You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@dubbo.apache.org by Huxing Zhang <hu...@apache.org> on 2019/04/21 02:40:55 UTC
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Hi,
ccing dev@dubbo
On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com> wrote:
>
> Hi，
>
> I just checked the binary release kit, it has the third party
> dependency of LGPL (Hibernate core) which is belonged to Cataloge
> X[1], it cannot be included in Apache Product.
> I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> fix this issue, I just fill an issue here[2].
I did some dig for this issue and confirm that this is introduced by
this pull request[1].
The purpose of this pull request is to introduce the pagination to
service query.
In this pull request a dependency to spring-boot-starter-data-jpa was added,
which introduce the LGPL licensed dependency hibernate-core.
The detailed dependency tree is shown below:
[INFO] +- org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
[INFO] | +- org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
[INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
[INFO] | +- org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
[INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
[INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
[INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
[INFO] | | +-
org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
[INFO] | | +- antlr:antlr:jar:2.7.7:compile
[INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
[INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
[INFO] | | \-
org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
[INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
[INFO] | +- org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
[INFO] | | +-
org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
[INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
[INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
[INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
Actually the hiberate-core dependency is never used when implementing
the feature,
I think it can be excluded quietly. This is the safest way to solve this issue.
To dig further, the only dependency that required to be added is just
spring-data-commons,
which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
and start correctly with spring-data-commons,
it might need to check more at runtime to ensure everything is working)
We need to be very careful when new dependency is added, and ensure
all the license (including transitive dependencies) are compatible
with Apache.
The community has identified several similar issues [3][4] for
incubator-dubbo project, and similar actions should be done to
incubator-dubbo-admin as well.
To identify the issue automatically, I run the following command:
mvn license:add-third-party -Dlicense.useMissingFile
and grep the output:
cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
grep "General Public License"
(Eclipse Public License - v 1.0) (GNU Lesser General Public
License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
- http://logback.qos.ch/logback-classic)
(Eclipse Public License - v 1.0) (GNU Lesser General Public
License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
http://logback.qos.ch/logback-core)
(GNU Lesser General Public License) Core Hibernate O/RM
functionality (org.hibernate:hibernate-core:5.2.17.Final -
http://hibernate.org)
(GNU Lesser General Public License) Hibernate Commons Annotations
(org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
http://hibernate.org)
The last 2 are both introduced by hibernate-core. A script to check
license issue for dependencies was on the way[5].
[1] https://github.com/apache/incubator-dubbo-admin/pull/324
[2] https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
[3] https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
[4] https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
[5] https://github.com/apache/incubator-dubbo/issues/3840
>
> [1]https://www.apache.org/legal/resolved.html#category-x
> [2]https://github.com/apache/incubator-dubbo-admin/issues/366
>
> Willem Jiang
>
> Twitter: willemjiang
> Weibo: 姜宁willem
>
> On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com> wrote:
> >
> > Hello Incubator Community,
> >
> > The Apache Dubbo community has voted on and approved a proposal to release
> > Apache Dubbo Admin (Incubating) version 0.2.0.
> >
> > We now kindly request the Incubator PMC members review and vote on this
> > incubator release.
> >
> > Apache Dubbo™ (incubating) is a high-performance, java based, open source
> > RPC framework. Dubbo offers three key functionalities, which include
> > interface based remote call, fault tolerance & load balancing, and
> > automatic service registration & discovery.
> >
> >
> > Dubbo community vote and result thread:
> > https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> >
> > The release candidates (RC3):
> > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/>/*
> >
> >
> > Git tag for the release (RC3):
> > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> >
> > Hash for the release tag:
> > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> >
> > Release Notes:
> > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> >
> >
> > The artifacts have been signed with Key :
> > DA2108479B0C1E71, which can be
> > found in the keys file:
> > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
> >
> > The vote will be open for at least 72 hours or until necessary number of
> > votes are reached.
> >
> > Please vote accordingly:
> >
> > [ ] +1 approve
> > [ ] +0 no opinion
> > [ ] -1 disapprove with the reason
> >
> > Thanks,
> > The Apache Dubbo (Incubating) Team
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
--
Best Regards！
Huxing
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Huxing Zhang <hu...@apache.org>.
On Mon, Apr 22, 2019 at 10:17 AM Justin Mclean <ju...@classsoftware.com> wrote:
>
> HI,
>
> > However, LGPL software does not fit into this case, because in [2]
> > section 5, it says linking to a LGPL software is not considered to
> > create a derivative work.
>
> It still places restriction above and beyond what the ALv2 does and that why it’s listing in Category X. [1]
>
> > Basically I am trying to figure out, why in ASF policy, linking to
> > LGPL code is not allowed. I just want to discuss this issue
> > technically. No other meanings.
>
> I suggest you ask on the legal discuss list they are likely to be able to provide a better answer.
Thanks, I am planning to do that. :-) This issue has confused me for a while.
>
> Thanks,
> Justin
>
> 1. https://apache.org/legal/resolved.html#category-x <https://apache.org/legal/resolved.html#category-x>
--
Best Regards！
Huxing
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Justin Mclean <ju...@classsoftware.com>.
HI,
> However, LGPL software does not fit into this case, because in [2]
> section 5, it says linking to a LGPL software is not considered to
> create a derivative work.
It still places restriction above and beyond what the ALv2 does and that why it’s listing in Category X. [1]
> Basically I am trying to figure out, why in ASF policy, linking to
> LGPL code is not allowed. I just want to discuss this issue
> technically. No other meanings.
I suggest you ask on the legal discuss list they are likely to be able to provide a better answer.
Thanks,
Justin
1. https://apache.org/legal/resolved.html#category-x <https://apache.org/legal/resolved.html#category-x>
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Huxing Zhang <hu...@apache.org>.
Hi,
On Mon, Apr 22, 2019 at 12:20 PM Justin Mclean <ju...@classsoftware.com> wrote:
>
> Hi,
>
> > From my understanding, I don't see any issues that stop us from
> > allowing product depend on LGPL licensed software…
>
> Expect that it is against ASF policy as it listed in Category X, and podlings (and TLP) are expected to follow ASF legal / release policy. Please ask why on legal discuss and not here. The incubator doesn’t set legal, release or distribution policy and can only guide podlings on the practical aspects of it.
I have no objection to it. I will consult with legal team about this issue.
>
> Thanks,
> Justin
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
--
Best Regards！
Huxing
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
> From my understanding, I don't see any issues that stop us from
> allowing product depend on LGPL licensed software…
Expect that it is against ASF policy as it listed in Category X, and podlings (and TLP) are expected to follow ASF legal / release policy. Please ask why on legal discuss and not here. The incubator doesn’t set legal, release or distribution policy and can only guide podlings on the practical aspects of it.
Thanks,
Justin
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Huxing Zhang <hu...@apache.org>.
Hi,
Just FYI:
On Mon, Apr 22, 2019 at 10:22 AM Justin Mclean <ju...@classsoftware.com> wrote:
>
> Hi,
>
> Interesting to note that has been discuss at the board level but no resolution was passed. This was back in 2005 so I’m not aware of the history or why the resolution wasn’t passed [1] a search of the mailing lists from that time may provide an answer.
I've attached the board meeting minutes as below:
28 Jul 2005: Allow product dependencies on LGPL-licensed libraries (tabled) [1]
E. V.P. of Legal Affairs [Cliff Schmidt]
See Special Orders for two proposed resolutions.
The first resolution allows PMCs to develop and distribute
software that depends on the presence of LGPL-licensed
libraries, *without* distributing the libraries themselves.
After numerous discussions with the FSF, other LGPL licensors,
and ASF counsel, Larry Rosen, it appears that such a policy
should not impact the product licensing. In order to allow
PMCs to apply this policy to all useful LGPL-licensed
libraries, the resolution does not require the PMCs to get
an agreement from each copyright owner, but instead requires
the PMC to register the use of the particular LGPL library
with the VP of Legal Affairs. See my post to the board@
list for more details ("My recommendation for an ASF policy on
the LGPL").
The second resolution allows PMCs to redistribute MPL/NPL-
licensed executables. The key difference between the MPL/NPL
and the LGPL regarding redistribution requirements is that the
MPL/NPL allows redistribution under any license (provided that
the distributor complies with the applicable terms of the
MPL/NPL); the LGPL requires redistribution of either the source
or executable of the library to be licensed only under the LGPL.
While the MPL 1.0, MPL 1.1, NPL 1.0, and NPL 1.1 are nearly
identical in their treatment of redistribution of executables,
it is important to note that the NPL licenses are not OSI-
approved, as they discriminate in favor of Netscape, weakening
the terms that Netscape has to comply with relative to other
users. See my post to the board@ list for more details ("MPL/NPL
Issue: My recommendation for an ASF policy on the MPL/NPL").
NOTE: Larry Rosen has agreed with my analysis of the MPL/NPL
licenses as described in the referenced post; however, yesterday
he suggested that I confirm that Mitchell Baker also agrees
(author of the licenses). I have not yet received her response.
This could be a reason to table this resolution.
17 Aug 2005: Allow product dependencies on LGPL-licensed libraries (tabled) [2]
E. V.P. of Legal Affairs [Cliff Schmidt]
I've inserted slightly edited versions of the same MPL/NPL
and LGPL resolutions, which were tabled last month.
Since last month's meeting, I have:
- confirmed with a second member of ASF's legal counsel
that the proposed LGPL policy does not put our product
licensing at risk;
- posted and discussed the proposed LGPL policy on the
legal-discuss list, where no new concerns were raised
about the licensing ramifications; however there was
concern raised by both outside lawyers and Apache
committers that dependencies on LGPL libraries was not
in the best interests of some Apache users;
- engaged with representatives of the Mozilla Foundation
to discuss the proposed MPL/NPL licensing policy. While
they have *not* yet formally indicated their agreement
with our interpretation, they have not yet raised any
new concerns.
Future action items include resolving the BXA/crypto issue
and investigating and proposing policies for the CPL, EPL,
and CDDL licenses.
Finally, one of my short-term objectives is to overhaul the
legal STATUS file to reflect the current priorities and
status.
16 Nov 2005: LGPL resolution (tabled) [3]
LGPL: I'm still waiting on feedback from Eben on my
Java/LGPL position paper that I sent him last month. He
wanted to refrain from giving me feedback until
discussing the matter with the FSF. I expect to have
something any day now, since that meeting should have
recently happened. I recommend we hold off any decision
to allow distribution of LGPL components within non-
incubating product JARs until getting this one last
opinion from Eben and then bouncing it off the rest of
our counsel. However, I do not think we should have any
legal concern about separately distributing the LGPL and
ASF component that depends on it; both Jason and Larry
have signed off on this question.
The latest update was waiting from Eben's feedback.
The discussion happened on the legal-discuss[4][5].
From my understanding, I don't see any issues that stop us from
allowing product depend on LGPL licensed software...
[1] https://www.apache.org/foundation/records/minutes/2005/board_minutes_2005_07_28.txt
[2] https://www.apache.org/foundation/records/minutes/2005/board_minutes_2005_08_17.txt
[3] https://www.apache.org/foundation/records/minutes/2005/board_minutes_2005_11_16.txt
[4] https://lists.apache.org/thread.html/1991b7c73caaeda401cade3b9b94e070c2469fa40460552edb465c96@1123019323@%3Clegal-discuss.apache.org%3E
[5] https://lists.apache.org/thread.html/fbff7df04de5187a35799cf148d77deeb5349ca1d8381a9c002ac400@1123024332@%3Clegal-discuss.apache.org%3E
>
> Thanks,
> Justin
>
> 1,https://www.apache.org/foundation/board/calendar-2005-2009.html <https://www.apache.org/foundation/board/calendar-2005-2009.html>
--
Best Regards！
Huxing
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
Interesting to note that has been discuss at the board level but no resolution was passed. This was back in 2005 so I’m not aware of the history or why the resolution wasn’t passed [1] a search of the mailing lists from that time may provide an answer.
Thanks,
Justin
1,https://www.apache.org/foundation/board/calendar-2005-2009.html <https://www.apache.org/foundation/board/calendar-2005-2009.html>
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Huxing Zhang <hu...@apache.org>.
Hi,
On Mon, Apr 22, 2019 at 8:18 AM Justin Mclean <ju...@classsoftware.com> wrote:
>
> Hi,
>
> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> > licensed library "hibernate-core", and can still be Apache 2.0
> > licensed.
>
> That may be the case for a non ASF project, but it is ASF policy to not depends on GPL code. [1][2]
I understand it is ASF policy to not depend on GPL code. In [1] it
clears states:
We avoid GPLv3 software because merely linking to it is considered by
the GPLv3 authors to create a derivative work
However, LGPL software does not fit into this case, because in [2]
section 5, it says linking to a LGPL software is not considered to
create a derivative work.
Basically I am trying to figure out, why in ASF policy, linking to
LGPL code is not allowed. I just want to discuss this issue
technically. No other meanings.
>
> In short "The Apache Software Foundation does not allow its own projects to distribute software under licenses more restrictive than the Apache License,"
IMO, if what state in [2], section 5, is the case, the source code of
incubator-dubbo-admin, could still be distributed with Apache License.
Maybe I am missing something here, I'd be appreciated if someone could
point it out.
[1] https://www.apache.org/licenses/GPL-compatibility.html
[2] https://opensource.org/licenses/LGPL-2.1
>
> Thanks,
> Justin
>
> 1. https://www.apache.org/licenses/GPL-compatibility.html
> 2. https://www.apache.org/legal/resolved.html#category-x
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
--
Best Regards！
Huxing
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
> I am thinking why spring-boot-starter-data-jpa depends on LGPL
> licensed library "hibernate-core", and can still be Apache 2.0
> licensed.
That may be the case for a non ASF project, but it is ASF policy to not depends on GPL code. [1][2]
In short "The Apache Software Foundation does not allow its own projects to distribute software under licenses more restrictive than the Apache License,"
Thanks,
Justin
1. https://www.apache.org/licenses/GPL-compatibility.html
2. https://www.apache.org/legal/resolved.html#category-x
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
[CANCEL] [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Minxuan Zhuang <z8...@gmail.com>.
On Mon, Apr 22, 2019 at 4:08 PM Minxuan Zhuang <z8...@gmail.com> wrote:
> Hi, this LGPL License issue has been fixed, thanks kezhenxu94, I'll
> cancel this vote and start a new one
>
> On Mon, Apr 22, 2019 at 3:09 PM Huxing Zhang <hu...@apache.org> wrote:
>
>> Hi,
>>
>> On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94 <ke...@163.com> wrote:
>> >
>> > Hi All,
>> > I've excluded the `hibernate-core` dependency and verified as follows:
>> >
>> >
>> > $ mvn license:add-third-party -Dlicense.useMissingFile
>> > $ cat
>> dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep
>> "General Public License"
>> >
>> >
>> > here is the output
>> >
>> >
>> > (Eclipse Public License - v 1.0) (GNU Lesser General Public
>> License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 -
>> http://logback.qos.ch/logback-classic)
>> > (Eclipse Public License - v 1.0) (GNU Lesser General Public
>> License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
>> http://logback.qos.ch/logback-core)
>> >
>>
>> These are dual licensed dependencies, so we can choose the most
>> permissive one. In this case EPL is compatible with Apache so no issue
>> here.
>> Be aware that General Public License is just on of the keyword, other
>> keywords might also be check like GPL.
>>
>> >
>> > also, I've tested that the functionality introduced together with this
>> dependency[1] works well.
>> >
>> >
>> > I'll check the license next time when I need to introduce new
>> dependencies.
>> > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
>> >
>> >
>> > Thanks
>> >
>> >
>> > At 2019-04-22 10:17:43, "Huxing Zhang" <hu...@apache.org> wrote:
>> > >Hi,
>> > >
>> > >On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu <wu...@gmail.com>
>> wrote:
>> > >>
>> > >> Hi.
>> > >>
>> > >> > 1. Stop distribute the binary of incubator-dubbo-admin
>> > >>
>> > >> I think "stop distribute the binary" would NOT change the fact the
>> source
>> > >> release could lead users to use `hiberante-core`. I doubt this is an
>> option.
>> > >
>> > >That option is based on my understanding that linking to
>> > >"hibernate-core" does not create a derivative work of
>> > >"hibernate-core".
>> > >Yes, when compiling the source code and run the incubator-dubbo-admin
>> > >code, the hibernate-core binary will be included, this
>> > >will create a derivative work of "hibernate-core". As long as user do
>> > >not distribute it, I think it is fine to use it.
>> > >This is the same case as using "spring-boot-starter-data-jpa".
>> > >However, it becomes a problem when user want to distributed the
>> > >incubator-dubbo-admin binary, it must not be licensed as Apache
>> > >license, but should only be GPL/LGPL licensed.
>> > >This creates a risk that some user won't use this software because of
>> > >the potential license issue, which is not what we want.
>> > >So as long as an Apache project does not distribute the binary, IMO it
>> is fine.
>> > >That is my understanding of why this is an option. It is not a good
>> > >option, but I think it is an option.
>> > >
>> > >>
>> > >> Also based on the license issue, you should consider canceling this
>> vote,
>> > >> and move the further discussion to dev ml.
>> > >
>> > >I agree that cancel this vote is the safest way for now, before
>> > >everything is cleared.
>> > >
>> > >>
>> > >>
>> > >> Sheng Wu 吴晟
>> > >>
>> > >> Apache SkyWalking, ShardingSphere, Zipkin
>> > >> Twitter, wusheng1108
>> > >>
>> > >>
>> > >> Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
>> > >>
>> > >> > Hi,
>> > >> >
>> > >> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
>> > >> > licensed library "hibernate-core", and can still be Apache 2.0
>> > >> > licensed.
>> > >> > I am reading [1]. In section 5 it says:
>> > >> >
>> > >> > A program that contains no derivative of any portion of the
>> Library,
>> > >> > but is designed to work with the Library by being compiled or
>> linked
>> > >> > with it, is called a "work that uses the Library". Such a work, in
>> > >> > isolation, is not a derivative work of the Library, and therefore
>> > >> > falls outside the scope of this License.
>> > >> >
>> > >> > I think spring-boot-starter-data-jpa falls in to this case. It is a
>> > >> > "work that uses the Library".
>> > >> >
>> > >> > The source code of incubator-dubbo-admin should also falls into
>> this
>> > >> > case, because it does not contain any portion of the
>> hibernate-core.
>> > >> > Based on it and explanation here[2], I think the source code can be
>> > >> > released anyway. Is my understanding correct?
>> > >> >
>> > >> > Next, the LGPL license says:
>> > >> >
>> > >> > However, linking a "work that uses the Library" with the Library
>> > >> > creates an executable that is a derivative of the Library (because
>> it
>> > >> > contains portions of the Library), rather than a "work that uses
>> the
>> > >> > library". The executable is therefore covered by this License.
