Mailing-List: contact legal-discuss-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: legal-discuss@apache.org
Date: Tue, 18 Apr 2017 14:39:41 +0000 (UTC)
From: "Marvin Humphrey (JIRA)" <jira@apache.org>
To: legal-discuss@apache.org
Message-ID: <JIRA.13063843.1492101845000.306500.1492526381653@Atlassian.JIRA>
In-Reply-To: <JIRA.13063843.1492101845000@Atlassian.JIRA>
References: <JIRA.13063843.1492101845000@Atlassian.JIRA> <JIRA.13063843.1492101845734@jira-lw-us.apache.org>
Subject: [jira] [Commented] (LEGAL-299) Category-X Dependency in Incubator
 Project
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Tue, 18 Apr 2017 14:39:44 -0000


    [ https://issues.apache.org/jira/browse/LEGAL-299?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15972811#comment-15972811 ] 

Marvin Humphrey commented on LEGAL-299:
---------------------------------------

{quote}
If a user chooses to download the source and build it themselves, they will get the RADIUS extension, which will then pull in the Cat-X dependency.
{quote}

People who build an ASF product expect an ALv2 binary.  What you're describing will incorporate an LGPL dependency by default, violating that expectation.

It should take an explicit action on the part of the user to bring in the LGPL dependency, such as adding a command-line flag or changing a configuration file.


> Category-X Dependency in Incubator Project
> ------------------------------------------
>
>                 Key: LEGAL-299
>                 URL: https://issues.apache.org/jira/browse/LEGAL-299
>             Project: Legal Discuss
>          Issue Type: Question
>            Reporter: Nick Couchman
>
> I'm currently contributing code to the Guacamole project, which is in the Incubator phase with ASF.  One of the items I'm contributing is an extension to the Guacamole Client that supports RADIUS authentication.  The extension that I've written includes a binary dependency on the JRadius library, which is licensed under LGPL-2.1, a license not compatible with the Apache 2.0 license and listed in the Category-X section on the ASF legal page.
> We have been through several rounds of discussions in the project and on the Incubator General list about the acceptability of including this extension in the project.  At this point we have determined that it is definitely not acceptable to distribute a binary form of this extension that would include the binary (JAR) of the JRadius library.  However, if possible, we'd like to include the source code for this extension in the main repository, with instructions to users on building the extension.  Based on the information provided on the ASF legal page, we believe this is acceptable, but would like to have verification on that.
> All of the source code in the extension is Apache 2.0 licensed.  There is no source code included from the JRadius library, only calls to classes and methods provided by the library.
> Finally, the source code in question is for an optional extension to the Guacamole Client project, and is not core to its functionality.  It allows a user to perform RADIUS authentication with the Guacamole Client, if they so choose, and other authentication modules are also available.
> Given the above information, can we get some guidance on whether or not including the source code for the extension (*not* the JRadius library) in this ASF Incubator project is acceptable?


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org