www-legal-discuss mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Christian Müller <christian.muel...@gmail.com>
Subject Re: transitive 3rd party dependencies
Date Thu, 26 Jun 2014 20:03:16 GMT
Thanks for the timely response.

Our release artifacts do not include any prohibited jars.
One of our artifacts (camel-infinispan) has a dependency to infinispan-core
(ASL 2.0) which has a dependency to jboss-marshalling (GNU LGPL). This
means:
- If you build the Camel release, it will download the prohibited jar via
the Maven dependency resolution (is this a "deliberate action"?).
- You can compile the camel-infinispan component without the need of the
prohibited jar.
- You cannot execute the camel-infinispan junit tests without the
prohibited jar.
- You cannot use the camel-infinispan component without the prohibited jar.

I looking for clarification whether this is an issue or not and, if it's an
issue, what the appropriate action the Camel PMC should do.

Thanks in advance,
Christian
-----------------

Software Integration Specialist

Apache Member
V.P. Apache Camel | Apache Camel PMC Member | Apache Camel committer
Apache Incubator PMC Member



On Wed, Jun 25, 2014 at 2:15 AM, sebb <sebbaz@gmail.com> wrote:

> On 24 June 2014 18:39, Christian Müller <christian.mueller@gmail.com>
> wrote:
> > Hi list!
> >
> > In Camel, we have a component to interface with Infinispan. All our
> direct
> > dependencies are in line with [1]. However, the infinispan-core artifact
> is
> > AL 2.0 [2], but some of the dependencies (e.g. jboss-marshalling
> 1.3.18.GA)
> > are GNU LGPL which are excepted at Apache.
> >
> > What should we do with these two releases (Camel Infinispan 2.13.0 and
> > 2.13.1 are affected)?
>
> In what way is the release affected?
> Does it include any prohibited jars?
>
> I just downloaded apache-camel-2.13.1.tar.gz and it does not seem to
> include any files with jboss or marshal in the name.
>
> ASF binary bundles must only include code that is AL2.0 or compatible with
> it.
> However they can depend on prohibited jars so long as:
> - they are not included in the ASF bundle
> - they are optional, i.e. the app will still work without them
> - the user has to take deliberate action to download them
>
> One reason for this is to avoid suprises for downstream users, who
> have a right to expect that the download is licensed under AL2.0.
>
> > We have fixed this probable issue in all of our actual branches.
> >
> > [INFO]
> > ------------------------------------------------------------------------
> > [INFO] Building Camel :: Infinispan 2.13.0
> > [INFO]
> > ------------------------------------------------------------------------
> > [INFO]
> > [INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @
> camel-infinispan
> > ---
> > [INFO] org.apache.camel:camel-infinispan:bundle:2.13.0
> > [INFO] +- org.apache.camel:camel-core:jar:2.13.0:compile
> > [INFO] |  \- org.slf4j:slf4j-api:jar:1.6.6:compile
> > [INFO] +- org.infinispan:infinispan-core:jar:6.0.1.Final:compile
> > [INFO] |  +- org.infinispan:infinispan-commons:jar:6.0.1.Final:compile
> > [INFO] |  +- org.jgroups:jgroups:jar:3.4.1.Final:compile
> > [INFO] |  +-
> >
> org.jboss.spec.javax.transaction:jboss-transaction-api_1.1_spec:jar:1.0.1.Final:compile
> > [INFO] |  +-
> > org.jboss.marshalling:jboss-marshalling-river:jar:1.3.18.GA:compile
> > [INFO] |  +- org.jboss.marshalling:jboss-marshalling:jar:1.3.18.GA:
> compile
> > [INFO] |  \- org.jboss.logging:jboss-logging:jar:3.1.2.GA:compile
> > [INFO] +- org.infinispan:infinispan-client-hotrod:jar:6.0.1.Final:compile
> > [INFO] |  \- commons-pool:commons-pool:jar:1.6:compile
> > [INFO] +- org.apache.camel:camel-test:jar:2.13.0:test
> > [INFO] +- org.slf4j:slf4j-log4j12:jar:1.7.6:test
> > [INFO] |  \- log4j:log4j:jar:1.2.17:test
> > [INFO] +- junit:junit:jar:4.11:test
> > [INFO] |  \- org.hamcrest:hamcrest-core:jar:1.3:test
> > [INFO] +- org.mockito:mockito-all:jar:1.9.5:test
> > [INFO] +- org.apache.camel:apt:jar:2.13.0:provided
> > [INFO] |  \- org.apache.camel:spi-annotations:jar:2.13.0:provided
> > [INFO] \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:compile
> >
> > [1] http://www.apache.org/legal/3party.html
> > [2]
> >
> http://search.maven.org/remotecontent?filepath=org/infinispan/infinispan-parent/6.0.1.Final/infinispan-parent-6.0.1.Final.pom
> > [3]
> >
> http://search.maven.org/remotecontent?filepath=org/jboss/marshalling/jboss-marshalling-parent/1.3.18.GA/jboss-marshalling-parent-1.3.18.GA.pom
> >
> > Thanks in advance,
> > Christian
> > -----------------
> >
> > Software Integration Specialist
> >
> > Apache Member
> > V.P. Apache Camel | Apache Camel PMC Member | Apache Camel committer
> > Apache Incubator PMC Member
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
> For additional commands, e-mail: legal-discuss-help@apache.org
>
>

Mime
View raw message