>> > >> >
>> > >> > The binary distribution of incuabator-dubbo-admin falls into this
>> case
>> > >> > because it creates an executable that contains binary of
>> > >> > hibernate-core. Therefore it is a "work based on the library". As a
>> > >> > derivative of hibernate-core, it must be licensed with LGPL/GPL,
>> which
>> > >> > is not allowed as an Apache product, and eventually causes the
>> > >> > incompatibility.
>> > >> >
>> > >> > If my understanding is correct, there are at least 4 ways to solve
>> this
>> > >> > issue:
>> > >> > 1. Stop distribute the binary of incubator-dubbo-admin
>> > >> > 2. Make the feature optional, as explained here[3]
>> > >> > 3. Stop depending on hiberante-core
>> > >> > 4. Choose other Apache compatible equivalent
>> > >> >
>> > >> > I recommend to go with number 3 in my last thread.
>> > >> >
>> > >> >
>> > >> > [1] https://opensource.org/licenses/LGPL-2.1
>> > >> > [2] https://www.apache.org/legal/resolved.html#prohibited
>> > >> > [3] https://www.apache.org/legal/resolved.html#optional
>> > >> >
>> > >> > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org>
>> wrote:
>> > >> > >
>> > >> > > Hi,
>> > >> > >
>> > >> > > ccing dev@dubbo
>> > >> > >
>> > >> > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <
>> willem.jiang@gmail.com>
>> > >> > wrote:
>> > >> > > >
>> > >> > > > Hi，
>> > >> > > >
>> > >> > > > I just checked the binary release kit, it has the third party
>> > >> > > > dependency of LGPL (Hibernate core) which is belonged to
>> Cataloge
>> > >> > > > X[1], it cannot be included in Apache Product.
>> > >> > > > I had to vote -1 for it. We can change the ORM lib to Eclipse
>> Link to
>> > >> > > > fix this issue, I just fill an issue here[2].
>> > >> > >
>> > >> > > I did some dig for this issue and confirm that this is
>> introduced by
>> > >> > > this pull request[1].
>> > >> > > The purpose of this pull request is to introduce the pagination
>> to
>> > >> > > service query.
>> > >> > > In this pull request a dependency to
>> spring-boot-starter-data-jpa was
>> > >> > added,
>> > >> > > which introduce the LGPL licensed dependency hibernate-core.
>> > >> > > The detailed dependency tree is shown below:
>> > >> > >
>> > >> > > [INFO] +-
>> > >> >
>> org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
>> > >> > > [INFO] | +-
>> > >> >
>> org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
>> > >> > > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
>> > >> > > [INFO] | +-
>> > >> >
>> org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
>> > >> > > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
>> > >> > > [INFO] | | \-
>> org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
>> > >> > > [INFO] | +-
>> org.hibernate:hibernate-core:jar:5.2.17.Final:compile
>> > >> > > [INFO] | | +-
>> > >> > >
>> > >> >
>> org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
>> > >> > > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
>> > >> > > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
>> > >> > > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
>> > >> > > [INFO] | | \-
>> > >> > >
>> > >> >
>> org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
>> > >> > > [INFO] | +-
>> javax.transaction:javax.transaction-api:jar:1.2:compile
>> > >> > > [INFO] | +-
>> > >> > org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
>> > >> > > [INFO] | | +-
>> > >> > >
>> org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
>> > >> > > [INFO] | | +-
>> org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
>> > >> > > [INFO] | | \-
>> org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
>> > >> > > [INFO] | \-
>> org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
>> > >> > >
>> > >> > > Actually the hiberate-core dependency is never used when
>> implementing
>> > >> > > the feature,
>> > >> > > I think it can be excluded quietly. This is the safest way to
>> solve this
>> > >> > issue.
>> > >> > > To dig further, the only dependency that required to be added is
>> just
>> > >> > > spring-data-commons,
>> > >> > > which is Apache 2.0 Licensed[2]. (I just confirm the code can
>> compile
>> > >> > > and start correctly with spring-data-commons,
>> > >> > > it might need to check more at runtime to ensure everything is
>> working)
>> > >> > >
>> > >> > > We need to be very careful when new dependency is added, and
>> ensure
>> > >> > > all the license (including transitive dependencies) are
>> compatible
>> > >> > > with Apache.
>> > >> > >
>> > >> > > The community has identified several similar issues [3][4] for
>> > >> > > incubator-dubbo project, and similar actions should be done to
>> > >> > > incubator-dubbo-admin as well.
>> > >> > >
>> > >> > > To identify the issue automatically, I run the following command:
>> > >> > >
>> > >> > > mvn license:add-third-party -Dlicense.useMissingFile
>> > >> > >
>> > >> > > and grep the output:
>> > >> > >
>> > >> > > cat
>> dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
>> > >> > > grep "General Public License"
>> > >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
>> > >> > > License) Logback Classic Module
>> (ch.qos.logback:logback-classic:1.2.3
>> > >> > > - http://logback.qos.ch/logback-classic)
>> > >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
>> > >> > > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
>> > >> > > http://logback.qos.ch/logback-core)
>> > >> > > (GNU Lesser General Public License) Core Hibernate O/RM
>> > >> > > functionality (org.hibernate:hibernate-core:5.2.17.Final -
>> > >> > > http://hibernate.org)
>> > >> > > (GNU Lesser General Public License) Hibernate Commons
>> Annotations
>> > >> > > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
>> > >> > > http://hibernate.org)
>> > >> > >
>> > >> > > The last 2 are both introduced by hibernate-core. A script to
>> check
>> > >> > > license issue for dependencies was on the way[5].
>> > >> > >
>> > >> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
>> > >> > > [2]
>> > >> >
>> https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
>> > >> > > [3]
>> > >> >
>> https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
>> > >> > > [4]
>> > >> >
>> https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
>> > >> > > [5] https://github.com/apache/incubator-dubbo/issues/3840
>> > >> > >
>> > >> > > >
>> > >> > > > [1]https://www.apache.org/legal/resolved.html#category-x
>> > >> > > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
>> > >> > > >
>> > >> > > > Willem Jiang
>> > >> > > >
>> > >> > > > Twitter: willemjiang
>> > >> > > > Weibo: 姜宁willem
>> > >> > > >
>> > >> > > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <
>> z82507200@gmail.com>
>> > >> > wrote:
>> > >> > > > >
>> > >> > > > > Hello Incubator Community,
>> > >> > > > >
>> > >> > > > > The Apache Dubbo community has voted on and approved a
>> proposal to
>> > >> > release
>> > >> > > > > Apache Dubbo Admin (Incubating) version 0.2.0.
>> > >> > > > >
>> > >> > > > > We now kindly request the Incubator PMC members review and
>> vote on
>> > >> > this
>> > >> > > > > incubator release.
>> > >> > > > >
>> > >> > > > > Apache Dubbo™ (incubating) is a high-performance, java
>> based, open
>> > >> > source
>> > >> > > > > RPC framework. Dubbo offers three key functionalities, which
>> include
>> > >> > > > > interface based remote call, fault tolerance & load
>> balancing, and
>> > >> > > > > automatic service registration & discovery.
>> > >> > > > >
>> > >> > > > >
>> > >> > > > > Dubbo community vote and result thread:
>> > >> > > > >
>> > >> >
>> https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
>> > >> > > > >
>> > >> > > > > The release candidates (RC3):
>> > >> > > > > *
>> > >> >
>> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
>> > >> > > > > <
>> > >> >
>> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
>> > >> > >/*
>> > >> > > > >
>> > >> > > > >
>> > >> > > > > Git tag for the release (RC3):
>> > >> > > > >
>> https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
>> > >> > > > >
>> > >> > > > > Hash for the release tag:
>> > >> > > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
>> > >> > > > >
>> > >> > > > > Release Notes:
>> > >> > > > >
>> https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
>> > >> > > > >
>> > >> > > > >
>> > >> > > > > The artifacts have been signed with Key :
>> > >> > > > > DA2108479B0C1E71, which can be
>> > >> > > > > found in the keys file:
>> > >> > > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
>> > >> > > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
>> >*
>> > >> > > > >
>> > >> > > > > The vote will be open for at least 72 hours or until
>> necessary
>> > >> > number of
>> > >> > > > > votes are reached.
>> > >> > > > >
>> > >> > > > > Please vote accordingly:
>> > >> > > > >
>> > >> > > > > [ ] +1 approve
>> > >> > > > > [ ] +0 no opinion
>> > >> > > > > [ ] -1 disapprove with the reason
>> > >> > > > >
>> > >> > > > > Thanks,
>> > >> > > > > The Apache Dubbo (Incubating) Team
>> > >> > > >
>> > >> > > >
>> ---------------------------------------------------------------------
>> > >> > > > To unsubscribe, e-mail:
>> general-unsubscribe@incubator.apache.org
>> > >> > > > For additional commands, e-mail:
>> general-help@incubator.apache.org
>> > >> > > >
>> > >> > >
>> > >> > >
>> > >> > > --
>> > >> > > Best Regards！
>> > >> > > Huxing
>> > >> >
>> > >> >
>> > >> >
>> > >> > --
>> > >> > Best Regards！
>> > >> > Huxing
>> > >> >
>> > >> >
>> ---------------------------------------------------------------------
>> > >> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>> > >> > For additional commands, e-mail: general-help@incubator.apache.org
>> > >> >
>> > >> >
>> > >
>> > >
>> > >
>> > >--
>> > >Best Regards！
>> > >Huxing
>>
>>
>>
>> --
>> Best Regards！
>> Huxing
>>
>
[CANCEL][VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Minxuan Zhuang <z8...@gmail.com>.
On Mon, Apr 22, 2019 at 4:13 PM Minxuan Zhuang <z8...@gmail.com> wrote:
>
> ---------- Forwarded message ---------
> From: Minxuan Zhuang <z8...@gmail.com>
> Date: Mon, Apr 22, 2019 at 4:08 PM
> Subject: Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
> To: <de...@dubbo.apache.org>
>
>
> Hi, this LGPL License issue has been fixed, thanks kezhenxu94, I'll
> cancel this vote and start a new one
>
> On Mon, Apr 22, 2019 at 3:09 PM Huxing Zhang <hu...@apache.org> wrote:
>
>> Hi,
>>
>> On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94 <ke...@163.com> wrote:
>> >
>> > Hi All,
>> > I've excluded the `hibernate-core` dependency and verified as follows:
>> >
>> >
>> > $ mvn license:add-third-party -Dlicense.useMissingFile
>> > $ cat
>> dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep
>> "General Public License"
>> >
>> >
>> > here is the output
>> >
>> >
>> > (Eclipse Public License - v 1.0) (GNU Lesser General Public
>> License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 -
>> http://logback.qos.ch/logback-classic)
>> > (Eclipse Public License - v 1.0) (GNU Lesser General Public
>> License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
>> http://logback.qos.ch/logback-core)
>> >
>>
>> These are dual licensed dependencies, so we can choose the most
>> permissive one. In this case EPL is compatible with Apache so no issue
>> here.
>> Be aware that General Public License is just on of the keyword, other
>> keywords might also be check like GPL.
>>
>> >
>> > also, I've tested that the functionality introduced together with this
>> dependency[1] works well.
>> >
>> >
>> > I'll check the license next time when I need to introduce new
>> dependencies.
>> > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
>> >
>> >
>> > Thanks
>>
>>
Fwd: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Minxuan Zhuang <z8...@gmail.com>.
---------- Forwarded message ---------
From: Minxuan Zhuang <z8...@gmail.com>
Date: Mon, Apr 22, 2019 at 4:08 PM
Subject: Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
To: <de...@dubbo.apache.org>
Hi, this LGPL License issue has been fixed, thanks kezhenxu94, I'll cancel
this vote and start a new one
On Mon, Apr 22, 2019 at 3:09 PM Huxing Zhang <hu...@apache.org> wrote:
> Hi,
>
> On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94 <ke...@163.com> wrote:
> >
> > Hi All,
> > I've excluded the `hibernate-core` dependency and verified as follows:
> >
> >
> > $ mvn license:add-third-party -Dlicense.useMissingFile
> > $ cat
> dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep
> "General Public License"
> >
> >
> > here is the output
> >
> >
> > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 -
> http://logback.qos.ch/logback-classic)
> > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> http://logback.qos.ch/logback-core)
> >
>
> These are dual licensed dependencies, so we can choose the most
> permissive one. In this case EPL is compatible with Apache so no issue
> here.
> Be aware that General Public License is just on of the keyword, other
> keywords might also be check like GPL.
>
> >
> > also, I've tested that the functionality introduced together with this
> dependency[1] works well.
> >
> >
> > I'll check the license next time when I need to introduce new
> dependencies.
> > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> >
> >
> > Thanks
>
>
Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Huxing Zhang <hu...@apache.org>.
Hi,
On Mon, Apr 22, 2019 at 4:08 PM Minxuan Zhuang <z8...@gmail.com> wrote:
>
> Hi, this LGPL License issue has been fixed, thanks kezhenxu94, I'll cancel
> this vote and start a new one
Could you please cancel it on general@ as well?
>
> On Mon, Apr 22, 2019 at 3:09 PM Huxing Zhang <hu...@apache.org> wrote:
>
> > Hi,
> >
> > On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94 <ke...@163.com> wrote:
> > >
> > > Hi All,
> > > I've excluded the `hibernate-core` dependency and verified as follows:
> > >
> > >
> > > $ mvn license:add-third-party -Dlicense.useMissingFile
> > > $ cat
> > dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep
> > "General Public License"
> > >
> > >
> > > here is the output
> > >
> > >
> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 -
> > http://logback.qos.ch/logback-classic)
> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> > http://logback.qos.ch/logback-core)
> > >
> >
> > These are dual licensed dependencies, so we can choose the most
> > permissive one. In this case EPL is compatible with Apache so no issue
> > here.
> > Be aware that General Public License is just on of the keyword, other
> > keywords might also be check like GPL.
> >
> > >
> > > also, I've tested that the functionality introduced together with this
> > dependency[1] works well.
> > >
> > >
> > > I'll check the license next time when I need to introduce new
> > dependencies.
> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> > >
> > >
> > > Thanks
> > >
> > >
> > > At 2019-04-22 10:17:43, "Huxing Zhang" <hu...@apache.org> wrote:
> > > >Hi,
> > > >
> > > >On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu <wu...@gmail.com>
> > wrote:
> > > >>
> > > >> Hi.
> > > >>
> > > >> > 1. Stop distribute the binary of incubator-dubbo-admin
> > > >>
> > > >> I think "stop distribute the binary" would NOT change the fact the
> > source
> > > >> release could lead users to use `hiberante-core`. I doubt this is an
> > option.
> > > >
> > > >That option is based on my understanding that linking to
> > > >"hibernate-core" does not create a derivative work of
> > > >"hibernate-core".
> > > >Yes, when compiling the source code and run the incubator-dubbo-admin
> > > >code, the hibernate-core binary will be included, this
> > > >will create a derivative work of "hibernate-core". As long as user do
> > > >not distribute it, I think it is fine to use it.
> > > >This is the same case as using "spring-boot-starter-data-jpa".
> > > >However, it becomes a problem when user want to distributed the
> > > >incubator-dubbo-admin binary, it must not be licensed as Apache
> > > >license, but should only be GPL/LGPL licensed.
> > > >This creates a risk that some user won't use this software because of
> > > >the potential license issue, which is not what we want.
> > > >So as long as an Apache project does not distribute the binary, IMO it
> > is fine.
> > > >That is my understanding of why this is an option. It is not a good
> > > >option, but I think it is an option.
> > > >
> > > >>
> > > >> Also based on the license issue, you should consider canceling this
> > vote,
> > > >> and move the further discussion to dev ml.
> > > >
> > > >I agree that cancel this vote is the safest way for now, before
> > > >everything is cleared.
> > > >
> > > >>
> > > >>
> > > >> Sheng Wu 吴晟
> > > >>
> > > >> Apache SkyWalking, ShardingSphere, Zipkin
> > > >> Twitter, wusheng1108
> > > >>
> > > >>
> > > >> Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
> > > >>
> > > >> > Hi,
> > > >> >
> > > >> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> > > >> > licensed library "hibernate-core", and can still be Apache 2.0
> > > >> > licensed.
> > > >> > I am reading [1]. In section 5 it says:
> > > >> >
> > > >> > A program that contains no derivative of any portion of the Library,
> > > >> > but is designed to work with the Library by being compiled or linked
> > > >> > with it, is called a "work that uses the Library". Such a work, in
> > > >> > isolation, is not a derivative work of the Library, and therefore
> > > >> > falls outside the scope of this License.
> > > >> >
> > > >> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> > > >> > "work that uses the Library".
> > > >> >
> > > >> > The source code of incubator-dubbo-admin should also falls into this
> > > >> > case, because it does not contain any portion of the hibernate-core.
> > > >> > Based on it and explanation here[2], I think the source code can be
> > > >> > released anyway. Is my understanding correct?
> > > >> >
> > > >> > Next, the LGPL license says:
> > > >> >
> > > >> > However, linking a "work that uses the Library" with the Library
> > > >> > creates an executable that is a derivative of the Library (because
> > it
> > > >> > contains portions of the Library), rather than a "work that uses the
> > > >> > library". The executable is therefore covered by this License.
> > > >> >
> > > >> > The binary distribution of incuabator-dubbo-admin falls into this
> > case
> > > >> > because it creates an executable that contains binary of
> > > >> > hibernate-core. Therefore it is a "work based on the library". As a
> > > >> > derivative of hibernate-core, it must be licensed with LGPL/GPL,
> > which
> > > >> > is not allowed as an Apache product, and eventually causes the
> > > >> > incompatibility.
> > > >> >
> > > >> > If my understanding is correct, there are at least 4 ways to solve
> > this
> > > >> > issue:
> > > >> > 1. Stop distribute the binary of incubator-dubbo-admin
> > > >> > 2. Make the feature optional, as explained here[3]
> > > >> > 3. Stop depending on hiberante-core
> > > >> > 4. Choose other Apache compatible equivalent
> > > >> >
> > > >> > I recommend to go with number 3 in my last thread.
> > > >> >
> > > >> >
> > > >> > [1] https://opensource.org/licenses/LGPL-2.1
> > > >> > [2] https://www.apache.org/legal/resolved.html#prohibited
> > > >> > [3] https://www.apache.org/legal/resolved.html#optional
> > > >> >
> > > >> > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org>
> > wrote:
> > > >> > >
> > > >> > > Hi,
> > > >> > >
> > > >> > > ccing dev@dubbo
> > > >> > >
> > > >> > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <
> > willem.jiang@gmail.com>
> > > >> > wrote:
> > > >> > > >
> > > >> > > > Hi，
> > > >> > > >
> > > >> > > > I just checked the binary release kit, it has the third party
> > > >> > > > dependency of LGPL (Hibernate core) which is belonged to
> > Cataloge
> > > >> > > > X[1], it cannot be included in Apache Product.
> > > >> > > > I had to vote -1 for it. We can change the ORM lib to Eclipse
> > Link to
> > > >> > > > fix this issue, I just fill an issue here[2].
