www-legal-discuss mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Marvin Humphrey (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (LEGAL-299) Category-X Dependency in Incubator Project
Date Sat, 15 Apr 2017 19:42:42 GMT

    [ https://issues.apache.org/jira/browse/LEGAL-299?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15970097#comment-15970097
] 

Marvin Humphrey commented on LEGAL-299:
---------------------------------------

We need to distinguish between various "Category X" licenses.  The LGPL 2.1 makes a distinction
between a "derivative work" and a "work that uses the Library".

{quote}
5. A program that contains no derivative of any portion of the Library, but is designed to
work with the Library by being compiled or linked with it, is called a "work that uses the
Library". Such a work, in isolation, is not a derivative work of the Library, and therefore
falls outside the scope of this License. [...] 
{quote}

So long as the Guacamole Client extension source code which invokes the jRadius API qualifies
as a "work which uses the Library" (and this ought to be the case -- see https://www.gnu.org/licenses/lgpl-java.en.html
), then it does not need to be licensed under the LGPL.  Therefore the requirements of the
LGPL do not pose an obstacle to licensing said code under the ALv2 and shipping it in a Guacamole
source release package advertised as ALv2.

However, we do have *policy* concerns about the LGPL, which is why it is in "Category X" and
Apache products may not have mandatory LGPL dependencies.  In a nutshell, the LGPL's reverse-engineering
provisions impose conditions on the combined work that we cannot live with -- see the comment
at https://s.apache.org/ToOC from Roy Fielding on LEGAL-192 for more insight.

Since you indicate that the dependency on jRadius is optional, though, the criteria described
at http://www.apache.org/legal/resolved.html#optional may apply.  From your description, it
would seem that the answer to the following question is "yes".

{quote}
"Will the majority of users want to use my product without adding the optional components?"
{quote}

And since that's the case, I see no reason to object.




> Category-X Dependency in Incubator Project
> ------------------------------------------
>
>                 Key: LEGAL-299
>                 URL: https://issues.apache.org/jira/browse/LEGAL-299
>             Project: Legal Discuss
>          Issue Type: Question
>            Reporter: Nick Couchman
>
> I'm currently contributing code to the Guacamole project, which is in the Incubator phase
with ASF.  One of the items I'm contributing is an extension to the Guacamole Client that
supports RADIUS authentication.  The extension that I've written includes a binary dependency
on the JRadius library, which is licensed under LGPL-2.1, a license not compatible with the
Apache 2.0 license and listed in the Category-X section on the ASF legal page.
> We have been through several rounds of discussions in the project and on the Incubator
General list about the acceptability of including this extension in the project.  At this
point we have determined that it is definitely not acceptable to distribute a binary form
of this extension that would include the binary (JAR) of the JRadius library.  However, if
possible, we'd like to include the source code for this extension in the main repository,
with instructions to users on building the extension.  Based on the information provided on
the ASF legal page, we believe this is acceptable, but would like to have verification on
that.
> All of the source code in the extension is Apache 2.0 licensed.  There is no source code
included from the JRadius library, only calls to classes and methods provided by the library.
> Finally, the source code in question is for an optional extension to the Guacamole Client
project, and is not core to its functionality.  It allows a user to perform RADIUS authentication
with the Guacamole Client, if they so choose, and other authentication modules are also available.
> Given the above information, can we get some guidance on whether or not including the
source code for the extension (*not* the JRadius library) in this ASF Incubator project is
acceptable?



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org


Mime
View raw message