www-legal-discuss mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Nick Couchman (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (LEGAL-299) Category-X Dependency in Incubator Project
Date Sun, 16 Apr 2017 18:35:41 GMT

    [ https://issues.apache.org/jira/browse/LEGAL-299?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15970476#comment-15970476

Nick Couchman commented on LEGAL-299:

Thank you for the response.  It sounds like we're okay to push forward with this dependency,
but I wanted to ask one minor follow-up question, regarding this section:

However, we do have policy concerns about the LGPL, which is why it is in "Category X" and
Apache products may not have mandatory LGPL dependencies.
Since you indicate that the dependency on jRadius is optional, though...

I wanted to clarify the following:
- As the entire Guacamole project, particularly the Guacamole Client code, goes, this holds
true - you do not need the RADIUS authentication extension, and, therefore, the jRADIUS library,
in order to operate the Guacamole Client - you can use one of the other authentication methods
without the RADIUS code.
- As far as the Guacamole RADIUS authentication extension goes, the jRADIUS dependency is
required - the RADIUS extension won't operate without a Java RADIUS library, and jRADIUS is,
really, the only one out there.

So, the project itself meets this requirement; the extension does not.  I just want to make
sure that is still okay - that this is targeted at the Project code overall and not on a specific
change we're introducing.


> Category-X Dependency in Incubator Project
> ------------------------------------------
>                 Key: LEGAL-299
>                 URL: https://issues.apache.org/jira/browse/LEGAL-299
>             Project: Legal Discuss
>          Issue Type: Question
>            Reporter: Nick Couchman
> I'm currently contributing code to the Guacamole project, which is in the Incubator phase
with ASF.  One of the items I'm contributing is an extension to the Guacamole Client that
supports RADIUS authentication.  The extension that I've written includes a binary dependency
on the JRadius library, which is licensed under LGPL-2.1, a license not compatible with the
Apache 2.0 license and listed in the Category-X section on the ASF legal page.
> We have been through several rounds of discussions in the project and on the Incubator
General list about the acceptability of including this extension in the project.  At this
point we have determined that it is definitely not acceptable to distribute a binary form
of this extension that would include the binary (JAR) of the JRadius library.  However, if
possible, we'd like to include the source code for this extension in the main repository,
with instructions to users on building the extension.  Based on the information provided on
the ASF legal page, we believe this is acceptable, but would like to have verification on
> All of the source code in the extension is Apache 2.0 licensed.  There is no source code
included from the JRadius library, only calls to classes and methods provided by the library.
> Finally, the source code in question is for an optional extension to the Guacamole Client
project, and is not core to its functionality.  It allows a user to perform RADIUS authentication
with the Guacamole Client, if they so choose, and other authentication modules are also available.
> Given the above information, can we get some guidance on whether or not including the
source code for the extension (*not* the JRadius library) in this ASF Incubator project is

This message was sent by Atlassian JIRA

To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org

View raw message