> > > >> > >
> > > >> > > I did some dig for this issue and confirm that this is introduced
> > by
> > > >> > > this pull request[1].
> > > >> > > The purpose of this pull request is to introduce the pagination to
> > > >> > > service query.
> > > >> > > In this pull request a dependency to spring-boot-starter-data-jpa
> > was
> > > >> > added,
> > > >> > > which introduce the LGPL licensed dependency hibernate-core.
> > > >> > > The detailed dependency tree is shown below:
> > > >> > >
> > > >> > > [INFO] +-
> > > >> >
> > org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> > > >> > > [INFO] | +-
> > > >> >
> > org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> > > >> > > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> > > >> > > [INFO] | +-
> > > >> >
> > org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> > > >> > > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> > > >> > > [INFO] | | \-
> > org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> > > >> > > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> > > >> > > [INFO] | | +-
> > > >> > >
> > > >> >
> > org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> > > >> > > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> > > >> > > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> > > >> > > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> > > >> > > [INFO] | | \-
> > > >> > >
> > > >> >
> > org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> > > >> > > [INFO] | +-
> > javax.transaction:javax.transaction-api:jar:1.2:compile
> > > >> > > [INFO] | +-
> > > >> > org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> > > >> > > [INFO] | | +-
> > > >> > >
> > org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> > > >> > > [INFO] | | +-
> > org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> > > >> > > [INFO] | | \-
> > org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> > > >> > > [INFO] | \-
> > org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
> > > >> > >
> > > >> > > Actually the hiberate-core dependency is never used when
> > implementing
> > > >> > > the feature,
> > > >> > > I think it can be excluded quietly. This is the safest way to
> > solve this
> > > >> > issue.
> > > >> > > To dig further, the only dependency that required to be added is
> > just
> > > >> > > spring-data-commons,
> > > >> > > which is Apache 2.0 Licensed[2]. (I just confirm the code can
> > compile
> > > >> > > and start correctly with spring-data-commons,
> > > >> > > it might need to check more at runtime to ensure everything is
> > working)
> > > >> > >
> > > >> > > We need to be very careful when new dependency is added, and
> > ensure
> > > >> > > all the license (including transitive dependencies) are compatible
> > > >> > > with Apache.
> > > >> > >
> > > >> > > The community has identified several similar issues [3][4] for
> > > >> > > incubator-dubbo project, and similar actions should be done to
> > > >> > > incubator-dubbo-admin as well.
> > > >> > >
> > > >> > > To identify the issue automatically, I run the following command:
> > > >> > >
> > > >> > > mvn license:add-third-party -Dlicense.useMissingFile
> > > >> > >
> > > >> > > and grep the output:
> > > >> > >
> > > >> > > cat
> > dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> > > >> > > grep "General Public License"
> > > >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > > >> > > License) Logback Classic Module
> > (ch.qos.logback:logback-classic:1.2.3
> > > >> > > - http://logback.qos.ch/logback-classic)
> > > >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > > >> > > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> > > >> > > http://logback.qos.ch/logback-core)
> > > >> > > (GNU Lesser General Public License) Core Hibernate O/RM
> > > >> > > functionality (org.hibernate:hibernate-core:5.2.17.Final -
> > > >> > > http://hibernate.org)
> > > >> > > (GNU Lesser General Public License) Hibernate Commons
> > Annotations
> > > >> > > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> > > >> > > http://hibernate.org)
> > > >> > >
> > > >> > > The last 2 are both introduced by hibernate-core. A script to
> > check
> > > >> > > license issue for dependencies was on the way[5].
> > > >> > >
> > > >> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> > > >> > > [2]
> > > >> >
> > https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> > > >> > > [3]
> > > >> >
> > https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> > > >> > > [4]
> > > >> >
> > https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> > > >> > > [5] https://github.com/apache/incubator-dubbo/issues/3840
> > > >> > >
> > > >> > > >
> > > >> > > > [1]https://www.apache.org/legal/resolved.html#category-x
> > > >> > > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> > > >> > > >
> > > >> > > > Willem Jiang
> > > >> > > >
> > > >> > > > Twitter: willemjiang
> > > >> > > > Weibo: 姜宁willem
> > > >> > > >
> > > >> > > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <
> > z82507200@gmail.com>
> > > >> > wrote:
> > > >> > > > >
> > > >> > > > > Hello Incubator Community,
> > > >> > > > >
> > > >> > > > > The Apache Dubbo community has voted on and approved a
> > proposal to
> > > >> > release
> > > >> > > > > Apache Dubbo Admin (Incubating) version 0.2.0.
> > > >> > > > >
> > > >> > > > > We now kindly request the Incubator PMC members review and
> > vote on
> > > >> > this
> > > >> > > > > incubator release.
> > > >> > > > >
> > > >> > > > > Apache Dubbo™ (incubating) is a high-performance, java based,
> > open
> > > >> > source
> > > >> > > > > RPC framework. Dubbo offers three key functionalities, which
> > include
> > > >> > > > > interface based remote call, fault tolerance & load
> > balancing, and
> > > >> > > > > automatic service registration & discovery.
> > > >> > > > >
> > > >> > > > >
> > > >> > > > > Dubbo community vote and result thread:
> > > >> > > > >
> > > >> >
> > https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> > > >> > > > >
> > > >> > > > > The release candidates (RC3):
> > > >> > > > > *
> > > >> >
> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> > > >> > > > > <
> > > >> >
> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > > >> > >/*
> > > >> > > > >
> > > >> > > > >
> > > >> > > > > Git tag for the release (RC3):
> > > >> > > > >
> > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > >> > > > >
> > > >> > > > > Hash for the release tag:
> > > >> > > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> > > >> > > > >
> > > >> > > > > Release Notes:
> > > >> > > > >
> > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > >> > > > >
> > > >> > > > >
> > > >> > > > > The artifacts have been signed with Key :
> > > >> > > > > DA2108479B0C1E71, which can be
> > > >> > > > > found in the keys file:
> > > >> > > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > > >> > > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > >*
> > > >> > > > >
> > > >> > > > > The vote will be open for at least 72 hours or until necessary
> > > >> > number of
> > > >> > > > > votes are reached.
> > > >> > > > >
> > > >> > > > > Please vote accordingly:
> > > >> > > > >
> > > >> > > > > [ ] +1 approve
> > > >> > > > > [ ] +0 no opinion
> > > >> > > > > [ ] -1 disapprove with the reason
> > > >> > > > >
> > > >> > > > > Thanks,
> > > >> > > > > The Apache Dubbo (Incubating) Team
> > > >> > > >
> > > >> > > >
> > ---------------------------------------------------------------------
> > > >> > > > To unsubscribe, e-mail:
> > general-unsubscribe@incubator.apache.org
> > > >> > > > For additional commands, e-mail:
> > general-help@incubator.apache.org
> > > >> > > >
> > > >> > >
> > > >> > >
> > > >> > > --
> > > >> > > Best Regards！
> > > >> > > Huxing
> > > >> >
> > > >> >
> > > >> >
> > > >> > --
> > > >> > Best Regards！
> > > >> > Huxing
> > > >> >
> > > >> >
> > ---------------------------------------------------------------------
> > > >> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > > >> > For additional commands, e-mail: general-help@incubator.apache.org
> > > >> >
> > > >> >
> > > >
> > > >
> > > >
> > > >--
> > > >Best Regards！
> > > >Huxing
> >
> >
> >
> > --
> > Best Regards！
> > Huxing
> >
--
Best Regards！
Huxing
Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Minxuan Zhuang <z8...@gmail.com>.
Hi, this LGPL License issue has been fixed, thanks kezhenxu94, I'll cancel
this vote and start a new one
On Mon, Apr 22, 2019 at 3:09 PM Huxing Zhang <hu...@apache.org> wrote:
> Hi,
>
> On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94 <ke...@163.com> wrote:
> >
> > Hi All,
> > I've excluded the `hibernate-core` dependency and verified as follows:
> >
> >
> > $ mvn license:add-third-party -Dlicense.useMissingFile
> > $ cat
> dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep
> "General Public License"
> >
> >
> > here is the output
> >
> >
> > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 -
> http://logback.qos.ch/logback-classic)
> > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> http://logback.qos.ch/logback-core)
> >
>
> These are dual licensed dependencies, so we can choose the most
> permissive one. In this case EPL is compatible with Apache so no issue
> here.
> Be aware that General Public License is just on of the keyword, other
> keywords might also be check like GPL.
>
> >
> > also, I've tested that the functionality introduced together with this
> dependency[1] works well.
> >
> >
> > I'll check the license next time when I need to introduce new
> dependencies.
> > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> >
> >
> > Thanks
> >
> >
> > At 2019-04-22 10:17:43, "Huxing Zhang" <hu...@apache.org> wrote:
> > >Hi,
> > >
> > >On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu <wu...@gmail.com>
> wrote:
> > >>
> > >> Hi.
> > >>
> > >> > 1. Stop distribute the binary of incubator-dubbo-admin
> > >>
> > >> I think "stop distribute the binary" would NOT change the fact the
> source
> > >> release could lead users to use `hiberante-core`. I doubt this is an
> option.
> > >
> > >That option is based on my understanding that linking to
> > >"hibernate-core" does not create a derivative work of
> > >"hibernate-core".
> > >Yes, when compiling the source code and run the incubator-dubbo-admin
> > >code, the hibernate-core binary will be included, this
> > >will create a derivative work of "hibernate-core". As long as user do
> > >not distribute it, I think it is fine to use it.
> > >This is the same case as using "spring-boot-starter-data-jpa".
> > >However, it becomes a problem when user want to distributed the
> > >incubator-dubbo-admin binary, it must not be licensed as Apache
> > >license, but should only be GPL/LGPL licensed.
> > >This creates a risk that some user won't use this software because of
> > >the potential license issue, which is not what we want.
> > >So as long as an Apache project does not distribute the binary, IMO it
> is fine.
> > >That is my understanding of why this is an option. It is not a good
> > >option, but I think it is an option.
> > >
> > >>
> > >> Also based on the license issue, you should consider canceling this
> vote,
> > >> and move the further discussion to dev ml.
> > >
> > >I agree that cancel this vote is the safest way for now, before
> > >everything is cleared.
> > >
> > >>
> > >>
> > >> Sheng Wu 吴晟
> > >>
> > >> Apache SkyWalking, ShardingSphere, Zipkin
> > >> Twitter, wusheng1108
> > >>
> > >>
> > >> Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
> > >>
> > >> > Hi,
> > >> >
> > >> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> > >> > licensed library "hibernate-core", and can still be Apache 2.0
> > >> > licensed.
> > >> > I am reading [1]. In section 5 it says:
> > >> >
> > >> > A program that contains no derivative of any portion of the Library,
> > >> > but is designed to work with the Library by being compiled or linked
> > >> > with it, is called a "work that uses the Library". Such a work, in
> > >> > isolation, is not a derivative work of the Library, and therefore
> > >> > falls outside the scope of this License.
> > >> >
> > >> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> > >> > "work that uses the Library".
> > >> >
> > >> > The source code of incubator-dubbo-admin should also falls into this
> > >> > case, because it does not contain any portion of the hibernate-core.
> > >> > Based on it and explanation here[2], I think the source code can be
> > >> > released anyway. Is my understanding correct?
> > >> >
> > >> > Next, the LGPL license says:
> > >> >
> > >> > However, linking a "work that uses the Library" with the Library
> > >> > creates an executable that is a derivative of the Library (because
> it
> > >> > contains portions of the Library), rather than a "work that uses the
> > >> > library". The executable is therefore covered by this License.
> > >> >
> > >> > The binary distribution of incuabator-dubbo-admin falls into this
> case
> > >> > because it creates an executable that contains binary of
> > >> > hibernate-core. Therefore it is a "work based on the library". As a
> > >> > derivative of hibernate-core, it must be licensed with LGPL/GPL,
> which
> > >> > is not allowed as an Apache product, and eventually causes the
> > >> > incompatibility.
> > >> >
> > >> > If my understanding is correct, there are at least 4 ways to solve
> this
> > >> > issue:
> > >> > 1. Stop distribute the binary of incubator-dubbo-admin
> > >> > 2. Make the feature optional, as explained here[3]
> > >> > 3. Stop depending on hiberante-core
> > >> > 4. Choose other Apache compatible equivalent
> > >> >
> > >> > I recommend to go with number 3 in my last thread.
> > >> >
> > >> >
> > >> > [1] https://opensource.org/licenses/LGPL-2.1
> > >> > [2] https://www.apache.org/legal/resolved.html#prohibited
> > >> > [3] https://www.apache.org/legal/resolved.html#optional
> > >> >
> > >> > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org>
> wrote:
> > >> > >
> > >> > > Hi,
> > >> > >
> > >> > > ccing dev@dubbo
> > >> > >
> > >> > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <
> willem.jiang@gmail.com>
> > >> > wrote:
> > >> > > >
> > >> > > > Hi，
> > >> > > >
> > >> > > > I just checked the binary release kit, it has the third party
> > >> > > > dependency of LGPL (Hibernate core) which is belonged to
> Cataloge
> > >> > > > X[1], it cannot be included in Apache Product.
> > >> > > > I had to vote -1 for it. We can change the ORM lib to Eclipse
> Link to
> > >> > > > fix this issue, I just fill an issue here[2].
> > >> > >
> > >> > > I did some dig for this issue and confirm that this is introduced
> by
> > >> > > this pull request[1].
> > >> > > The purpose of this pull request is to introduce the pagination to
> > >> > > service query.
> > >> > > In this pull request a dependency to spring-boot-starter-data-jpa
> was
> > >> > added,
> > >> > > which introduce the LGPL licensed dependency hibernate-core.
> > >> > > The detailed dependency tree is shown below:
> > >> > >
> > >> > > [INFO] +-
> > >> >
> org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> > >> > > [INFO] | +-
> > >> >
> org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> > >> > > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> > >> > > [INFO] | +-
> > >> >
> org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> > >> > > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> > >> > > [INFO] | | \-
> org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> > >> > > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> > >> > > [INFO] | | +-
> > >> > >
> > >> >
> org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> > >> > > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> > >> > > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> > >> > > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> > >> > > [INFO] | | \-
> > >> > >
> > >> >
> org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> > >> > > [INFO] | +-
> javax.transaction:javax.transaction-api:jar:1.2:compile
> > >> > > [INFO] | +-
> > >> > org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> > >> > > [INFO] | | +-
> > >> > >
> org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> > >> > > [INFO] | | +-
> org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> > >> > > [INFO] | | \-
> org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> > >> > > [INFO] | \-
> org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
> > >> > >
> > >> > > Actually the hiberate-core dependency is never used when
> implementing
> > >> > > the feature,
> > >> > > I think it can be excluded quietly. This is the safest way to
> solve this
> > >> > issue.
> > >> > > To dig further, the only dependency that required to be added is
> just
> > >> > > spring-data-commons,
> > >> > > which is Apache 2.0 Licensed[2]. (I just confirm the code can
> compile
> > >> > > and start correctly with spring-data-commons,
> > >> > > it might need to check more at runtime to ensure everything is
> working)
> > >> > >
> > >> > > We need to be very careful when new dependency is added, and
> ensure
> > >> > > all the license (including transitive dependencies) are compatible
> > >> > > with Apache.
> > >> > >
> > >> > > The community has identified several similar issues [3][4] for
> > >> > > incubator-dubbo project, and similar actions should be done to
> > >> > > incubator-dubbo-admin as well.
> > >> > >
> > >> > > To identify the issue automatically, I run the following command:
> > >> > >
> > >> > > mvn license:add-third-party -Dlicense.useMissingFile
> > >> > >
> > >> > > and grep the output:
> > >> > >
> > >> > > cat
> dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> > >> > > grep "General Public License"
> > >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > >> > > License) Logback Classic Module
> (ch.qos.logback:logback-classic:1.2.3
> > >> > > - http://logback.qos.ch/logback-classic)
> > >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > >> > > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> > >> > > http://logback.qos.ch/logback-core)
> > >> > > (GNU Lesser General Public License) Core Hibernate O/RM
> > >> > > functionality (org.hibernate:hibernate-core:5.2.17.Final -
> > >> > > http://hibernate.org)
> > >> > > (GNU Lesser General Public License) Hibernate Commons
> Annotations
> > >> > > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> > >> > > http://hibernate.org)
> > >> > >
> > >> > > The last 2 are both introduced by hibernate-core. A script to
> check
> > >> > > license issue for dependencies was on the way[5].
> > >> > >
> > >> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> > >> > > [2]
> > >> >
> https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> > >> > > [3]
> > >> >
> https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> > >> > > [4]
> > >> >
> https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> > >> > > [5] https://github.com/apache/incubator-dubbo/issues/3840
> > >> > >
> > >> > > >
> > >> > > > [1]https://www.apache.org/legal/resolved.html#category-x
> > >> > > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> > >> > > >
> > >> > > > Willem Jiang
> > >> > > >
> > >> > > > Twitter: willemjiang
> > >> > > > Weibo: 姜宁willem
> > >> > > >
> > >> > > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <
> z82507200@gmail.com>
> > >> > wrote:
> > >> > > > >
> > >> > > > > Hello Incubator Community,
> > >> > > > >
> > >> > > > > The Apache Dubbo community has voted on and approved a
> proposal to
> > >> > release
> > >> > > > > Apache Dubbo Admin (Incubating) version 0.2.0.
> > >> > > > >
> > >> > > > > We now kindly request the Incubator PMC members review and
> vote on
> > >> > this
> > >> > > > > incubator release.
> > >> > > > >
> > >> > > > > Apache Dubbo™ (incubating) is a high-performance, java based,
> open
> > >> > source
> > >> > > > > RPC framework. Dubbo offers three key functionalities, which
> include
> > >> > > > > interface based remote call, fault tolerance & load
> balancing, and
> > >> > > > > automatic service registration & discovery.
> > >> > > > >
> > >> > > > >
> > >> > > > > Dubbo community vote and result thread:
> > >> > > > >
> > >> >
> https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> > >> > > > >
> > >> > > > > The release candidates (RC3):
> > >> > > > > *
> > >> >
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> > >> > > > > <
> > >> >
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > >> > >/*
> > >> > > > >
> > >> > > > >
> > >> > > > > Git tag for the release (RC3):
> > >> > > > >
> https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > >> > > > >
> > >> > > > > Hash for the release tag:
> > >> > > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> > >> > > > >
> > >> > > > > Release Notes:
> > >> > > > >
> https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > >> > > > >
> > >> > > > >
> > >> > > > > The artifacts have been signed with Key :
> > >> > > > > DA2108479B0C1E71, which can be
> > >> > > > > found in the keys file:
> > >> > > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > >> > > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> >*
> > >> > > > >
> > >> > > > > The vote will be open for at least 72 hours or until necessary
> > >> > number of
> > >> > > > > votes are reached.
