You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@jackrabbit.apache.org by Jeremias Maerki <de...@jeremias-maerki.ch> on 2008/05/30 10:22:21 UTC

List of dependencies with licenses available?

I'm looking for a list of dependencies for Jackrabbit including their
licenses. Can anyone give me a pointer?

Thanks,
Jeremias Maerki

Re: List of dependencies with licenses available?

Posted by Jukka Zitting <ju...@gmail.com>.

Hi,

On Fri, May 30, 2008 at 11:30 AM, Felix Meschberger <fm...@gmail.com> wrote:
> Am Freitag, den 30.05.2008, 10:22 +0200 schrieb Jeremias Maerki:
>> I'm looking for a list of dependencies for Jackrabbit including their
>> licenses. Can anyone give me a pointer?
>
> The non-Apache licensed dependencies should be listed in the NOTICE file
> along with references to their respective license.

We don't do that for example for jackrabbit-core as we don't
distribute the dependencies along with jackrabbit-core releases.
However, we should do that for things like jackrabbit-webapp and
jackrabbit-jca, but now that I checked I realized we aren't doing
that. I'll file an issue to fix that.

> All dependencies should be available from the POM file -- running
> the maven dependency report (the project-info-reports:dependencies
> goal might be your friend).

Here's a summary of external (non-Jackrabbit) dependencies bundled
with jackrabbit-webapp:

Apache License, version 2.0
    commons-collections 3.1
    commons-io 1.4
    commons-logging 1.1
    commons-httpclient 3.0
    commons-codec 1.2
    derby 10.2.1.6
    log4j 1.2.13
    lucene-core 2.2.0
    poi 3.0.2-FINAL
    poi-scratchpad 3.0.2-FINAL
    xercesImpl 2.8.1
    xml-apis 1.3.03

Concurrent (public domain / Sun)
    concurrent 1.3.4

PDFBox (BSD)
    pdfbox 0.6.4

CyberNeko (Apache 1.1)
    nekohtml 0.9.4

SLF4J (MIT)
    jcl104-over-slf4j 1.3.0
    slf4j-api 1.3.0
    slf4j-log4j12 1.3.0

Hmm, there's a duplicate commons-logging dependency (we should use
only jcl104-over-slf4j), I'll file an issue for that as well.

> Maybe we should add the ouput of this report to the Jackrabbit site --
> if it ain't there and my eyes are too week today ?

Good idea, let's do that.

BR,

Jukka Zitting

Re: List of dependencies with licenses available?

Posted by Jeremias Maerki <de...@jeremias-maerki.ch>.

Hi Felix

On 30.05.2008 10:30:53 Felix Meschberger wrote:
> Hi Jeremias,
> 
> Am Freitag, den 30.05.2008, 10:22 +0200 schrieb Jeremias Maerki:
> > I'm looking for a list of dependencies for Jackrabbit including their
> > licenses. Can anyone give me a pointer?
> 
> The non-Apache licensed dependencies should be listed in the NOTICE file
> along with references to their respective license.

Unfortunately, that's not the case for org.textmining, for example:
http://svn.apache.org/viewvc/jackrabbit/tags/1.4/jackrabbit-text-extractors/NOTICE.txt?view=markup
http://svn.apache.org/viewvc/jackrabbit/tags/1.4/jackrabbit-text-extractors/LICENSE.txt?view=markup
http://svn.apache.org/viewvc/jackrabbit/tags/1.4/jackrabbit-text-extractors/README.txt?view=markup
http://svn.apache.org/viewvc/jackrabbit/tags/1.4/jackrabbit-text-extractors/pom.xml?view=markup

The same applies to SLF4J, as another example.

> All dependencies
> should be available from the POM file -- running the maven dependency
> report (the project-info-reports:dependencies goal might be your
> friend).

I tried "project-info-reports:dependencies" but it doesn't list the
licenses on the dependencies themselves. The top-level report just says
that there are no dependencies. Running the report for each module is
not giving me much more. I still have to track down the license manually
for each non-ASF artifact via the project URLs. In the case of the
org.textmining dependency the license prior to 1.0 (now LGPL) cannot
even be determined since the JAR doesn't contain information about the
license and the authors didn't use branch/tag for the 0.4 release. Stuff
like that makes a license audit very difficult.

In the end, I don't think Maven can be our friend at the moment to
provide the necessary information for a license audit. Even the POMs
lack the necessary entries. And what if, as in the case of
org.textmining, the license suddenly changes?

> Maybe we should add the ouput of this report to the Jackrabbit site --
> if it ain't there and my eyes are too week today ?

I haven't found it. Yes, please add such a report. Or better even: a
section in the top-level README.txt that lists all dependencies with
their licenses. Something like the following would make the job much
easier:
http://svn.apache.org/viewvc/xmlgraphics/fop/trunk/lib/README.txt?revision=638396

> Hope this helps.
> 
> Regards
> Felix

Thanks,
Jeremias Maerki

Re: List of dependencies with licenses available?

Posted by Felix Meschberger <fm...@gmail.com>.

Hi Jeremias,

Am Freitag, den 30.05.2008, 10:22 +0200 schrieb Jeremias Maerki:
> I'm looking for a list of dependencies for Jackrabbit including their
> licenses. Can anyone give me a pointer?

The non-Apache licensed dependencies should be listed in the NOTICE file
along with references to their respective license. All dependencies
should be available from the POM file -- running the maven dependency
report (the project-info-reports:dependencies goal might be your
friend).

Maybe we should add the ouput of this report to the Jackrabbit site --
if it ain't there and my eyes are too week today ?

Hope this helps.

Regards
Felix