Mailing-List: contact user-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Users Mailing List" <user@struts.apache.org>
Received-SPF: pass (athena.apache.org: domain of musachy@gmail.com designates
 209.85.162.177 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type:content-transfer-encoding;
        b=A1PpW2xG1a7sKNMCmiwPCxKtMRPhPdvls9Px1Br4p8UljMiLlDdRYao3a0C/yiUvb+
         dzwXMmAKzJnevkBvEB/QWWXycWbfJ7EzUXJlEa0N6vQj4NP5s479z4sIex/yIO7KKOSz
         uJlHL4m6fULVftyUj5lPwcaRZgPjFvOhtqCCk=
MIME-Version: 1.0
In-Reply-To: <fadcf8240903030632w6437cc25w1168dfb188f8a534@mail.gmail.com>
References: <fadcf8240903030632w6437cc25w1168dfb188f8a534@mail.gmail.com>
Date: Tue, 3 Mar 2009 13:54:34 -0500
Message-ID: <d8bdeb6f0903031054v64ea35b6qb94e8ebb49fa3c3a@mail.gmail.com>
Subject: Re: [OT] POM, licenses and dependency trees
From: Musachy Barroso <musachy@gmail.com>
To: Struts Users Mailing List <user@struts.apache.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

All the dependencies that we have, must have a license that is
compatible with ASL 2. I don't know of any way to compile a list of
licenses used, that would be cool for a maven plugin.

musachy

On Tue, Mar 3, 2009 at 9:32 AM,  <stanlick@gmail.com> wrote:
> How does a company go about fleshing out the aspects of FOSS without wast=
ing
> so many people's time? =A0As FOSS gains in popularity, we are sinking in =
a
> quagmire of manual research, analysis and legal license inspections. =A0I=
t
> seems the FOSSology product will unpack compressed files and sniff around
> for licenses while on the other side of the planet we have Maven
> repositories that understand version dependencies -- but there is a void =
in
> bring them together!
>
> In an attempt to follow a concrete day-in-the-job, let us consider
> struts2.1.6 and let's further suppose that we plan to take advantage of a=
ll
> the downstream dependencies it offers (i.e. optionals).
>
>
> =A0 1. Is there a version specific dependency tree mechanically available=
?
> =A0 =A0 =A0- Will subsequent versions eventually appear in the same
> =A0 =A0 =A0location.format?
> =A0 2. What technique to use in determining the stack of licenses gleaned
> =A0 from this tree?
>
> I see developers struggling to bring together the jars necessary to do a
> build, which is time consuming and expensive. =A0I see a legal team in th=
e
> other building struggling to ascertain our risk, should this "stack" be
> implemented.
>
> P.S. Does anyone here have first hand experience with FOSSology?
>
> Peace,
> Scott
>


--=20
"Hey you! Would you help me to carry the stone?" Pink Floyd

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org