> > >> > > > >
> > >> > > > > Please vote accordingly:
> > >> > > > >
> > >> > > > > [ ] +1 approve
> > >> > > > > [ ] +0 no opinion
> > >> > > > > [ ] -1 disapprove with the reason
> > >> > > > >
> > >> > > > > Thanks,
> > >> > > > > The Apache Dubbo (Incubating) Team
> > >> > > >
> > >> > > >
> ---------------------------------------------------------------------
> > >> > > > To unsubscribe, e-mail:
> general-unsubscribe@incubator.apache.org
> > >> > > > For additional commands, e-mail:
> general-help@incubator.apache.org
> > >> > > >
> > >> > >
> > >> > >
> > >> > > --
> > >> > > Best Regards！
> > >> > > Huxing
> > >> >
> > >> >
> > >> >
> > >> > --
> > >> > Best Regards！
> > >> > Huxing
> > >> >
> > >> >
> ---------------------------------------------------------------------
> > >> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > >> > For additional commands, e-mail: general-help@incubator.apache.org
> > >> >
> > >> >
> > >
> > >
> > >
> > >--
> > >Best Regards！
> > >Huxing
>
>
>
> --
> Best Regards！
> Huxing
>
Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Huxing Zhang <hu...@apache.org>.
Hi,
On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94 <ke...@163.com> wrote:
>
> Hi All,
> I've excluded the `hibernate-core` dependency and verified as follows:
>
>
> $ mvn license:add-third-party -Dlicense.useMissingFile
> $ cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep "General Public License"
>
>
> here is the output
>
>
> (Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 - http://logback.qos.ch/logback-classic)
> (Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 - http://logback.qos.ch/logback-core)
>
These are dual licensed dependencies, so we can choose the most
permissive one. In this case EPL is compatible with Apache so no issue
here.
Be aware that General Public License is just on of the keyword, other
keywords might also be check like GPL.
>
> also, I've tested that the functionality introduced together with this dependency[1] works well.
>
>
> I'll check the license next time when I need to introduce new dependencies.
> [1] https://github.com/apache/incubator-dubbo-admin/pull/324
>
>
> Thanks
>
>
> At 2019-04-22 10:17:43, "Huxing Zhang" <hu...@apache.org> wrote:
> >Hi,
> >
> >On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu <wu...@gmail.com> wrote:
> >>
> >> Hi.
> >>
> >> > 1. Stop distribute the binary of incubator-dubbo-admin
> >>
> >> I think "stop distribute the binary" would NOT change the fact the source
> >> release could lead users to use `hiberante-core`. I doubt this is an option.
> >
> >That option is based on my understanding that linking to
> >"hibernate-core" does not create a derivative work of
> >"hibernate-core".
> >Yes, when compiling the source code and run the incubator-dubbo-admin
> >code, the hibernate-core binary will be included, this
> >will create a derivative work of "hibernate-core". As long as user do
> >not distribute it, I think it is fine to use it.
> >This is the same case as using "spring-boot-starter-data-jpa".
> >However, it becomes a problem when user want to distributed the
> >incubator-dubbo-admin binary, it must not be licensed as Apache
> >license, but should only be GPL/LGPL licensed.
> >This creates a risk that some user won't use this software because of
> >the potential license issue, which is not what we want.
> >So as long as an Apache project does not distribute the binary, IMO it is fine.
> >That is my understanding of why this is an option. It is not a good
> >option, but I think it is an option.
> >
> >>
> >> Also based on the license issue, you should consider canceling this vote,
> >> and move the further discussion to dev ml.
> >
> >I agree that cancel this vote is the safest way for now, before
> >everything is cleared.
> >
> >>
> >>
> >> Sheng Wu 吴晟
> >>
> >> Apache SkyWalking, ShardingSphere, Zipkin
> >> Twitter, wusheng1108
> >>
> >>
> >> Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
> >>
> >> > Hi,
> >> >
> >> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> >> > licensed library "hibernate-core", and can still be Apache 2.0
> >> > licensed.
> >> > I am reading [1]. In section 5 it says:
> >> >
> >> > A program that contains no derivative of any portion of the Library,
> >> > but is designed to work with the Library by being compiled or linked
> >> > with it, is called a "work that uses the Library". Such a work, in
> >> > isolation, is not a derivative work of the Library, and therefore
> >> > falls outside the scope of this License.
> >> >
> >> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> >> > "work that uses the Library".
> >> >
> >> > The source code of incubator-dubbo-admin should also falls into this
> >> > case, because it does not contain any portion of the hibernate-core.
> >> > Based on it and explanation here[2], I think the source code can be
> >> > released anyway. Is my understanding correct?
> >> >
> >> > Next, the LGPL license says:
> >> >
> >> > However, linking a "work that uses the Library" with the Library
> >> > creates an executable that is a derivative of the Library (because it
> >> > contains portions of the Library), rather than a "work that uses the
> >> > library". The executable is therefore covered by this License.
> >> >
> >> > The binary distribution of incuabator-dubbo-admin falls into this case
> >> > because it creates an executable that contains binary of
> >> > hibernate-core. Therefore it is a "work based on the library". As a
> >> > derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> >> > is not allowed as an Apache product, and eventually causes the
> >> > incompatibility.
> >> >
> >> > If my understanding is correct, there are at least 4 ways to solve this
> >> > issue:
> >> > 1. Stop distribute the binary of incubator-dubbo-admin
> >> > 2. Make the feature optional, as explained here[3]
> >> > 3. Stop depending on hiberante-core
> >> > 4. Choose other Apache compatible equivalent
> >> >
> >> > I recommend to go with number 3 in my last thread.
> >> >
> >> >
> >> > [1] https://opensource.org/licenses/LGPL-2.1
> >> > [2] https://www.apache.org/legal/resolved.html#prohibited
> >> > [3] https://www.apache.org/legal/resolved.html#optional
> >> >
> >> > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org> wrote:
> >> > >
> >> > > Hi,
> >> > >
> >> > > ccing dev@dubbo
> >> > >
> >> > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com>
> >> > wrote:
> >> > > >
> >> > > > Hi，
> >> > > >
> >> > > > I just checked the binary release kit, it has the third party
> >> > > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> >> > > > X[1], it cannot be included in Apache Product.
> >> > > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> >> > > > fix this issue, I just fill an issue here[2].
> >> > >
> >> > > I did some dig for this issue and confirm that this is introduced by
> >> > > this pull request[1].
> >> > > The purpose of this pull request is to introduce the pagination to
> >> > > service query.
> >> > > In this pull request a dependency to spring-boot-starter-data-jpa was
> >> > added,
> >> > > which introduce the LGPL licensed dependency hibernate-core.
> >> > > The detailed dependency tree is shown below:
> >> > >
> >> > > [INFO] +-
> >> > org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> >> > > [INFO] | +-
> >> > org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> >> > > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> >> > > [INFO] | +-
> >> > org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> >> > > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> >> > > [INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> >> > > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> >> > > [INFO] | | +-
> >> > >
> >> > org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> >> > > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> >> > > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> >> > > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> >> > > [INFO] | | \-
> >> > >
> >> > org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> >> > > [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
> >> > > [INFO] | +-
> >> > org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> >> > > [INFO] | | +-
> >> > > org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> >> > > [INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> >> > > [INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> >> > > [INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
> >> > >
> >> > > Actually the hiberate-core dependency is never used when implementing
> >> > > the feature,
> >> > > I think it can be excluded quietly. This is the safest way to solve this
> >> > issue.
> >> > > To dig further, the only dependency that required to be added is just
> >> > > spring-data-commons,
> >> > > which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
> >> > > and start correctly with spring-data-commons,
> >> > > it might need to check more at runtime to ensure everything is working)
> >> > >
> >> > > We need to be very careful when new dependency is added, and ensure
> >> > > all the license (including transitive dependencies) are compatible
> >> > > with Apache.
> >> > >
> >> > > The community has identified several similar issues [3][4] for
> >> > > incubator-dubbo project, and similar actions should be done to
> >> > > incubator-dubbo-admin as well.
> >> > >
> >> > > To identify the issue automatically, I run the following command:
> >> > >
> >> > > mvn license:add-third-party -Dlicense.useMissingFile
> >> > >
> >> > > and grep the output:
> >> > >
> >> > > cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> >> > > grep "General Public License"
> >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> >> > > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
> >> > > - http://logback.qos.ch/logback-classic)
> >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> >> > > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> >> > > http://logback.qos.ch/logback-core)
> >> > > (GNU Lesser General Public License) Core Hibernate O/RM
> >> > > functionality (org.hibernate:hibernate-core:5.2.17.Final -
> >> > > http://hibernate.org)
> >> > > (GNU Lesser General Public License) Hibernate Commons Annotations
> >> > > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> >> > > http://hibernate.org)
> >> > >
> >> > > The last 2 are both introduced by hibernate-core. A script to check
> >> > > license issue for dependencies was on the way[5].
> >> > >
> >> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> >> > > [2]
> >> > https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> >> > > [3]
> >> > https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> >> > > [4]
> >> > https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> >> > > [5] https://github.com/apache/incubator-dubbo/issues/3840
> >> > >
> >> > > >
> >> > > > [1]https://www.apache.org/legal/resolved.html#category-x
> >> > > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> >> > > >
> >> > > > Willem Jiang
> >> > > >
> >> > > > Twitter: willemjiang
> >> > > > Weibo: 姜宁willem
> >> > > >
> >> > > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com>
> >> > wrote:
> >> > > > >
> >> > > > > Hello Incubator Community,
> >> > > > >
> >> > > > > The Apache Dubbo community has voted on and approved a proposal to
> >> > release
> >> > > > > Apache Dubbo Admin (Incubating) version 0.2.0.
> >> > > > >
> >> > > > > We now kindly request the Incubator PMC members review and vote on
> >> > this
> >> > > > > incubator release.
> >> > > > >
> >> > > > > Apache Dubbo™ (incubating) is a high-performance, java based, open
> >> > source
> >> > > > > RPC framework. Dubbo offers three key functionalities, which include
> >> > > > > interface based remote call, fault tolerance & load balancing, and
> >> > > > > automatic service registration & discovery.
> >> > > > >
> >> > > > >
> >> > > > > Dubbo community vote and result thread:
> >> > > > >
> >> > https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> >> > > > >
> >> > > > > The release candidates (RC3):
> >> > > > > *
> >> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> >> > > > > <
> >> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> >> > >/*
> >> > > > >
> >> > > > >
> >> > > > > Git tag for the release (RC3):
> >> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> >> > > > >
> >> > > > > Hash for the release tag:
> >> > > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> >> > > > >
> >> > > > > Release Notes:
> >> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> >> > > > >
> >> > > > >
> >> > > > > The artifacts have been signed with Key :
> >> > > > > DA2108479B0C1E71, which can be
> >> > > > > found in the keys file:
> >> > > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> >> > > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
> >> > > > >
> >> > > > > The vote will be open for at least 72 hours or until necessary
> >> > number of
> >> > > > > votes are reached.
> >> > > > >
> >> > > > > Please vote accordingly:
> >> > > > >
> >> > > > > [ ] +1 approve
> >> > > > > [ ] +0 no opinion
> >> > > > > [ ] -1 disapprove with the reason
> >> > > > >
> >> > > > > Thanks,
> >> > > > > The Apache Dubbo (Incubating) Team
> >> > > >
> >> > > > ---------------------------------------------------------------------
> >> > > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> >> > > > For additional commands, e-mail: general-help@incubator.apache.org
> >> > > >
> >> > >
> >> > >
> >> > > --
> >> > > Best Regards！
> >> > > Huxing
> >> >
> >> >
> >> >
> >> > --
> >> > Best Regards！
> >> > Huxing
> >> >
> >> > ---------------------------------------------------------------------
> >> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> >> > For additional commands, e-mail: general-help@incubator.apache.org
> >> >
> >> >
> >
> >
> >
> >--
> >Best Regards！
> >Huxing
--
Best Regards！
Huxing
Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Huxing Zhang <hu...@apache.org>.
Hi,
On Tue, Apr 23, 2019 at 9:54 AM Willem Jiang <wi...@gmail.com> wrote:
>
> I think we could put it into the wiki page to let other community
> developers know about the policy.
> BTW, we could also put the license check into the checklist of release
> candidate.
I've already added to release guide:
https://github.com/apache/incubator-dubbo-website/blob/asf-site/docs/en-us/developers/committer-guide/release-guide_dev.md#check-third-party-dependencies
>
> Willem Jiang
>
> Twitter: willemjiang
> Weibo: 姜宁willem
>
> On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94 <ke...@163.com> wrote:
> >
> > Hi All,
> > I've excluded the `hibernate-core` dependency and verified as follows:
> >
> >
> > $ mvn license:add-third-party -Dlicense.useMissingFile
> > $ cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep "General Public License"
> >
> >
> > here is the output
> >
> >
> > (Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 - http://logback.qos.ch/logback-classic)
> > (Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 - http://logback.qos.ch/logback-core)
> >
> >
> > also, I've tested that the functionality introduced together with this dependency[1] works well.
> >
> >
> > I'll check the license next time when I need to introduce new dependencies.
> > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> >
> >
> > Thanks
> >
> >
> > At 2019-04-22 10:17:43, "Huxing Zhang" <hu...@apache.org> wrote:
> > >Hi,
> > >
> > >On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu <wu...@gmail.com> wrote:
> > >>
> > >> Hi.
> > >>
> > >> > 1. Stop distribute the binary of incubator-dubbo-admin
> > >>
> > >> I think "stop distribute the binary" would NOT change the fact the source
> > >> release could lead users to use `hiberante-core`. I doubt this is an option.
> > >
> > >That option is based on my understanding that linking to
> > >"hibernate-core" does not create a derivative work of
> > >"hibernate-core".
> > >Yes, when compiling the source code and run the incubator-dubbo-admin
> > >code, the hibernate-core binary will be included, this
> > >will create a derivative work of "hibernate-core". As long as user do
> > >not distribute it, I think it is fine to use it.
> > >This is the same case as using "spring-boot-starter-data-jpa".
> > >However, it becomes a problem when user want to distributed the
> > >incubator-dubbo-admin binary, it must not be licensed as Apache
> > >license, but should only be GPL/LGPL licensed.
> > >This creates a risk that some user won't use this software because of
> > >the potential license issue, which is not what we want.
> > >So as long as an Apache project does not distribute the binary, IMO it is fine.
> > >That is my understanding of why this is an option. It is not a good
> > >option, but I think it is an option.
> > >
> > >>
> > >> Also based on the license issue, you should consider canceling this vote,
> > >> and move the further discussion to dev ml.
> > >
> > >I agree that cancel this vote is the safest way for now, before
> > >everything is cleared.
> > >
> > >>
> > >>
> > >> Sheng Wu 吴晟
> > >>
> > >> Apache SkyWalking, ShardingSphere, Zipkin
> > >> Twitter, wusheng1108
> > >>
> > >>
> > >> Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
> > >>
> > >> > Hi,
> > >> >
> > >> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> > >> > licensed library "hibernate-core", and can still be Apache 2.0
> > >> > licensed.
> > >> > I am reading [1]. In section 5 it says:
> > >> >
> > >> > A program that contains no derivative of any portion of the Library,
> > >> > but is designed to work with the Library by being compiled or linked
> > >> > with it, is called a "work that uses the Library". Such a work, in
> > >> > isolation, is not a derivative work of the Library, and therefore
> > >> > falls outside the scope of this License.
> > >> >
> > >> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> > >> > "work that uses the Library".
> > >> >
> > >> > The source code of incubator-dubbo-admin should also falls into this
> > >> > case, because it does not contain any portion of the hibernate-core.
> > >> > Based on it and explanation here[2], I think the source code can be
> > >> > released anyway. Is my understanding correct?
> > >> >
> > >> > Next, the LGPL license says:
> > >> >
> > >> > However, linking a "work that uses the Library" with the Library
> > >> > creates an executable that is a derivative of the Library (because it
> > >> > contains portions of the Library), rather than a "work that uses the
> > >> > library". The executable is therefore covered by this License.
> > >> >
> > >> > The binary distribution of incuabator-dubbo-admin falls into this case
> > >> > because it creates an executable that contains binary of
> > >> > hibernate-core. Therefore it is a "work based on the library". As a
> > >> > derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> > >> > is not allowed as an Apache product, and eventually causes the
> > >> > incompatibility.
> > >> >
> > >> > If my understanding is correct, there are at least 4 ways to solve this
> > >> > issue:
> > >> > 1. Stop distribute the binary of incubator-dubbo-admin
> > >> > 2. Make the feature optional, as explained here[3]
> > >> > 3. Stop depending on hiberante-core
> > >> > 4. Choose other Apache compatible equivalent
> > >> >
> > >> > I recommend to go with number 3 in my last thread.
> > >> >
> > >> >
> > >> > [1] https://opensource.org/licenses/LGPL-2.1
> > >> > [2] https://www.apache.org/legal/resolved.html#prohibited
> > >> > [3] https://www.apache.org/legal/resolved.html#optional
> > >> >
> > >> > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org> wrote:
> > >> > >
> > >> > > Hi,
> > >> > >
> > >> > > ccing dev@dubbo
> > >> > >
> > >> > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com>
> > >> > wrote:
> > >> > > >
> > >> > > > Hi，
> > >> > > >
> > >> > > > I just checked the binary release kit, it has the third party
> > >> > > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> > >> > > > X[1], it cannot be included in Apache Product.
> > >> > > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> > >> > > > fix this issue, I just fill an issue here[2].
> > >> > >
> > >> > > I did some dig for this issue and confirm that this is introduced by
> > >> > > this pull request[1].
> > >> > > The purpose of this pull request is to introduce the pagination to
> > >> > > service query.
> > >> > > In this pull request a dependency to spring-boot-starter-data-jpa was
> > >> > added,
> > >> > > which introduce the LGPL licensed dependency hibernate-core.
> > >> > > The detailed dependency tree is shown below:
> > >> > >
> > >> > > [INFO] +-
> > >> > org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> > >> > > [INFO] | +-
> > >> > org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> > >> > > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> > >> > > [INFO] | +-
> > >> > org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> > >> > > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> > >> > > [INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> > >> > > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> > >> > > [INFO] | | +-
> > >> > >
> > >> > org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> > >> > > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> > >> > > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> > >> > > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> > >> > > [INFO] | | \-
> > >> > >
> > >> > org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> > >> > > [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
> > >> > > [INFO] | +-
> > >> > org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> > >> > > [INFO] | | +-
> > >> > > org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> > >> > > [INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> > >> > > [INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> > >> > > [INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
> > >> > >
> > >> > > Actually the hiberate-core dependency is never used when implementing
> > >> > > the feature,
> > >> > > I think it can be excluded quietly. This is the safest way to solve this
> > >> > issue.
> > >> > > To dig further, the only dependency that required to be added is just
> > >> > > spring-data-commons,
> > >> > > which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
> > >> > > and start correctly with spring-data-commons,
> > >> > > it might need to check more at runtime to ensure everything is working)
> > >> > >
> > >> > > We need to be very careful when new dependency is added, and ensure
> > >> > > all the license (including transitive dependencies) are compatible
> > >> > > with Apache.
