www-legal-discuss mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Davanum Srinivas" <dava...@gmail.com>
Subject Re: Axis2 dependencies mostly with ASL ?
Date Fri, 22 Dec 2006 14:40:58 GMT
Good Policy to cross check everything. When i doubt ask on the project
mailing list.

For Xmlbeans, check the xmlbeans distribution for their NOTICE/LICENSE
files. Example see:
http://svn.apache.org/repos/asf/xmlbeans/trunk/NOTICE.txt. the
org.w3c.dom is repackaged version of classes from xerces i believe
(under ASL 2.0). com.ctc is from woodstox project which releases under
2 licenses. we use the jars that are released under ASL 2.0

For Stax, we use the stax api jar from the stax project (not from the jcp page):

For Geronimo, it's an Apache project under ASL2.0.

As far as practice is concerned, each pmc/project team works hard to
ensure that what we release in a ZIP/TAR as part of a apache project's
release is "compatible" with our license and can be shipped as part of
*your* product/service. So for example, we don't ship LGPL jars and we
don't allow any GPL either.

Bottom line, Cross check every jar from any software you wish to use.
Ask on the project mailing list when in doubt.


On 12/22/06, Paul Libbrecht <paul@activemath.org> wrote:
> Hello,
> I tried to check the dependencies of Axis2 that a colleague wanted to
> include into ActiveMath.
> Our policy is to make sure of the origin of the package and... I dare
> say... he could have trusted the ASF having downloaded his archive from
> there but I personally doubt.
> My first complaints is that dependencies are not officially visible on
> the website and that is a shame... why ??
> But more seriously, in the Axis2 1.0 zip-archive that one can download,
> under the lib directory I see the following content which surprise me:
> - the xbeans jar is flagged with Apache license but it does have classes
> belonging to a com.ctc.something and does also have org.w3c.dom classes.
> I believe that at least the latter is wrong, the W3C has its own'
> copyright I think.
> - the StAX API is bundled under Apache license... which really surprises
> me... this seems not coherent with the license you get when downloading
> from the StAX JCP page and is especially surprising for a javax something.
> - I seem to see several other bundled classes with a different origin,
> in particular, geronimo-activation, geronimo-jms, and and geronimo-javamail.
> So what is the policy of Apache Foundation for this ? My colleague is of
> the opinion that "if we get if from ASF we're safe and we can believe
> it"... so I understand that if we get ever sued for this we can turn to
> accuse ASF... I don't really believe that.
> Would it be a more correct practice to actually store the rights to
> transmit such archives under, say, the APL, in a shared place,
> potentially visible by others (e.g. a donation maybe) ?
> thanks
> paul

Davanum Srinivas : http://www.wso2.net (Oxygen for Web Service Developers)

DISCLAIMER: Discussions on this list are informational and educational
only.  Statements made on this list are not privileged, do not
constitute legal advice, and do not necessarily reflect the opinions
and policies of the ASF.  See <http://www.apache.org/licenses/> for
official ASF policies and documents.
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org

View raw message