www-legal-discuss mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Paul Libbrecht <p...@activemath.org>
Subject Re: Axis2 dependencies mostly with ASL ?
Date Fri, 22 Dec 2006 14:48:46 GMT
For this reason I asked on this list... and not on one of the very many 
dependent projects of axis2...
So let's be concrete, xerces folks, if any on the list, can you answer 
about the org.w3c.dom packages ??
xbeans is part of Apache, anyone of xbeans down here ?



Davanum Srinivas wrote:
> Good Policy to cross check everything. When i doubt ask on the project
> mailing list.
> For Xmlbeans, check the xmlbeans distribution for their NOTICE/LICENSE
> files. Example see:
> http://svn.apache.org/repos/asf/xmlbeans/trunk/NOTICE.txt. the
> org.w3c.dom is repackaged version of classes from xerces i believe
> (under ASL 2.0). com.ctc is from woodstox project which releases under
> 2 licenses. we use the jars that are released under ASL 2.0
> For Stax, we use the stax api jar from the stax project (not from the 
> jcp page):
> http://stax.codehaus.org/
> For Geronimo, it's an Apache project under ASL2.0.
> As far as practice is concerned, each pmc/project team works hard to
> ensure that what we release in a ZIP/TAR as part of a apache project's
> release is "compatible" with our license and can be shipped as part of
> *your* product/service. So for example, we don't ship LGPL jars and we
> don't allow any GPL either.
> Bottom line, Cross check every jar from any software you wish to use.
> Ask on the project mailing list when in doubt.
> thanks,
> dims
> On 12/22/06, Paul Libbrecht <paul@activemath.org> wrote:
>> Hello,
>> I tried to check the dependencies of Axis2 that a colleague wanted to
>> include into ActiveMath.
>> Our policy is to make sure of the origin of the package and... I dare
>> say... he could have trusted the ASF having downloaded his archive from
>> there but I personally doubt.
>> My first complaints is that dependencies are not officially visible on
>> the website and that is a shame... why ??
>> But more seriously, in the Axis2 1.0 zip-archive that one can download,
>> under the lib directory I see the following content which surprise me:
>> - the xbeans jar is flagged with Apache license but it does have classes
>> belonging to a com.ctc.something and does also have org.w3c.dom classes.
>> I believe that at least the latter is wrong, the W3C has its own'
>> copyright I think.
>> - the StAX API is bundled under Apache license... which really surprises
>> me... this seems not coherent with the license you get when downloading
>> from the StAX JCP page and is especially surprising for a javax 
>> something.
>> - I seem to see several other bundled classes with a different origin,
>> in particular, geronimo-activation, geronimo-jms, and and 
>> geronimo-javamail.
>> So what is the policy of Apache Foundation for this ? My colleague is of
>> the opinion that "if we get if from ASF we're safe and we can believe
>> it"... so I understand that if we get ever sued for this we can turn to
>> accuse ASF... I don't really believe that.
>> Would it be a more correct practice to actually store the rights to
>> transmit such archives under, say, the APL, in a shared place,
>> potentially visible by others (e.g. a donation maybe) ?
>> thanks
>> paul

View raw message