> > >> > >
> > >> > > The community has identified several similar issues [3][4] for
> > >> > > incubator-dubbo project, and similar actions should be done to
> > >> > > incubator-dubbo-admin as well.
> > >> > >
> > >> > > To identify the issue automatically, I run the following command:
> > >> > >
> > >> > > mvn license:add-third-party -Dlicense.useMissingFile
> > >> > >
> > >> > > and grep the output:
> > >> > >
> > >> > > cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> > >> > > grep "General Public License"
> > >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > >> > > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
> > >> > > - http://logback.qos.ch/logback-classic)
> > >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > >> > > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> > >> > > http://logback.qos.ch/logback-core)
> > >> > > (GNU Lesser General Public License) Core Hibernate O/RM
> > >> > > functionality (org.hibernate:hibernate-core:5.2.17.Final -
> > >> > > http://hibernate.org)
> > >> > > (GNU Lesser General Public License) Hibernate Commons Annotations
> > >> > > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> > >> > > http://hibernate.org)
> > >> > >
> > >> > > The last 2 are both introduced by hibernate-core. A script to check
> > >> > > license issue for dependencies was on the way[5].
> > >> > >
> > >> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> > >> > > [2]
> > >> > https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> > >> > > [3]
> > >> > https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> > >> > > [4]
> > >> > https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> > >> > > [5] https://github.com/apache/incubator-dubbo/issues/3840
> > >> > >
> > >> > > >
> > >> > > > [1]https://www.apache.org/legal/resolved.html#category-x
> > >> > > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> > >> > > >
> > >> > > > Willem Jiang
> > >> > > >
> > >> > > > Twitter: willemjiang
> > >> > > > Weibo: 姜宁willem
> > >> > > >
> > >> > > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com>
> > >> > wrote:
> > >> > > > >
> > >> > > > > Hello Incubator Community,
> > >> > > > >
> > >> > > > > The Apache Dubbo community has voted on and approved a proposal to
> > >> > release
> > >> > > > > Apache Dubbo Admin (Incubating) version 0.2.0.
> > >> > > > >
> > >> > > > > We now kindly request the Incubator PMC members review and vote on
> > >> > this
> > >> > > > > incubator release.
> > >> > > > >
> > >> > > > > Apache Dubbo™ (incubating) is a high-performance, java based, open
> > >> > source
> > >> > > > > RPC framework. Dubbo offers three key functionalities, which include
> > >> > > > > interface based remote call, fault tolerance & load balancing, and
> > >> > > > > automatic service registration & discovery.
> > >> > > > >
> > >> > > > >
> > >> > > > > Dubbo community vote and result thread:
> > >> > > > >
> > >> > https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> > >> > > > >
> > >> > > > > The release candidates (RC3):
> > >> > > > > *
> > >> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> > >> > > > > <
> > >> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > >> > >/*
> > >> > > > >
> > >> > > > >
> > >> > > > > Git tag for the release (RC3):
> > >> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > >> > > > >
> > >> > > > > Hash for the release tag:
> > >> > > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> > >> > > > >
> > >> > > > > Release Notes:
> > >> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > >> > > > >
> > >> > > > >
> > >> > > > > The artifacts have been signed with Key :
> > >> > > > > DA2108479B0C1E71, which can be
> > >> > > > > found in the keys file:
> > >> > > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > >> > > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
> > >> > > > >
> > >> > > > > The vote will be open for at least 72 hours or until necessary
> > >> > number of
> > >> > > > > votes are reached.
> > >> > > > >
> > >> > > > > Please vote accordingly:
> > >> > > > >
> > >> > > > > [ ] +1 approve
> > >> > > > > [ ] +0 no opinion
> > >> > > > > [ ] -1 disapprove with the reason
> > >> > > > >
> > >> > > > > Thanks,
> > >> > > > > The Apache Dubbo (Incubating) Team
> > >> > > >
> > >> > > > ---------------------------------------------------------------------
> > >> > > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > >> > > > For additional commands, e-mail: general-help@incubator.apache.org
> > >> > > >
> > >> > >
> > >> > >
> > >> > > --
> > >> > > Best Regards！
> > >> > > Huxing
> > >> >
> > >> >
> > >> >
> > >> > --
> > >> > Best Regards！
> > >> > Huxing
> > >> >
> > >> > ---------------------------------------------------------------------
> > >> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > >> > For additional commands, e-mail: general-help@incubator.apache.org
> > >> >
> > >> >
> > >
> > >
> > >
> > >--
> > >Best Regards！
> > >Huxing
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
--
Best Regards！
Huxing
Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Huxing Zhang <hu...@apache.org>.
Hi,
On Tue, Apr 23, 2019 at 9:54 AM Willem Jiang <wi...@gmail.com> wrote:
>
> I think we could put it into the wiki page to let other community
> developers know about the policy.
> BTW, we could also put the license check into the checklist of release
> candidate.
I've already added to release guide:
https://github.com/apache/incubator-dubbo-website/blob/asf-site/docs/en-us/developers/committer-guide/release-guide_dev.md#check-third-party-dependencies
>
> Willem Jiang
>
> Twitter: willemjiang
> Weibo: 姜宁willem
>
> On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94 <ke...@163.com> wrote:
> >
> > Hi All,
> > I've excluded the `hibernate-core` dependency and verified as follows:
> >
> >
> > $ mvn license:add-third-party -Dlicense.useMissingFile
> > $ cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep "General Public License"
> >
> >
> > here is the output
> >
> >
> > (Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 - http://logback.qos.ch/logback-classic)
> > (Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 - http://logback.qos.ch/logback-core)
> >
> >
> > also, I've tested that the functionality introduced together with this dependency[1] works well.
> >
> >
> > I'll check the license next time when I need to introduce new dependencies.
> > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> >
> >
> > Thanks
> >
> >
> > At 2019-04-22 10:17:43, "Huxing Zhang" <hu...@apache.org> wrote:
> > >Hi,
> > >
> > >On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu <wu...@gmail.com> wrote:
> > >>
> > >> Hi.
> > >>
> > >> > 1. Stop distribute the binary of incubator-dubbo-admin
> > >>
> > >> I think "stop distribute the binary" would NOT change the fact the source
> > >> release could lead users to use `hiberante-core`. I doubt this is an option.
> > >
> > >That option is based on my understanding that linking to
> > >"hibernate-core" does not create a derivative work of
> > >"hibernate-core".
> > >Yes, when compiling the source code and run the incubator-dubbo-admin
> > >code, the hibernate-core binary will be included, this
> > >will create a derivative work of "hibernate-core". As long as user do
> > >not distribute it, I think it is fine to use it.
> > >This is the same case as using "spring-boot-starter-data-jpa".
> > >However, it becomes a problem when user want to distributed the
> > >incubator-dubbo-admin binary, it must not be licensed as Apache
> > >license, but should only be GPL/LGPL licensed.
> > >This creates a risk that some user won't use this software because of
> > >the potential license issue, which is not what we want.
> > >So as long as an Apache project does not distribute the binary, IMO it is fine.
> > >That is my understanding of why this is an option. It is not a good
> > >option, but I think it is an option.
> > >
> > >>
> > >> Also based on the license issue, you should consider canceling this vote,
> > >> and move the further discussion to dev ml.
> > >
> > >I agree that cancel this vote is the safest way for now, before
> > >everything is cleared.
> > >
> > >>
> > >>
> > >> Sheng Wu 吴晟
> > >>
> > >> Apache SkyWalking, ShardingSphere, Zipkin
> > >> Twitter, wusheng1108
> > >>
> > >>
> > >> Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
> > >>
> > >> > Hi,
> > >> >
> > >> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> > >> > licensed library "hibernate-core", and can still be Apache 2.0
> > >> > licensed.
> > >> > I am reading [1]. In section 5 it says:
> > >> >
> > >> > A program that contains no derivative of any portion of the Library,
> > >> > but is designed to work with the Library by being compiled or linked
> > >> > with it, is called a "work that uses the Library". Such a work, in
> > >> > isolation, is not a derivative work of the Library, and therefore
> > >> > falls outside the scope of this License.
> > >> >
> > >> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> > >> > "work that uses the Library".
> > >> >
> > >> > The source code of incubator-dubbo-admin should also falls into this
> > >> > case, because it does not contain any portion of the hibernate-core.
> > >> > Based on it and explanation here[2], I think the source code can be
> > >> > released anyway. Is my understanding correct?
> > >> >
> > >> > Next, the LGPL license says:
> > >> >
> > >> > However, linking a "work that uses the Library" with the Library
> > >> > creates an executable that is a derivative of the Library (because it
> > >> > contains portions of the Library), rather than a "work that uses the
> > >> > library". The executable is therefore covered by this License.
> > >> >
> > >> > The binary distribution of incuabator-dubbo-admin falls into this case
> > >> > because it creates an executable that contains binary of
> > >> > hibernate-core. Therefore it is a "work based on the library". As a
> > >> > derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> > >> > is not allowed as an Apache product, and eventually causes the
> > >> > incompatibility.
> > >> >
> > >> > If my understanding is correct, there are at least 4 ways to solve this
> > >> > issue:
> > >> > 1. Stop distribute the binary of incubator-dubbo-admin
> > >> > 2. Make the feature optional, as explained here[3]
> > >> > 3. Stop depending on hiberante-core
> > >> > 4. Choose other Apache compatible equivalent
> > >> >
> > >> > I recommend to go with number 3 in my last thread.
> > >> >
> > >> >
> > >> > [1] https://opensource.org/licenses/LGPL-2.1
> > >> > [2] https://www.apache.org/legal/resolved.html#prohibited
> > >> > [3] https://www.apache.org/legal/resolved.html#optional
> > >> >
> > >> > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org> wrote:
> > >> > >
> > >> > > Hi,
> > >> > >
> > >> > > ccing dev@dubbo
> > >> > >
> > >> > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com>
> > >> > wrote:
> > >> > > >
> > >> > > > Hi，
> > >> > > >
> > >> > > > I just checked the binary release kit, it has the third party
> > >> > > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> > >> > > > X[1], it cannot be included in Apache Product.
> > >> > > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> > >> > > > fix this issue, I just fill an issue here[2].
> > >> > >
> > >> > > I did some dig for this issue and confirm that this is introduced by
> > >> > > this pull request[1].
> > >> > > The purpose of this pull request is to introduce the pagination to
> > >> > > service query.
> > >> > > In this pull request a dependency to spring-boot-starter-data-jpa was
> > >> > added,
> > >> > > which introduce the LGPL licensed dependency hibernate-core.
> > >> > > The detailed dependency tree is shown below:
> > >> > >
> > >> > > [INFO] +-
> > >> > org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> > >> > > [INFO] | +-
> > >> > org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> > >> > > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> > >> > > [INFO] | +-
> > >> > org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> > >> > > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> > >> > > [INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> > >> > > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> > >> > > [INFO] | | +-
> > >> > >
> > >> > org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> > >> > > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> > >> > > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> > >> > > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> > >> > > [INFO] | | \-
> > >> > >
> > >> > org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> > >> > > [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
> > >> > > [INFO] | +-
> > >> > org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> > >> > > [INFO] | | +-
> > >> > > org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> > >> > > [INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> > >> > > [INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> > >> > > [INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
> > >> > >
> > >> > > Actually the hiberate-core dependency is never used when implementing
> > >> > > the feature,
> > >> > > I think it can be excluded quietly. This is the safest way to solve this
> > >> > issue.
> > >> > > To dig further, the only dependency that required to be added is just
> > >> > > spring-data-commons,
> > >> > > which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
> > >> > > and start correctly with spring-data-commons,
> > >> > > it might need to check more at runtime to ensure everything is working)
> > >> > >
> > >> > > We need to be very careful when new dependency is added, and ensure
> > >> > > all the license (including transitive dependencies) are compatible
> > >> > > with Apache.
> > >> > >
> > >> > > The community has identified several similar issues [3][4] for
> > >> > > incubator-dubbo project, and similar actions should be done to
> > >> > > incubator-dubbo-admin as well.
> > >> > >
> > >> > > To identify the issue automatically, I run the following command:
> > >> > >
> > >> > > mvn license:add-third-party -Dlicense.useMissingFile
> > >> > >
> > >> > > and grep the output:
> > >> > >
> > >> > > cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> > >> > > grep "General Public License"
> > >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > >> > > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
> > >> > > - http://logback.qos.ch/logback-classic)
> > >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > >> > > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> > >> > > http://logback.qos.ch/logback-core)
> > >> > > (GNU Lesser General Public License) Core Hibernate O/RM
> > >> > > functionality (org.hibernate:hibernate-core:5.2.17.Final -
> > >> > > http://hibernate.org)
> > >> > > (GNU Lesser General Public License) Hibernate Commons Annotations
> > >> > > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> > >> > > http://hibernate.org)
> > >> > >
> > >> > > The last 2 are both introduced by hibernate-core. A script to check
> > >> > > license issue for dependencies was on the way[5].
> > >> > >
> > >> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> > >> > > [2]
> > >> > https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> > >> > > [3]
> > >> > https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> > >> > > [4]
> > >> > https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> > >> > > [5] https://github.com/apache/incubator-dubbo/issues/3840
> > >> > >
> > >> > > >
> > >> > > > [1]https://www.apache.org/legal/resolved.html#category-x
> > >> > > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> > >> > > >
> > >> > > > Willem Jiang
> > >> > > >
> > >> > > > Twitter: willemjiang
> > >> > > > Weibo: 姜宁willem
> > >> > > >
> > >> > > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com>
> > >> > wrote:
> > >> > > > >
> > >> > > > > Hello Incubator Community,
> > >> > > > >
> > >> > > > > The Apache Dubbo community has voted on and approved a proposal to
> > >> > release
> > >> > > > > Apache Dubbo Admin (Incubating) version 0.2.0.
> > >> > > > >
> > >> > > > > We now kindly request the Incubator PMC members review and vote on
> > >> > this
> > >> > > > > incubator release.
> > >> > > > >
> > >> > > > > Apache Dubbo™ (incubating) is a high-performance, java based, open
> > >> > source
> > >> > > > > RPC framework. Dubbo offers three key functionalities, which include
> > >> > > > > interface based remote call, fault tolerance & load balancing, and
> > >> > > > > automatic service registration & discovery.
> > >> > > > >
> > >> > > > >
> > >> > > > > Dubbo community vote and result thread:
> > >> > > > >
> > >> > https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> > >> > > > >
> > >> > > > > The release candidates (RC3):
> > >> > > > > *
> > >> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> > >> > > > > <
> > >> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > >> > >/*
> > >> > > > >
> > >> > > > >
> > >> > > > > Git tag for the release (RC3):
> > >> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > >> > > > >
> > >> > > > > Hash for the release tag:
> > >> > > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> > >> > > > >
> > >> > > > > Release Notes:
> > >> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > >> > > > >
> > >> > > > >
> > >> > > > > The artifacts have been signed with Key :
> > >> > > > > DA2108479B0C1E71, which can be
> > >> > > > > found in the keys file:
> > >> > > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > >> > > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
> > >> > > > >
> > >> > > > > The vote will be open for at least 72 hours or until necessary
> > >> > number of
> > >> > > > > votes are reached.
> > >> > > > >
> > >> > > > > Please vote accordingly:
> > >> > > > >
> > >> > > > > [ ] +1 approve
> > >> > > > > [ ] +0 no opinion
> > >> > > > > [ ] -1 disapprove with the reason
> > >> > > > >
> > >> > > > > Thanks,
> > >> > > > > The Apache Dubbo (Incubating) Team
> > >> > > >
> > >> > > > ---------------------------------------------------------------------
> > >> > > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > >> > > > For additional commands, e-mail: general-help@incubator.apache.org
> > >> > > >
> > >> > >
> > >> > >
> > >> > > --
> > >> > > Best Regards！
> > >> > > Huxing
> > >> >
> > >> >
> > >> >
> > >> > --
> > >> > Best Regards！
> > >> > Huxing
> > >> >
> > >> > ---------------------------------------------------------------------
> > >> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > >> > For additional commands, e-mail: general-help@incubator.apache.org
> > >> >
> > >> >
> > >
> > >
> > >
> > >--
> > >Best Regards！
> > >Huxing
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
--
Best Regards！
Huxing
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Willem Jiang <wi...@gmail.com>.
I think we could put it into the wiki page to let other community
developers know about the policy.
BTW, we could also put the license check into the checklist of release
candidate.
Willem Jiang
Twitter: willemjiang
Weibo: 姜宁willem
On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94 <ke...@163.com> wrote:
>
> Hi All,
> I've excluded the `hibernate-core` dependency and verified as follows:
>
>
> $ mvn license:add-third-party -Dlicense.useMissingFile
> $ cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep "General Public License"
>
>
> here is the output
>
>
> (Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 - http://logback.qos.ch/logback-classic)
> (Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 - http://logback.qos.ch/logback-core)
>
>
> also, I've tested that the functionality introduced together with this dependency[1] works well.
>
>
> I'll check the license next time when I need to introduce new dependencies.
> [1] https://github.com/apache/incubator-dubbo-admin/pull/324
>
>
> Thanks
>
>
> At 2019-04-22 10:17:43, "Huxing Zhang" <hu...@apache.org> wrote:
> >Hi,
> >
> >On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu <wu...@gmail.com> wrote:
> >>
> >> Hi.
> >>
> >> > 1. Stop distribute the binary of incubator-dubbo-admin
> >>
> >> I think "stop distribute the binary" would NOT change the fact the source
> >> release could lead users to use `hiberante-core`. I doubt this is an option.
> >
> >That option is based on my understanding that linking to
> >"hibernate-core" does not create a derivative work of
> >"hibernate-core".
> >Yes, when compiling the source code and run the incubator-dubbo-admin
> >code, the hibernate-core binary will be included, this
> >will create a derivative work of "hibernate-core". As long as user do
> >not distribute it, I think it is fine to use it.
> >This is the same case as using "spring-boot-starter-data-jpa".
> >However, it becomes a problem when user want to distributed the
> >incubator-dubbo-admin binary, it must not be licensed as Apache
> >license, but should only be GPL/LGPL licensed.
> >This creates a risk that some user won't use this software because of
> >the potential license issue, which is not what we want.
> >So as long as an Apache project does not distribute the binary, IMO it is fine.
> >That is my understanding of why this is an option. It is not a good
> >option, but I think it is an option.
> >
> >>
> >> Also based on the license issue, you should consider canceling this vote,
> >> and move the further discussion to dev ml.
> >
> >I agree that cancel this vote is the safest way for now, before
> >everything is cleared.
> >
> >>
> >>
> >> Sheng Wu 吴晟
> >>
> >> Apache SkyWalking, ShardingSphere, Zipkin
> >> Twitter, wusheng1108
> >>
> >>
> >> Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
> >>
> >> > Hi,
> >> >
> >> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> >> > licensed library "hibernate-core", and can still be Apache 2.0
> >> > licensed.
