a question of how the dependency is used? Bundling an LG=
PL dependency is bad. Direct source linkage to LGPL, likewise. Simple build=
 / test maven dependency would be OK from an ASF perspective...</div>
</div><div class=3D"gmail_extra"><br><br><div class=3D"gmail_quote">On Sat,=
 Jul 12, 2014 at 12:36 PM, Steve Rowe <span dir=3D"ltr">&lt;<a href=3D"mail=
to:sarowe@gmail.com" target=3D"_blank">sarowe@gmail.com</a>&gt;</span> wrot=
e:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div><div><div>Hi, my name =
is Steve Rowe, and I&#39;m a member of the Apache Lucene PMC.<br><br>We rec=
ently discovered that the &quot;greenmail&quot; Java library, which declare=
s its license as ASLv2 in its POM and elsewhere, has LGPL license headers i=
n its source code files.=A0 In response the Lucene project reverted a recen=
t commit containing this depedency.<br>

<br></div><div>I conducted a survey of current Apache releases and found th=
at four Apache projects include source code that links to the &quot;greenma=
il&quot; library: Syncope, OODT, Oozie and Geronimo.=A0 Additionally, Axis2=
 has a Maven POM that includes a &quot;greenmail&quot; dependency, though I=
 couldn&#39;t find any current releases containing this dependency.=A0 Deta=
ils are posted on &lt;<a href=3D"https://issues.apache.org/jira/browse/LEGA=
L-206" target=3D"_blank">https://issues.apache.org/jira/browse/LEGAL-206</a=
>&gt;; I would appreciate your project&#39;s involvement.<br>

</div><div><br></div>An issue was filed with the greenmail project on Sourc=
eforge earlier this year asking for clarification &lt;<a href=3D"http://sou=
rceforge.net/p/greenmail/bugs/8/" target=3D"_blank">http://sourceforge.net/=
p/greenmail/bugs/8/</a>&gt;, but there has been no response on that issue, =
or any other issue, for that matter - the project may be dead, as it has se=
en no activity for some time.<span class=3D"HOEnZb"><font color=3D"#888888"=
><br>

<br></font></span></div><span class=3D"HOEnZb"><font color=3D"#888888">Stev=
e<br></font></span></div></div>
</blockquote></div><br></div>

--047d7b66f5fbf8c66f04fe1e27f0--