You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by chris snow <ch...@gmail.com> on 2014/05/23 17:19:10 UTC
Fediz IDP - implication of removing OGNL dependency?
I'm currently evaluating Fediz 1.1 for my company, but noticed that
the IDP has an OGNL dependency that in turn requires Javassist which
is LGPL:
I would have to jump through hoops to get LGPL approved, so I was
wondering what the implications would be if I removed the OGNL
dependency.
The main reference to OGNL that I could find is:
src/main/webapp/WEB-INF/idp-servlet.xml: <bean
id="expressionParser"
class="org.springframework.webflow.expression.WebFlowOgnlExpressionParser"
/>
Does anyone know the impact of replacing OGNL with SpringEL in the IDP?
Re: Fediz IDP - implication of removing OGNL dependency?
Posted by chris snow <ch...@gmail.com>.
Fantastic stuff! Thanks Colm!
On Mon, May 26, 2014 at 3:21 PM, Colm O hEigeartaigh
<co...@apache.org> wrote:
> I've upgraded Fediz trunk + 1.1 to use Javassist 3.16.1-GA, which is what
> Apache Commons OGNL trunk currently picks up. This is Apache licensed and
> so it's ok for us to use.
>
> Colm.
>
>
> On Fri, May 23, 2014 at 7:37 PM, chris snow <ch...@gmail.com> wrote:
>
>> Hi Dan,
>>
>> Fediz 1.1 is picking up javassist 3.11.0.GA:
>>
>> [INFO] org.apache.cxf.fediz:fediz-idp:war:1.1.0
>> ...
>> [INFO] +- ognl:ognl:jar:3.0.5:runtime
>> [INFO] | \- javassist:javassist:jar:3.11.0.GA:runtime
>>
>> Javassist 3.11.0.GA is under the GPL and MPL:
>>
>> https://github.com/jboss-javassist/javassist/blob/rel_3_11_0_ga/License.html
>>
>> As the IDP is modified to suit your own requirements, it shouldn't be
>> too much of a problem for my project to switch to SpringEL.
>>
>> Many thanks,
>>
>> Chris
>>
>> On Fri, May 23, 2014 at 5:12 PM, Daniel Kulp <dk...@apache.org> wrote:
>> >
>> > On May 23, 2014, at 11:19 AM, chris snow <ch...@gmail.com> wrote:
>> >
>> >> I'm currently evaluating Fediz 1.1 for my company, but noticed that
>> >> the IDP has an OGNL dependency that in turn requires Javassist which
>> >> is LGPL:
>> >
>> > According to:
>> >
>> > http://www.javassist.org
>> > http://www.csg.ci.i.u-tokyo.ac.jp/~chiba/javassist/
>> >
>> > "This version is distributed under the triple license of the MPL, the
>> LGPL, and the Apache License.”
>> >
>> > That’s at least for the 3.18.1 version. We likely should make sure
>> we’re updated to grab the 3.18.1 version from:
>> >
>> http://central.maven.org/maven2/org/javassist/javassist/3.18.1-GA/javassist-3.18.1-GA.pom
>> > to make sure that is clear.
>> >
>> > Dan
>> >
>> >
>> >
>> >>
>> >> I would have to jump through hoops to get LGPL approved, so I was
>> >> wondering what the implications would be if I removed the OGNL
>> >> dependency.
>> >>
>> >> The main reference to OGNL that I could find is:
>> >>
>> >> src/main/webapp/WEB-INF/idp-servlet.xml: <bean
>> >> id="expressionParser"
>> >>
>> class="org.springframework.webflow.expression.WebFlowOgnlExpressionParser"
>> >> />
>> >>
>> >> Does anyone know the impact of replacing OGNL with SpringEL in the IDP?
>> >
>> > --
>> > Daniel Kulp
>> > dkulp@apache.org - http://dankulp.com/blog
>> > Talend Community Coder - http://coders.talend.com
>> >
>>
>>
>>
>> --
>> Check out my professional profile and connect with me on LinkedIn.
>> http://lnkd.in/cw5k69
>>
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
--
Check out my professional profile and connect with me on LinkedIn.
http://lnkd.in/cw5k69
Re: Fediz IDP - implication of removing OGNL dependency?
Posted by Colm O hEigeartaigh <co...@apache.org>.
I've upgraded Fediz trunk + 1.1 to use Javassist 3.16.1-GA, which is what
Apache Commons OGNL trunk currently picks up. This is Apache licensed and
so it's ok for us to use.
Colm.
On Fri, May 23, 2014 at 7:37 PM, chris snow <ch...@gmail.com> wrote:
> Hi Dan,
>
> Fediz 1.1 is picking up javassist 3.11.0.GA:
>
> [INFO] org.apache.cxf.fediz:fediz-idp:war:1.1.0
> ...
> [INFO] +- ognl:ognl:jar:3.0.5:runtime
> [INFO] | \- javassist:javassist:jar:3.11.0.GA:runtime
>
> Javassist 3.11.0.GA is under the GPL and MPL:
>
> https://github.com/jboss-javassist/javassist/blob/rel_3_11_0_ga/License.html
>
> As the IDP is modified to suit your own requirements, it shouldn't be
> too much of a problem for my project to switch to SpringEL.