> >> > I am reading [1]. In section 5 it says:
> >> >
> >> > A program that contains no derivative of any portion of the Library,
> >> > but is designed to work with the Library by being compiled or linked
> >> > with it, is called a "work that uses the Library". Such a work, in
> >> > isolation, is not a derivative work of the Library, and therefore
> >> > falls outside the scope of this License.
> >> >
> >> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> >> > "work that uses the Library".
> >> >
> >> > The source code of incubator-dubbo-admin should also falls into this
> >> > case, because it does not contain any portion of the hibernate-core.
> >> > Based on it and explanation here[2], I think the source code can be
> >> > released anyway. Is my understanding correct?
> >> >
> >> > Next, the LGPL license says:
> >> >
> >> > However, linking a "work that uses the Library" with the Library
> >> > creates an executable that is a derivative of the Library (because it
> >> > contains portions of the Library), rather than a "work that uses the
> >> > library". The executable is therefore covered by this License.
> >> >
> >> > The binary distribution of incuabator-dubbo-admin falls into this case
> >> > because it creates an executable that contains binary of
> >> > hibernate-core. Therefore it is a "work based on the library". As a
> >> > derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> >> > is not allowed as an Apache product, and eventually causes the
> >> > incompatibility.
> >> >
> >> > If my understanding is correct, there are at least 4 ways to solve this
> >> > issue:
> >> > 1. Stop distribute the binary of incubator-dubbo-admin
> >> > 2. Make the feature optional, as explained here[3]
> >> > 3. Stop depending on hiberante-core
> >> > 4. Choose other Apache compatible equivalent
> >> >
> >> > I recommend to go with number 3 in my last thread.
> >> >
> >> >
> >> > [1] https://opensource.org/licenses/LGPL-2.1
> >> > [2] https://www.apache.org/legal/resolved.html#prohibited
> >> > [3] https://www.apache.org/legal/resolved.html#optional
> >> >
> >> > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org> wrote:
> >> > >
> >> > > Hi,
> >> > >
> >> > > ccing dev@dubbo
> >> > >
> >> > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com>
> >> > wrote:
> >> > > >
> >> > > > Hi，
> >> > > >
> >> > > > I just checked the binary release kit, it has the third party
> >> > > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> >> > > > X[1], it cannot be included in Apache Product.
> >> > > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> >> > > > fix this issue, I just fill an issue here[2].
> >> > >
> >> > > I did some dig for this issue and confirm that this is introduced by
> >> > > this pull request[1].
> >> > > The purpose of this pull request is to introduce the pagination to
> >> > > service query.
> >> > > In this pull request a dependency to spring-boot-starter-data-jpa was
> >> > added,
> >> > > which introduce the LGPL licensed dependency hibernate-core.
> >> > > The detailed dependency tree is shown below:
> >> > >
> >> > > [INFO] +-
> >> > org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> >> > > [INFO] | +-
> >> > org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> >> > > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> >> > > [INFO] | +-
> >> > org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> >> > > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> >> > > [INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> >> > > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> >> > > [INFO] | | +-
> >> > >
> >> > org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> >> > > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> >> > > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> >> > > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> >> > > [INFO] | | \-
> >> > >
> >> > org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> >> > > [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
> >> > > [INFO] | +-
> >> > org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> >> > > [INFO] | | +-
> >> > > org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> >> > > [INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> >> > > [INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> >> > > [INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
> >> > >
> >> > > Actually the hiberate-core dependency is never used when implementing
> >> > > the feature,
> >> > > I think it can be excluded quietly. This is the safest way to solve this
> >> > issue.
> >> > > To dig further, the only dependency that required to be added is just
> >> > > spring-data-commons,
> >> > > which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
> >> > > and start correctly with spring-data-commons,
> >> > > it might need to check more at runtime to ensure everything is working)
> >> > >
> >> > > We need to be very careful when new dependency is added, and ensure
> >> > > all the license (including transitive dependencies) are compatible
> >> > > with Apache.
> >> > >
> >> > > The community has identified several similar issues [3][4] for
> >> > > incubator-dubbo project, and similar actions should be done to
> >> > > incubator-dubbo-admin as well.
> >> > >
> >> > > To identify the issue automatically, I run the following command:
> >> > >
> >> > > mvn license:add-third-party -Dlicense.useMissingFile
> >> > >
> >> > > and grep the output:
> >> > >
> >> > > cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> >> > > grep "General Public License"
> >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> >> > > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
> >> > > - http://logback.qos.ch/logback-classic)
> >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> >> > > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> >> > > http://logback.qos.ch/logback-core)
> >> > > (GNU Lesser General Public License) Core Hibernate O/RM
> >> > > functionality (org.hibernate:hibernate-core:5.2.17.Final -
> >> > > http://hibernate.org)
> >> > > (GNU Lesser General Public License) Hibernate Commons Annotations
> >> > > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> >> > > http://hibernate.org)
> >> > >
> >> > > The last 2 are both introduced by hibernate-core. A script to check
> >> > > license issue for dependencies was on the way[5].
> >> > >
> >> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> >> > > [2]
> >> > https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> >> > > [3]
> >> > https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> >> > > [4]
> >> > https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> >> > > [5] https://github.com/apache/incubator-dubbo/issues/3840
> >> > >
> >> > > >
> >> > > > [1]https://www.apache.org/legal/resolved.html#category-x
> >> > > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> >> > > >
> >> > > > Willem Jiang
> >> > > >
> >> > > > Twitter: willemjiang
> >> > > > Weibo: 姜宁willem
> >> > > >
> >> > > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com>
> >> > wrote:
> >> > > > >
> >> > > > > Hello Incubator Community,
> >> > > > >
> >> > > > > The Apache Dubbo community has voted on and approved a proposal to
> >> > release
> >> > > > > Apache Dubbo Admin (Incubating) version 0.2.0.
> >> > > > >
> >> > > > > We now kindly request the Incubator PMC members review and vote on
> >> > this
> >> > > > > incubator release.
> >> > > > >
> >> > > > > Apache Dubbo™ (incubating) is a high-performance, java based, open
> >> > source
> >> > > > > RPC framework. Dubbo offers three key functionalities, which include
> >> > > > > interface based remote call, fault tolerance & load balancing, and
> >> > > > > automatic service registration & discovery.
> >> > > > >
> >> > > > >
> >> > > > > Dubbo community vote and result thread:
> >> > > > >
> >> > https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> >> > > > >
> >> > > > > The release candidates (RC3):
> >> > > > > *
> >> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> >> > > > > <
> >> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> >> > >/*
> >> > > > >
> >> > > > >
> >> > > > > Git tag for the release (RC3):
> >> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> >> > > > >
> >> > > > > Hash for the release tag:
> >> > > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> >> > > > >
> >> > > > > Release Notes:
> >> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> >> > > > >
> >> > > > >
> >> > > > > The artifacts have been signed with Key :
> >> > > > > DA2108479B0C1E71, which can be
> >> > > > > found in the keys file:
> >> > > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> >> > > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
> >> > > > >
> >> > > > > The vote will be open for at least 72 hours or until necessary
> >> > number of
> >> > > > > votes are reached.
> >> > > > >
> >> > > > > Please vote accordingly:
> >> > > > >
> >> > > > > [ ] +1 approve
> >> > > > > [ ] +0 no opinion
> >> > > > > [ ] -1 disapprove with the reason
> >> > > > >
> >> > > > > Thanks,
> >> > > > > The Apache Dubbo (Incubating) Team
> >> > > >
> >> > > > ---------------------------------------------------------------------
> >> > > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> >> > > > For additional commands, e-mail: general-help@incubator.apache.org
> >> > > >
> >> > >
> >> > >
> >> > > --
> >> > > Best Regards！
> >> > > Huxing
> >> >
> >> >
> >> >
> >> > --
> >> > Best Regards！
> >> > Huxing
> >> >
> >> > ---------------------------------------------------------------------
> >> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> >> > For additional commands, e-mail: general-help@incubator.apache.org
> >> >
> >> >
> >
> >
> >
> >--
> >Best Regards！
> >Huxing
Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Willem Jiang <wi...@gmail.com>.
I think we could put it into the wiki page to let other community
developers know about the policy.
BTW, we could also put the license check into the checklist of release
candidate.
Willem Jiang
Twitter: willemjiang
Weibo: 姜宁willem
On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94 <ke...@163.com> wrote:
>
> Hi All,
> I've excluded the `hibernate-core` dependency and verified as follows:
>
>
> $ mvn license:add-third-party -Dlicense.useMissingFile
> $ cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep "General Public License"
>
>
> here is the output
>
>
> (Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 - http://logback.qos.ch/logback-classic)
> (Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 - http://logback.qos.ch/logback-core)
>
>
> also, I've tested that the functionality introduced together with this dependency[1] works well.
>
>
> I'll check the license next time when I need to introduce new dependencies.
> [1] https://github.com/apache/incubator-dubbo-admin/pull/324
>
>
> Thanks
>
>
> At 2019-04-22 10:17:43, "Huxing Zhang" <hu...@apache.org> wrote:
> >Hi,
> >
> >On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu <wu...@gmail.com> wrote:
> >>
> >> Hi.
> >>
> >> > 1. Stop distribute the binary of incubator-dubbo-admin
> >>
> >> I think "stop distribute the binary" would NOT change the fact the source
> >> release could lead users to use `hiberante-core`. I doubt this is an option.
> >
> >That option is based on my understanding that linking to
> >"hibernate-core" does not create a derivative work of
> >"hibernate-core".
> >Yes, when compiling the source code and run the incubator-dubbo-admin
> >code, the hibernate-core binary will be included, this
> >will create a derivative work of "hibernate-core". As long as user do
> >not distribute it, I think it is fine to use it.
> >This is the same case as using "spring-boot-starter-data-jpa".
> >However, it becomes a problem when user want to distributed the
> >incubator-dubbo-admin binary, it must not be licensed as Apache
> >license, but should only be GPL/LGPL licensed.
> >This creates a risk that some user won't use this software because of
> >the potential license issue, which is not what we want.
> >So as long as an Apache project does not distribute the binary, IMO it is fine.
> >That is my understanding of why this is an option. It is not a good
> >option, but I think it is an option.
> >
> >>
> >> Also based on the license issue, you should consider canceling this vote,
> >> and move the further discussion to dev ml.
> >
> >I agree that cancel this vote is the safest way for now, before
> >everything is cleared.
> >
> >>
> >>
> >> Sheng Wu 吴晟
> >>
> >> Apache SkyWalking, ShardingSphere, Zipkin
> >> Twitter, wusheng1108
> >>
> >>
> >> Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
> >>
> >> > Hi,
> >> >
> >> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> >> > licensed library "hibernate-core", and can still be Apache 2.0
> >> > licensed.
> >> > I am reading [1]. In section 5 it says:
> >> >
> >> > A program that contains no derivative of any portion of the Library,
> >> > but is designed to work with the Library by being compiled or linked
> >> > with it, is called a "work that uses the Library". Such a work, in
> >> > isolation, is not a derivative work of the Library, and therefore
> >> > falls outside the scope of this License.
> >> >
> >> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> >> > "work that uses the Library".
> >> >
> >> > The source code of incubator-dubbo-admin should also falls into this
> >> > case, because it does not contain any portion of the hibernate-core.
> >> > Based on it and explanation here[2], I think the source code can be
> >> > released anyway. Is my understanding correct?
> >> >
> >> > Next, the LGPL license says:
> >> >
> >> > However, linking a "work that uses the Library" with the Library
> >> > creates an executable that is a derivative of the Library (because it
> >> > contains portions of the Library), rather than a "work that uses the
> >> > library". The executable is therefore covered by this License.
> >> >
> >> > The binary distribution of incuabator-dubbo-admin falls into this case
> >> > because it creates an executable that contains binary of
> >> > hibernate-core. Therefore it is a "work based on the library". As a
> >> > derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> >> > is not allowed as an Apache product, and eventually causes the
> >> > incompatibility.
> >> >
> >> > If my understanding is correct, there are at least 4 ways to solve this
> >> > issue:
> >> > 1. Stop distribute the binary of incubator-dubbo-admin
> >> > 2. Make the feature optional, as explained here[3]
> >> > 3. Stop depending on hiberante-core
> >> > 4. Choose other Apache compatible equivalent
> >> >
> >> > I recommend to go with number 3 in my last thread.
> >> >
> >> >
> >> > [1] https://opensource.org/licenses/LGPL-2.1
> >> > [2] https://www.apache.org/legal/resolved.html#prohibited
> >> > [3] https://www.apache.org/legal/resolved.html#optional
> >> >
> >> > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org> wrote:
> >> > >
> >> > > Hi,
> >> > >
> >> > > ccing dev@dubbo
> >> > >
> >> > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com>
> >> > wrote:
> >> > > >
> >> > > > Hi，
> >> > > >
> >> > > > I just checked the binary release kit, it has the third party
> >> > > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> >> > > > X[1], it cannot be included in Apache Product.
> >> > > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> >> > > > fix this issue, I just fill an issue here[2].
> >> > >
> >> > > I did some dig for this issue and confirm that this is introduced by
> >> > > this pull request[1].
> >> > > The purpose of this pull request is to introduce the pagination to
> >> > > service query.
> >> > > In this pull request a dependency to spring-boot-starter-data-jpa was
> >> > added,
> >> > > which introduce the LGPL licensed dependency hibernate-core.
> >> > > The detailed dependency tree is shown below:
> >> > >
> >> > > [INFO] +-
> >> > org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> >> > > [INFO] | +-
> >> > org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> >> > > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> >> > > [INFO] | +-
> >> > org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> >> > > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> >> > > [INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> >> > > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> >> > > [INFO] | | +-
> >> > >
> >> > org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> >> > > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> >> > > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> >> > > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> >> > > [INFO] | | \-
> >> > >
> >> > org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> >> > > [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
> >> > > [INFO] | +-
> >> > org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> >> > > [INFO] | | +-
> >> > > org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> >> > > [INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> >> > > [INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> >> > > [INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
> >> > >
> >> > > Actually the hiberate-core dependency is never used when implementing
> >> > > the feature,
> >> > > I think it can be excluded quietly. This is the safest way to solve this
> >> > issue.
> >> > > To dig further, the only dependency that required to be added is just
> >> > > spring-data-commons,
> >> > > which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
> >> > > and start correctly with spring-data-commons,
> >> > > it might need to check more at runtime to ensure everything is working)
> >> > >
> >> > > We need to be very careful when new dependency is added, and ensure
> >> > > all the license (including transitive dependencies) are compatible
> >> > > with Apache.
> >> > >
> >> > > The community has identified several similar issues [3][4] for
> >> > > incubator-dubbo project, and similar actions should be done to
> >> > > incubator-dubbo-admin as well.
> >> > >
> >> > > To identify the issue automatically, I run the following command:
> >> > >
> >> > > mvn license:add-third-party -Dlicense.useMissingFile
> >> > >
> >> > > and grep the output:
> >> > >
> >> > > cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> >> > > grep "General Public License"
> >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> >> > > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
> >> > > - http://logback.qos.ch/logback-classic)
> >> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> >> > > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> >> > > http://logback.qos.ch/logback-core)
> >> > > (GNU Lesser General Public License) Core Hibernate O/RM
> >> > > functionality (org.hibernate:hibernate-core:5.2.17.Final -
> >> > > http://hibernate.org)
> >> > > (GNU Lesser General Public License) Hibernate Commons Annotations
> >> > > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> >> > > http://hibernate.org)
> >> > >
> >> > > The last 2 are both introduced by hibernate-core. A script to check
> >> > > license issue for dependencies was on the way[5].
> >> > >
> >> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> >> > > [2]
> >> > https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> >> > > [3]
> >> > https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> >> > > [4]
> >> > https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> >> > > [5] https://github.com/apache/incubator-dubbo/issues/3840
> >> > >
> >> > > >
> >> > > > [1]https://www.apache.org/legal/resolved.html#category-x
> >> > > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> >> > > >
> >> > > > Willem Jiang
> >> > > >
> >> > > > Twitter: willemjiang
> >> > > > Weibo: 姜宁willem
> >> > > >
> >> > > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com>
> >> > wrote:
> >> > > > >
> >> > > > > Hello Incubator Community,
> >> > > > >
> >> > > > > The Apache Dubbo community has voted on and approved a proposal to
> >> > release
> >> > > > > Apache Dubbo Admin (Incubating) version 0.2.0.
> >> > > > >
> >> > > > > We now kindly request the Incubator PMC members review and vote on
> >> > this
> >> > > > > incubator release.
> >> > > > >
> >> > > > > Apache Dubbo™ (incubating) is a high-performance, java based, open
> >> > source
> >> > > > > RPC framework. Dubbo offers three key functionalities, which include
> >> > > > > interface based remote call, fault tolerance & load balancing, and
> >> > > > > automatic service registration & discovery.
> >> > > > >
> >> > > > >
> >> > > > > Dubbo community vote and result thread:
> >> > > > >
> >> > https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> >> > > > >
> >> > > > > The release candidates (RC3):
> >> > > > > *
> >> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> >> > > > > <
> >> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> >> > >/*
> >> > > > >
> >> > > > >
> >> > > > > Git tag for the release (RC3):
> >> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> >> > > > >
> >> > > > > Hash for the release tag:
> >> > > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> >> > > > >
> >> > > > > Release Notes:
> >> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> >> > > > >
> >> > > > >
> >> > > > > The artifacts have been signed with Key :
> >> > > > > DA2108479B0C1E71, which can be
> >> > > > > found in the keys file:
> >> > > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> >> > > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
> >> > > > >
> >> > > > > The vote will be open for at least 72 hours or until necessary
> >> > number of
> >> > > > > votes are reached.
> >> > > > >
> >> > > > > Please vote accordingly:
> >> > > > >
> >> > > > > [ ] +1 approve
> >> > > > > [ ] +0 no opinion
> >> > > > > [ ] -1 disapprove with the reason
> >> > > > >
> >> > > > > Thanks,
> >> > > > > The Apache Dubbo (Incubating) Team
> >> > > >
> >> > > > ---------------------------------------------------------------------
> >> > > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> >> > > > For additional commands, e-mail: general-help@incubator.apache.org
> >> > > >
> >> > >
> >> > >
> >> > > --
> >> > > Best Regards！
> >> > > Huxing
> >> >
> >> >
> >> >
> >> > --
> >> > Best Regards！
> >> > Huxing
> >> >
> >> > ---------------------------------------------------------------------
> >> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> >> > For additional commands, e-mail: general-help@incubator.apache.org
> >> >
> >> >
> >
> >
> >
> >--
> >Best Regards！
> >Huxing
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re:Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by kezhenxu94 <ke...@163.com>.
Hi All,
I've excluded the `hibernate-core` dependency and verified as follows:
$ mvn license:add-third-party -Dlicense.useMissingFile
$ cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep "General Public License"
here is the output
(Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 - http://logback.qos.ch/logback-classic)
(Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 - http://logback.qos.ch/logback-core)
also, I've tested that the functionality introduced together with this dependency[1] works well.
I'll check the license next time when I need to introduce new dependencies.
[1] https://github.com/apache/incubator-dubbo-admin/pull/324
Thanks
At 2019-04-22 10:17:43, "Huxing Zhang" <hu...@apache.org> wrote:
>Hi,
>
>On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu <wu...@gmail.com> wrote:
>>
>> Hi.
>>
>> > 1. Stop distribute the binary of incubator-dubbo-admin
>>
>> I think "stop distribute the binary" would NOT change the fact the source
>> release could lead users to use `hiberante-core`. I doubt this is an option.
>
>That option is based on my understanding that linking to
>"hibernate-core" does not create a derivative work of
>"hibernate-core".
>Yes, when compiling the source code and run the incubator-dubbo-admin
>code, the hibernate-core binary will be included, this
>will create a derivative work of "hibernate-core". As long as user do
>not distribute it, I think it is fine to use it.
>This is the same case as using "spring-boot-starter-data-jpa".
>However, it becomes a problem when user want to distributed the
>incubator-dubbo-admin binary, it must not be licensed as Apache
>license, but should only be GPL/LGPL licensed.
>This creates a risk that some user won't use this software because of
>the potential license issue, which is not what we want.
>So as long as an Apache project does not distribute the binary, IMO it is fine.
>That is my understanding of why this is an option. It is not a good
>option, but I think it is an option.
>
>>
>> Also based on the license issue, you should consider canceling this vote,
>> and move the further discussion to dev ml.
>
>I agree that cancel this vote is the safest way for now, before
>everything is cleared.
>
>>
>>
>> Sheng Wu 吴晟
>>
>> Apache SkyWalking, ShardingSphere, Zipkin
>> Twitter, wusheng1108
>>
>>
>> Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
>>
>> > Hi,
>> >
>> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
>> > licensed library "hibernate-core", and can still be Apache 2.0
>> > licensed.
>> > I am reading [1]. In section 5 it says:
>> >
>> > A program that contains no derivative of any portion of the Library,
>> > but is designed to work with the Library by being compiled or linked
>> > with it, is called a "work that uses the Library". Such a work, in
>> > isolation, is not a derivative work of the Library, and therefore
>> > falls outside the scope of this License.
>> >
>> > I think spring-boot-starter-data-jpa falls in to this case. It is a
>> > "work that uses the Library".
>> >
>> > The source code of incubator-dubbo-admin should also falls into this
>> > case, because it does not contain any portion of the hibernate-core.
>> > Based on it and explanation here[2], I think the source code can be
>> > released anyway. Is my understanding correct?
>> >
>> > Next, the LGPL license says:
>> >
>> > However, linking a "work that uses the Library" with the Library
>> > creates an executable that is a derivative of the Library (because it
>> > contains portions of the Library), rather than a "work that uses the
>> > library". The executable is therefore covered by this License.
>> >
>> > The binary distribution of incuabator-dubbo-admin falls into this case
>> > because it creates an executable that contains binary of
>> > hibernate-core. Therefore it is a "work based on the library". As a
>> > derivative of hibernate-core, it must be licensed with LGPL/GPL, which
>> > is not allowed as an Apache product, and eventually causes the
>> > incompatibility.
>> >
>> > If my understanding is correct, there are at least 4 ways to solve this
>> > issue:
>> > 1. Stop distribute the binary of incubator-dubbo-admin
>> > 2. Make the feature optional, as explained here[3]
>> > 3. Stop depending on hiberante-core
>> > 4. Choose other Apache compatible equivalent
>> >
>> > I recommend to go with number 3 in my last thread.
>> >
>> >
>> > [1] https://opensource.org/licenses/LGPL-2.1
>> > [2] https://www.apache.org/legal/resolved.html#prohibited
>> > [3] https://www.apache.org/legal/resolved.html#optional
>> >
>> > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org> wrote:
>> > >
>> > > Hi,
>> > >
>> > > ccing dev@dubbo
>> > >
>> > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com>
>> > wrote:
>> > > >
>> > > > Hi，
>> > > >
>> > > > I just checked the binary release kit, it has the third party
>> > > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
>> > > > X[1], it cannot be included in Apache Product.
>> > > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
>> > > > fix this issue, I just fill an issue here[2].
>> > >
>> > > I did some dig for this issue and confirm that this is introduced by
>> > > this pull request[1].
>> > > The purpose of this pull request is to introduce the pagination to
>> > > service query.
>> > > In this pull request a dependency to spring-boot-starter-data-jpa was
>> > added,
>> > > which introduce the LGPL licensed dependency hibernate-core.
>> > > The detailed dependency tree is shown below:
>> > >
>> > > [INFO] +-
>> > org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
>> > > [INFO] | +-
>> > org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
>> > > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
>> > > [INFO] | +-
>> > org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
>> > > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
>> > > [INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
>> > > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
>> > > [INFO] | | +-
>> > >
>> > org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
>> > > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
>> > > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
>> > > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
>> > > [INFO] | | \-
>> > >
>> > org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
>> > > [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
>> > > [INFO] | +-
>> > org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
>> > > [INFO] | | +-
>> > > org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
>> > > [INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
>> > > [INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
>> > > [INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
>> > >
>> > > Actually the hiberate-core dependency is never used when implementing
>> > > the feature,
>> > > I think it can be excluded quietly. This is the safest way to solve this
>> > issue.
>> > > To dig further, the only dependency that required to be added is just
>> > > spring-data-commons,
>> > > which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
>> > > and start correctly with spring-data-commons,
>> > > it might need to check more at runtime to ensure everything is working)
>> > >
>> > > We need to be very careful when new dependency is added, and ensure
>> > > all the license (including transitive dependencies) are compatible
>> > > with Apache.
>> > >
>> > > The community has identified several similar issues [3][4] for
>> > > incubator-dubbo project, and similar actions should be done to
>> > > incubator-dubbo-admin as well.
>> > >
>> > > To identify the issue automatically, I run the following command:
>> > >
>> > > mvn license:add-third-party -Dlicense.useMissingFile
>> > >
>> > > and grep the output:
>> > >
>> > > cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
>> > > grep "General Public License"
>> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
>> > > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
>> > > - http://logback.qos.ch/logback-classic)
>> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
>> > > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
>> > > http://logback.qos.ch/logback-core)
>> > > (GNU Lesser General Public License) Core Hibernate O/RM
>> > > functionality (org.hibernate:hibernate-core:5.2.17.Final -
>> > > http://hibernate.org)
>> > > (GNU Lesser General Public License) Hibernate Commons Annotations
>> > > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
>> > > http://hibernate.org)
>> > >
>> > > The last 2 are both introduced by hibernate-core. A script to check
>> > > license issue for dependencies was on the way[5].
>> > >
>> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
>> > > [2]
>> > https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
>> > > [3]
>> > https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
>> > > [4]
>> > https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
>> > > [5] https://github.com/apache/incubator-dubbo/issues/3840
>> > >
>> > > >
>> > > > [1]https://www.apache.org/legal/resolved.html#category-x
>> > > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
>> > > >
>> > > > Willem Jiang
>> > > >
>> > > > Twitter: willemjiang
>> > > > Weibo: 姜宁willem
>> > > >
>> > > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com>
>> > wrote:
>> > > > >
>> > > > > Hello Incubator Community,
>> > > > >
>> > > > > The Apache Dubbo community has voted on and approved a proposal to
>> > release
>> > > > > Apache Dubbo Admin (Incubating) version 0.2.0.
>> > > > >
>> > > > > We now kindly request the Incubator PMC members review and vote on
>> > this
>> > > > > incubator release.
>> > > > >
>> > > > > Apache Dubbo™ (incubating) is a high-performance, java based, open
>> > source
>> > > > > RPC framework. Dubbo offers three key functionalities, which include
>> > > > > interface based remote call, fault tolerance & load balancing, and
>> > > > > automatic service registration & discovery.
>> > > > >
>> > > > >
>> > > > > Dubbo community vote and result thread:
>> > > > >
>> > https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
>> > > > >
>> > > > > The release candidates (RC3):
>> > > > > *
>> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
>> > > > > <
>> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
>> > >/*
>> > > > >
>> > > > >
>> > > > > Git tag for the release (RC3):
>> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
>> > > > >
>> > > > > Hash for the release tag:
>> > > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
>> > > > >
>> > > > > Release Notes:
>> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
>> > > > >
>> > > > >
>> > > > > The artifacts have been signed with Key :
>> > > > > DA2108479B0C1E71, which can be
>> > > > > found in the keys file:
>> > > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
>> > > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
>> > > > >
>> > > > > The vote will be open for at least 72 hours or until necessary
>> > number of
>> > > > > votes are reached.
>> > > > >
>> > > > > Please vote accordingly:
>> > > > >
>> > > > > [ ] +1 approve
>> > > > > [ ] +0 no opinion
>> > > > > [ ] -1 disapprove with the reason
>> > > > >
>> > > > > Thanks,
>> > > > > The Apache Dubbo (Incubating) Team
>> > > >
>> > > > ---------------------------------------------------------------------
>> > > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>> > > > For additional commands, e-mail: general-help@incubator.apache.org
>> > > >
>> > >
>> > >
>> > > --
>> > > Best Regards！
>> > > Huxing
>> >
>> >
>> >
>> > --
>> > Best Regards！
>> > Huxing
>> >
>> > ---------------------------------------------------------------------
>> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>> > For additional commands, e-mail: general-help@incubator.apache.org
>> >
>> >
>
>
>
>--
>Best Regards！
>Huxing
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Sheng Wu <wu...@gmail.com>.
Hi
> That option is based on my understanding that linking to
> "hibernate-core" does not create a derivative work of
> "hibernate-core".
> Yes, when compiling the source code and run the incubator-dubbo-admin
> code, the hibernate-core binary will be included, this
> will create a derivative work of "hibernate-core". As long as user do
> not distribute it, I think it is fine to use it.
> This is the same case as using "spring-boot-starter-data-jpa".
> However, it becomes a problem when user want to distributed the
> incubator-dubbo-admin binary, it must not be licensed as Apache
> license, but should only be GPL/LGPL licensed.
> This creates a risk that some user won't use this software because of
> the potential license issue, which is not what we want.
> So as long as an Apache project does not distribute the binary, IMO it is
fine.
> That is my understanding of why this is an option. It is not a good
> option, but I think it is an option.
As an Apache project, we should make sure re-distribution friendly, no
matter what the user intends to do.
So I still think only keep them optional, and the user could download and
use them if they want by themselves.
For the license part, I am not an expert, even not close, but I prefer to
follow the Apache suggestion at this moment. Unless the board or legal team
change that.
As it belongs to Catalog X[1] now and also supported by your answer, LGPL
is not friendly to re-distribution.
I still consider this a license issue.
Also, you could bring this discussion to legal ml, I think.
[1] https://apache.org/legal/resolved.html#category-x
Sheng Wu 吴晟
Apache SkyWalking, ShardingSphere, Zipkin
Twitter, wusheng1108
Huxing Zhang <hu...@apache.org> 于2019年4月22日周一 上午10:18写道：
> Hi,
>
> On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu <wu...@gmail.com>
> wrote:
> >
> > Hi.
> >
> > > 1. Stop distribute the binary of incubator-dubbo-admin
> >
> > I think "stop distribute the binary" would NOT change the fact the source
> > release could lead users to use `hiberante-core`. I doubt this is an
> option.
>
> That option is based on my understanding that linking to
> "hibernate-core" does not create a derivative work of
> "hibernate-core".
> Yes, when compiling the source code and run the incubator-dubbo-admin
> code, the hibernate-core binary will be included, this
> will create a derivative work of "hibernate-core". As long as user do
> not distribute it, I think it is fine to use it.
> This is the same case as using "spring-boot-starter-data-jpa".
> However, it becomes a problem when user want to distributed the
> incubator-dubbo-admin binary, it must not be licensed as Apache
> license, but should only be GPL/LGPL licensed.
> This creates a risk that some user won't use this software because of
> the potential license issue, which is not what we want.
> So as long as an Apache project does not distribute the binary, IMO it is
> fine.
> That is my understanding of why this is an option. It is not a good
> option, but I think it is an option.
>
> >
> > Also based on the license issue, you should consider canceling this vote,
> > and move the further discussion to dev ml.
>
> I agree that cancel this vote is the safest way for now, before
> everything is cleared.
>
> >
> >
> > Sheng Wu 吴晟
> >
> > Apache SkyWalking, ShardingSphere, Zipkin
> > Twitter, wusheng1108
> >
> >
> > Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
> >
> > > Hi,
> > >
> > > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> > > licensed library "hibernate-core", and can still be Apache 2.0
> > > licensed.
> > > I am reading [1]. In section 5 it says:
> > >
> > > A program that contains no derivative of any portion of the Library,
> > > but is designed to work with the Library by being compiled or linked
> > > with it, is called a "work that uses the Library". Such a work, in
> > > isolation, is not a derivative work of the Library, and therefore
> > > falls outside the scope of this License.
> > >
> > > I think spring-boot-starter-data-jpa falls in to this case. It is a
> > > "work that uses the Library".
> > >
> > > The source code of incubator-dubbo-admin should also falls into this
> > > case, because it does not contain any portion of the hibernate-core.
> > > Based on it and explanation here[2], I think the source code can be
> > > released anyway. Is my understanding correct?
> > >
> > > Next, the LGPL license says:
> > >
> > > However, linking a "work that uses the Library" with the Library
> > > creates an executable that is a derivative of the Library (because it
> > > contains portions of the Library), rather than a "work that uses the
> > > library". The executable is therefore covered by this License.
> > >
> > > The binary distribution of incuabator-dubbo-admin falls into this case
> > > because it creates an executable that contains binary of
> > > hibernate-core. Therefore it is a "work based on the library". As a
> > > derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> > > is not allowed as an Apache product, and eventually causes the
> > > incompatibility.
> > >
> > > If my understanding is correct, there are at least 4 ways to solve this
> > > issue:
> > > 1. Stop distribute the binary of incubator-dubbo-admin
> > > 2. Make the feature optional, as explained here[3]
> > > 3. Stop depending on hiberante-core
> > > 4. Choose other Apache compatible equivalent
> > >
> > > I recommend to go with number 3 in my last thread.
> > >
> > >
> > > [1] https://opensource.org/licenses/LGPL-2.1
> > > [2] https://www.apache.org/legal/resolved.html#prohibited
> > > [3] https://www.apache.org/legal/resolved.html#optional
> > >
> > > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org>
> wrote:
> > > >
> > > > Hi,
> > > >
> > > > ccing dev@dubbo
> > > >
> > > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <willem.jiang@gmail.com
> >
> > > wrote:
> > > > >
> > > > > Hi，
> > > > >
> > > > > I just checked the binary release kit, it has the third party
> > > > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> > > > > X[1], it cannot be included in Apache Product.
> > > > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link
> to
> > > > > fix this issue, I just fill an issue here[2].
> > > >
> > > > I did some dig for this issue and confirm that this is introduced by
> > > > this pull request[1].
> > > > The purpose of this pull request is to introduce the pagination to
> > > > service query.
> > > > In this pull request a dependency to spring-boot-starter-data-jpa was
> > > added,
> > > > which introduce the LGPL licensed dependency hibernate-core.
> > > > The detailed dependency tree is shown below:
> > > >
> > > > [INFO] +-
> > >
> org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> > > > [INFO] | +-
> > >
> org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> > > > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> > > > [INFO] | +-
> > >
> org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> > > > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> > > > [INFO] | | \-
> org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> > > > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> > > > [INFO] | | +-
> > > >
> > >
> org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> > > > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> > > > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> > > > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> > > > [INFO] | | \-
> > > >
> > >
> org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> > > > [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
> > > > [INFO] | +-
> > > org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> > > > [INFO] | | +-
> > > >
> org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> > > > [INFO] | | +-
> org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> > > > [INFO] | | \-
> org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> > > > [INFO] | \-
> org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
> > > >
> > > > Actually the hiberate-core dependency is never used when implementing
> > > > the feature,
> > > > I think it can be excluded quietly. This is the safest way to solve
> this
> > > issue.
> > > > To dig further, the only dependency that required to be added is just
> > > > spring-data-commons,
> > > > which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
> > > > and start correctly with spring-data-commons,
> > > > it might need to check more at runtime to ensure everything is
> working)
> > > >
> > > > We need to be very careful when new dependency is added, and ensure
> > > > all the license (including transitive dependencies) are compatible
> > > > with Apache.
> > > >
> > > > The community has identified several similar issues [3][4] for
> > > > incubator-dubbo project, and similar actions should be done to
> > > > incubator-dubbo-admin as well.
> > > >
> > > > To identify the issue automatically, I run the following command:
> > > >
> > > > mvn license:add-third-party -Dlicense.useMissingFile
> > > >
> > > > and grep the output:
> > > >
> > > > cat
> dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> > > > grep "General Public License"
> > > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > > > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
> > > > - http://logback.qos.ch/logback-classic)
> > > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > > > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> > > > http://logback.qos.ch/logback-core)
> > > > (GNU Lesser General Public License) Core Hibernate O/RM
> > > > functionality (org.hibernate:hibernate-core:5.2.17.Final -
> > > > http://hibernate.org)
> > > > (GNU Lesser General Public License) Hibernate Commons
> Annotations
> > > > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> > > > http://hibernate.org)
> > > >
> > > > The last 2 are both introduced by hibernate-core. A script to check
> > > > license issue for dependencies was on the way[5].
> > > >
> > > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> > > > [2]
> > >
> https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> > > > [3]
> > >
> https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> > > > [4]
> > >
> https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> > > > [5] https://github.com/apache/incubator-dubbo/issues/3840
> > > >
> > > > >
> > > > > [1]https://www.apache.org/legal/resolved.html#category-x
> > > > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> > > > >
> > > > > Willem Jiang
> > > > >
> > > > > Twitter: willemjiang
> > > > > Weibo: 姜宁willem
> > > > >
> > > > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <
> z82507200@gmail.com>
> > > wrote:
> > > > > >
> > > > > > Hello Incubator Community,
> > > > > >
> > > > > > The Apache Dubbo community has voted on and approved a proposal
> to
> > > release
> > > > > > Apache Dubbo Admin (Incubating) version 0.2.0.
> > > > > >
> > > > > > We now kindly request the Incubator PMC members review and vote
> on
> > > this
> > > > > > incubator release.
> > > > > >
> > > > > > Apache Dubbo™ (incubating) is a high-performance, java based,
> open
> > > source
> > > > > > RPC framework. Dubbo offers three key functionalities, which
> include
> > > > > > interface based remote call, fault tolerance & load balancing,
> and
> > > > > > automatic service registration & discovery.