>
> Many thanks,
>
> Chris
>
> On Fri, May 23, 2014 at 5:12 PM, Daniel Kulp <dk...@apache.org> wrote:
> >
> > On May 23, 2014, at 11:19 AM, chris snow <ch...@gmail.com> wrote:
> >
> >> I'm currently evaluating Fediz 1.1 for my company, but noticed that
> >> the IDP has an OGNL dependency that in turn requires Javassist which
> >> is LGPL:
> >
> > According to:
> >
> > http://www.javassist.org
> > http://www.csg.ci.i.u-tokyo.ac.jp/~chiba/javassist/
> >
> > "This version is distributed under the triple license of the MPL, the
> LGPL, and the Apache License.”
> >
> > That’s at least for the 3.18.1 version. We likely should make sure
> we’re updated to grab the 3.18.1 version from:
> >
> http://central.maven.org/maven2/org/javassist/javassist/3.18.1-GA/javassist-3.18.1-GA.pom
> > to make sure that is clear.
> >
> > Dan
> >
> >
> >
> >>
> >> I would have to jump through hoops to get LGPL approved, so I was
> >> wondering what the implications would be if I removed the OGNL
> >> dependency.
> >>
> >> The main reference to OGNL that I could find is:
> >>
> >> src/main/webapp/WEB-INF/idp-servlet.xml: <bean
> >> id="expressionParser"
> >>
> class="org.springframework.webflow.expression.WebFlowOgnlExpressionParser"
> >> />
> >>
> >> Does anyone know the impact of replacing OGNL with SpringEL in the IDP?
> >
> > --
> > Daniel Kulp
> > dkulp@apache.org - http://dankulp.com/blog
> > Talend Community Coder - http://coders.talend.com
> >
>
>
>
> --
> Check out my professional profile and connect with me on LinkedIn.
> http://lnkd.in/cw5k69
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: Fediz IDP - implication of removing OGNL dependency?
Posted by chris snow <ch...@gmail.com>.
Hi Dan,
Fediz 1.1 is picking up javassist 3.11.0.GA:
[INFO] org.apache.cxf.fediz:fediz-idp:war:1.1.0
...
[INFO] +- ognl:ognl:jar:3.0.5:runtime
[INFO] | \- javassist:javassist:jar:3.11.0.GA:runtime
Javassist 3.11.0.GA is under the GPL and MPL:
https://github.com/jboss-javassist/javassist/blob/rel_3_11_0_ga/License.html
As the IDP is modified to suit your own requirements, it shouldn't be
too much of a problem for my project to switch to SpringEL.
Many thanks,
Chris
On Fri, May 23, 2014 at 5:12 PM, Daniel Kulp <dk...@apache.org> wrote:
>
> On May 23, 2014, at 11:19 AM, chris snow <ch...@gmail.com> wrote:
>
>> I'm currently evaluating Fediz 1.1 for my company, but noticed that
>> the IDP has an OGNL dependency that in turn requires Javassist which
>> is LGPL:
>
> According to:
>
> http://www.javassist.org
> http://www.csg.ci.i.u-tokyo.ac.jp/~chiba/javassist/
>
> "This version is distributed under the triple license of the MPL, the LGPL, and the Apache License.”
>
> That’s at least for the 3.18.1 version. We likely should make sure we’re updated to grab the 3.18.1 version from:
> http://central.maven.org/maven2/org/javassist/javassist/3.18.1-GA/javassist-3.18.1-GA.pom
> to make sure that is clear.
>
> Dan
>
>
>
>>
>> I would have to jump through hoops to get LGPL approved, so I was
>> wondering what the implications would be if I removed the OGNL
>> dependency.
>>
>> The main reference to OGNL that I could find is:
>>
>> src/main/webapp/WEB-INF/idp-servlet.xml: <bean
>> id="expressionParser"
>> class="org.springframework.webflow.expression.WebFlowOgnlExpressionParser"
>> />
>>
>> Does anyone know the impact of replacing OGNL with SpringEL in the IDP?
>
> --
> Daniel Kulp
> dkulp@apache.org - http://dankulp.com/blog
> Talend Community Coder - http://coders.talend.com
>
--
Check out my professional profile and connect with me on LinkedIn.
http://lnkd.in/cw5k69
Re: Fediz IDP - implication of removing OGNL dependency?
Posted by Daniel Kulp <dk...@apache.org>.
On May 23, 2014, at 11:19 AM, chris snow <ch...@gmail.com> wrote:
> I'm currently evaluating Fediz 1.1 for my company, but noticed that
> the IDP has an OGNL dependency that in turn requires Javassist which
> is LGPL:
According to:
http://www.javassist.org
http://www.csg.ci.i.u-tokyo.ac.jp/~chiba/javassist/
"This version is distributed under the triple license of the MPL, the LGPL, and the Apache License.”
That’s at least for the 3.18.1 version. We likely should make sure we’re updated to grab the 3.18.1 version from:
http://central.maven.org/maven2/org/javassist/javassist/3.18.1-GA/javassist-3.18.1-GA.pom
to make sure that is clear.
Dan
>
> I would have to jump through hoops to get LGPL approved, so I was
> wondering what the implications would be if I removed the OGNL
> dependency.
>
> The main reference to OGNL that I could find is:
>
> src/main/webapp/WEB-INF/idp-servlet.xml: <bean
> id="expressionParser"
> class="org.springframework.webflow.expression.WebFlowOgnlExpressionParser"
> />
>
> Does anyone know the impact of replacing OGNL with SpringEL in the IDP?
--
Daniel Kulp
dkulp@apache.org - http://dankulp.com/blog
Talend Community Coder - http://coders.talend.com