> > > > > >
> > > > > >
> > > > > > Dubbo community vote and result thread:
> > > > > >
> > >
> https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> > > > > >
> > > > > > The release candidates (RC3):
> > > > > > *
> > >
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> > > > > > <
> > >
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > > >/*
> > > > > >
> > > > > >
> > > > > > Git tag for the release (RC3):
> > > > > >
> https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > > > >
> > > > > > Hash for the release tag:
> > > > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> > > > > >
> > > > > > Release Notes:
> > > > > >
> https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > > > >
> > > > > >
> > > > > > The artifacts have been signed with Key :
> > > > > > DA2108479B0C1E71, which can be
> > > > > > found in the keys file:
> > > > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > > > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
> > > > > >
> > > > > > The vote will be open for at least 72 hours or until necessary
> > > number of
> > > > > > votes are reached.
> > > > > >
> > > > > > Please vote accordingly:
> > > > > >
> > > > > > [ ] +1 approve
> > > > > > [ ] +0 no opinion
> > > > > > [ ] -1 disapprove with the reason
> > > > > >
> > > > > > Thanks,
> > > > > > The Apache Dubbo (Incubating) Team
> > > > >
> > > > >
> ---------------------------------------------------------------------
> > > > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > > > > For additional commands, e-mail: general-help@incubator.apache.org
> > > > >
> > > >
> > > >
> > > > --
> > > > Best Regards！
> > > > Huxing
> > >
> > >
> > >
> > > --
> > > Best Regards！
> > > Huxing
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > > For additional commands, e-mail: general-help@incubator.apache.org
> > >
> > >
>
>
>
> --
> Best Regards！
> Huxing
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>
Re:Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by kezhenxu94 <ke...@163.com>.
Hi All,
I've excluded the `hibernate-core` dependency and verified as follows:
$ mvn license:add-third-party -Dlicense.useMissingFile
$ cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep "General Public License"
here is the output
(Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 - http://logback.qos.ch/logback-classic)
(Eclipse Public License - v 1.0) (GNU Lesser General Public License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 - http://logback.qos.ch/logback-core)
also, I've tested that the functionality introduced together with this dependency[1] works well.
I'll check the license next time when I need to introduce new dependencies.
[1] https://github.com/apache/incubator-dubbo-admin/pull/324
Thanks
At 2019-04-22 10:17:43, "Huxing Zhang" <hu...@apache.org> wrote:
>Hi,
>
>On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu <wu...@gmail.com> wrote:
>>
>> Hi.
>>
>> > 1. Stop distribute the binary of incubator-dubbo-admin
>>
>> I think "stop distribute the binary" would NOT change the fact the source
>> release could lead users to use `hiberante-core`. I doubt this is an option.
>
>That option is based on my understanding that linking to
>"hibernate-core" does not create a derivative work of
>"hibernate-core".
>Yes, when compiling the source code and run the incubator-dubbo-admin
>code, the hibernate-core binary will be included, this
>will create a derivative work of "hibernate-core". As long as user do
>not distribute it, I think it is fine to use it.
>This is the same case as using "spring-boot-starter-data-jpa".
>However, it becomes a problem when user want to distributed the
>incubator-dubbo-admin binary, it must not be licensed as Apache
>license, but should only be GPL/LGPL licensed.
>This creates a risk that some user won't use this software because of
>the potential license issue, which is not what we want.
>So as long as an Apache project does not distribute the binary, IMO it is fine.
>That is my understanding of why this is an option. It is not a good
>option, but I think it is an option.
>
>>
>> Also based on the license issue, you should consider canceling this vote,
>> and move the further discussion to dev ml.
>
>I agree that cancel this vote is the safest way for now, before
>everything is cleared.
>
>>
>>
>> Sheng Wu 吴晟
>>
>> Apache SkyWalking, ShardingSphere, Zipkin
>> Twitter, wusheng1108
>>
>>
>> Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
>>
>> > Hi,
>> >
>> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
>> > licensed library "hibernate-core", and can still be Apache 2.0
>> > licensed.
>> > I am reading [1]. In section 5 it says:
>> >
>> > A program that contains no derivative of any portion of the Library,
>> > but is designed to work with the Library by being compiled or linked
>> > with it, is called a "work that uses the Library". Such a work, in
>> > isolation, is not a derivative work of the Library, and therefore
>> > falls outside the scope of this License.
>> >
>> > I think spring-boot-starter-data-jpa falls in to this case. It is a
>> > "work that uses the Library".
>> >
>> > The source code of incubator-dubbo-admin should also falls into this
>> > case, because it does not contain any portion of the hibernate-core.
>> > Based on it and explanation here[2], I think the source code can be
>> > released anyway. Is my understanding correct?
>> >
>> > Next, the LGPL license says:
>> >
>> > However, linking a "work that uses the Library" with the Library
>> > creates an executable that is a derivative of the Library (because it
>> > contains portions of the Library), rather than a "work that uses the
>> > library". The executable is therefore covered by this License.
>> >
>> > The binary distribution of incuabator-dubbo-admin falls into this case
>> > because it creates an executable that contains binary of
>> > hibernate-core. Therefore it is a "work based on the library". As a
>> > derivative of hibernate-core, it must be licensed with LGPL/GPL, which
>> > is not allowed as an Apache product, and eventually causes the
>> > incompatibility.
>> >
>> > If my understanding is correct, there are at least 4 ways to solve this
>> > issue:
>> > 1. Stop distribute the binary of incubator-dubbo-admin
>> > 2. Make the feature optional, as explained here[3]
>> > 3. Stop depending on hiberante-core
>> > 4. Choose other Apache compatible equivalent
>> >
>> > I recommend to go with number 3 in my last thread.
>> >
>> >
>> > [1] https://opensource.org/licenses/LGPL-2.1
>> > [2] https://www.apache.org/legal/resolved.html#prohibited
>> > [3] https://www.apache.org/legal/resolved.html#optional
>> >
>> > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org> wrote:
>> > >
>> > > Hi,
>> > >
>> > > ccing dev@dubbo
>> > >
>> > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com>
>> > wrote:
>> > > >
>> > > > Hi，
>> > > >
>> > > > I just checked the binary release kit, it has the third party
>> > > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
>> > > > X[1], it cannot be included in Apache Product.
>> > > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
>> > > > fix this issue, I just fill an issue here[2].
>> > >
>> > > I did some dig for this issue and confirm that this is introduced by
>> > > this pull request[1].
>> > > The purpose of this pull request is to introduce the pagination to
>> > > service query.
>> > > In this pull request a dependency to spring-boot-starter-data-jpa was
>> > added,
>> > > which introduce the LGPL licensed dependency hibernate-core.
>> > > The detailed dependency tree is shown below:
>> > >
>> > > [INFO] +-
>> > org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
>> > > [INFO] | +-
>> > org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
>> > > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
>> > > [INFO] | +-
>> > org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
>> > > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
>> > > [INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
>> > > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
>> > > [INFO] | | +-
>> > >
>> > org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
>> > > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
>> > > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
>> > > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
>> > > [INFO] | | \-
>> > >
>> > org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
>> > > [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
>> > > [INFO] | +-
>> > org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
>> > > [INFO] | | +-
>> > > org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
>> > > [INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
>> > > [INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
>> > > [INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
>> > >
>> > > Actually the hiberate-core dependency is never used when implementing
>> > > the feature,
>> > > I think it can be excluded quietly. This is the safest way to solve this
>> > issue.
>> > > To dig further, the only dependency that required to be added is just
>> > > spring-data-commons,
>> > > which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
>> > > and start correctly with spring-data-commons,
>> > > it might need to check more at runtime to ensure everything is working)
>> > >
>> > > We need to be very careful when new dependency is added, and ensure
>> > > all the license (including transitive dependencies) are compatible
>> > > with Apache.
>> > >
>> > > The community has identified several similar issues [3][4] for
>> > > incubator-dubbo project, and similar actions should be done to
>> > > incubator-dubbo-admin as well.
>> > >
>> > > To identify the issue automatically, I run the following command:
>> > >
>> > > mvn license:add-third-party -Dlicense.useMissingFile
>> > >
>> > > and grep the output:
>> > >
>> > > cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
>> > > grep "General Public License"
>> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
>> > > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
>> > > - http://logback.qos.ch/logback-classic)
>> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
>> > > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
>> > > http://logback.qos.ch/logback-core)
>> > > (GNU Lesser General Public License) Core Hibernate O/RM
>> > > functionality (org.hibernate:hibernate-core:5.2.17.Final -
>> > > http://hibernate.org)
>> > > (GNU Lesser General Public License) Hibernate Commons Annotations
>> > > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
>> > > http://hibernate.org)
>> > >
>> > > The last 2 are both introduced by hibernate-core. A script to check
>> > > license issue for dependencies was on the way[5].
>> > >
>> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
>> > > [2]
>> > https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
>> > > [3]
>> > https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
>> > > [4]
>> > https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
>> > > [5] https://github.com/apache/incubator-dubbo/issues/3840
>> > >
>> > > >
>> > > > [1]https://www.apache.org/legal/resolved.html#category-x
>> > > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
>> > > >
>> > > > Willem Jiang
>> > > >
>> > > > Twitter: willemjiang
>> > > > Weibo: 姜宁willem
>> > > >
>> > > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com>
>> > wrote:
>> > > > >
>> > > > > Hello Incubator Community,
>> > > > >
>> > > > > The Apache Dubbo community has voted on and approved a proposal to
>> > release
>> > > > > Apache Dubbo Admin (Incubating) version 0.2.0.
>> > > > >
>> > > > > We now kindly request the Incubator PMC members review and vote on
>> > this
>> > > > > incubator release.
>> > > > >
>> > > > > Apache Dubbo™ (incubating) is a high-performance, java based, open
>> > source
>> > > > > RPC framework. Dubbo offers three key functionalities, which include
>> > > > > interface based remote call, fault tolerance & load balancing, and
>> > > > > automatic service registration & discovery.
>> > > > >
>> > > > >
>> > > > > Dubbo community vote and result thread:
>> > > > >
>> > https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
>> > > > >
>> > > > > The release candidates (RC3):
>> > > > > *
>> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
>> > > > > <
>> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
>> > >/*
>> > > > >
>> > > > >
>> > > > > Git tag for the release (RC3):
>> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
>> > > > >
>> > > > > Hash for the release tag:
>> > > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
>> > > > >
>> > > > > Release Notes:
>> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
>> > > > >
>> > > > >
>> > > > > The artifacts have been signed with Key :
>> > > > > DA2108479B0C1E71, which can be
>> > > > > found in the keys file:
>> > > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
>> > > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
>> > > > >
>> > > > > The vote will be open for at least 72 hours or until necessary
>> > number of
>> > > > > votes are reached.
>> > > > >
>> > > > > Please vote accordingly:
>> > > > >
>> > > > > [ ] +1 approve
>> > > > > [ ] +0 no opinion
>> > > > > [ ] -1 disapprove with the reason
>> > > > >
>> > > > > Thanks,
>> > > > > The Apache Dubbo (Incubating) Team
>> > > >
>> > > > ---------------------------------------------------------------------
>> > > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>> > > > For additional commands, e-mail: general-help@incubator.apache.org
>> > > >
>> > >
>> > >
>> > > --
>> > > Best Regards！
>> > > Huxing
>> >
>> >
>> >
>> > --
>> > Best Regards！
>> > Huxing
>> >
>> > ---------------------------------------------------------------------
>> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>> > For additional commands, e-mail: general-help@incubator.apache.org
>> >
>> >
>
>
>
>--
>Best Regards！
>Huxing
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Huxing Zhang <hu...@apache.org>.
Hi,
On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu <wu...@gmail.com> wrote:
>
> Hi.
>
> > 1. Stop distribute the binary of incubator-dubbo-admin
>
> I think "stop distribute the binary" would NOT change the fact the source
> release could lead users to use `hiberante-core`. I doubt this is an option.
That option is based on my understanding that linking to
"hibernate-core" does not create a derivative work of
"hibernate-core".
Yes, when compiling the source code and run the incubator-dubbo-admin
code, the hibernate-core binary will be included, this
will create a derivative work of "hibernate-core". As long as user do
not distribute it, I think it is fine to use it.
This is the same case as using "spring-boot-starter-data-jpa".
However, it becomes a problem when user want to distributed the
incubator-dubbo-admin binary, it must not be licensed as Apache
license, but should only be GPL/LGPL licensed.
This creates a risk that some user won't use this software because of
the potential license issue, which is not what we want.
So as long as an Apache project does not distribute the binary, IMO it is fine.
That is my understanding of why this is an option. It is not a good
option, but I think it is an option.
>
> Also based on the license issue, you should consider canceling this vote,
> and move the further discussion to dev ml.
I agree that cancel this vote is the safest way for now, before
everything is cleared.
>
>
> Sheng Wu 吴晟
>
> Apache SkyWalking, ShardingSphere, Zipkin
> Twitter, wusheng1108
>
>
> Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
>
> > Hi,
> >
> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> > licensed library "hibernate-core", and can still be Apache 2.0
> > licensed.
> > I am reading [1]. In section 5 it says:
> >
> > A program that contains no derivative of any portion of the Library,
> > but is designed to work with the Library by being compiled or linked
> > with it, is called a "work that uses the Library". Such a work, in
> > isolation, is not a derivative work of the Library, and therefore
> > falls outside the scope of this License.
> >
> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> > "work that uses the Library".
> >
> > The source code of incubator-dubbo-admin should also falls into this
> > case, because it does not contain any portion of the hibernate-core.
> > Based on it and explanation here[2], I think the source code can be
> > released anyway. Is my understanding correct?
> >
> > Next, the LGPL license says:
> >
> > However, linking a "work that uses the Library" with the Library
> > creates an executable that is a derivative of the Library (because it
> > contains portions of the Library), rather than a "work that uses the
> > library". The executable is therefore covered by this License.
> >
> > The binary distribution of incuabator-dubbo-admin falls into this case
> > because it creates an executable that contains binary of
> > hibernate-core. Therefore it is a "work based on the library". As a
> > derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> > is not allowed as an Apache product, and eventually causes the
> > incompatibility.
> >
> > If my understanding is correct, there are at least 4 ways to solve this
> > issue:
> > 1. Stop distribute the binary of incubator-dubbo-admin
> > 2. Make the feature optional, as explained here[3]
> > 3. Stop depending on hiberante-core
> > 4. Choose other Apache compatible equivalent
> >
> > I recommend to go with number 3 in my last thread.
> >
> >
> > [1] https://opensource.org/licenses/LGPL-2.1
> > [2] https://www.apache.org/legal/resolved.html#prohibited
> > [3] https://www.apache.org/legal/resolved.html#optional
> >
> > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org> wrote:
> > >
> > > Hi,
> > >
> > > ccing dev@dubbo
> > >
> > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com>
> > wrote:
> > > >
> > > > Hi，
> > > >
> > > > I just checked the binary release kit, it has the third party
> > > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> > > > X[1], it cannot be included in Apache Product.
> > > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> > > > fix this issue, I just fill an issue here[2].
> > >
> > > I did some dig for this issue and confirm that this is introduced by
> > > this pull request[1].
> > > The purpose of this pull request is to introduce the pagination to
> > > service query.
> > > In this pull request a dependency to spring-boot-starter-data-jpa was
> > added,
> > > which introduce the LGPL licensed dependency hibernate-core.
> > > The detailed dependency tree is shown below:
> > >
> > > [INFO] +-
> > org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> > > [INFO] | +-
> > org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> > > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> > > [INFO] | +-
> > org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> > > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> > > [INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> > > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> > > [INFO] | | +-
> > >
> > org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> > > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> > > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> > > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> > > [INFO] | | \-
> > >
> > org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> > > [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
> > > [INFO] | +-
> > org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> > > [INFO] | | +-
> > > org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> > > [INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> > > [INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> > > [INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
> > >
> > > Actually the hiberate-core dependency is never used when implementing
> > > the feature,
> > > I think it can be excluded quietly. This is the safest way to solve this
> > issue.
> > > To dig further, the only dependency that required to be added is just
> > > spring-data-commons,
> > > which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
> > > and start correctly with spring-data-commons,
> > > it might need to check more at runtime to ensure everything is working)
> > >
> > > We need to be very careful when new dependency is added, and ensure
> > > all the license (including transitive dependencies) are compatible
> > > with Apache.
> > >
> > > The community has identified several similar issues [3][4] for
> > > incubator-dubbo project, and similar actions should be done to
> > > incubator-dubbo-admin as well.
> > >
> > > To identify the issue automatically, I run the following command:
> > >
> > > mvn license:add-third-party -Dlicense.useMissingFile
> > >
> > > and grep the output:
> > >
> > > cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> > > grep "General Public License"
> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
> > > - http://logback.qos.ch/logback-classic)
> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> > > http://logback.qos.ch/logback-core)
> > > (GNU Lesser General Public License) Core Hibernate O/RM
> > > functionality (org.hibernate:hibernate-core:5.2.17.Final -
> > > http://hibernate.org)
> > > (GNU Lesser General Public License) Hibernate Commons Annotations
> > > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> > > http://hibernate.org)
> > >
> > > The last 2 are both introduced by hibernate-core. A script to check
> > > license issue for dependencies was on the way[5].
> > >
> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> > > [2]
> > https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> > > [3]
> > https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> > > [4]
> > https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> > > [5] https://github.com/apache/incubator-dubbo/issues/3840
> > >
> > > >
> > > > [1]https://www.apache.org/legal/resolved.html#category-x
> > > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> > > >
> > > > Willem Jiang
> > > >
> > > > Twitter: willemjiang
> > > > Weibo: 姜宁willem
> > > >
> > > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com>
> > wrote:
> > > > >
> > > > > Hello Incubator Community,
> > > > >
> > > > > The Apache Dubbo community has voted on and approved a proposal to
> > release
> > > > > Apache Dubbo Admin (Incubating) version 0.2.0.
> > > > >
> > > > > We now kindly request the Incubator PMC members review and vote on
> > this
> > > > > incubator release.
> > > > >
> > > > > Apache Dubbo™ (incubating) is a high-performance, java based, open
> > source
> > > > > RPC framework. Dubbo offers three key functionalities, which include
> > > > > interface based remote call, fault tolerance & load balancing, and
> > > > > automatic service registration & discovery.
> > > > >
> > > > >
> > > > > Dubbo community vote and result thread:
> > > > >
> > https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> > > > >
> > > > > The release candidates (RC3):
> > > > > *
> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> > > > > <
> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > >/*
> > > > >
> > > > >
> > > > > Git tag for the release (RC3):
> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > > >
> > > > > Hash for the release tag:
> > > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> > > > >
> > > > > Release Notes:
> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > > >
> > > > >
> > > > > The artifacts have been signed with Key :
> > > > > DA2108479B0C1E71, which can be
> > > > > found in the keys file:
> > > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
> > > > >
> > > > > The vote will be open for at least 72 hours or until necessary
> > number of
> > > > > votes are reached.
> > > > >
> > > > > Please vote accordingly:
> > > > >
> > > > > [ ] +1 approve
> > > > > [ ] +0 no opinion
> > > > > [ ] -1 disapprove with the reason
> > > > >
> > > > > Thanks,
> > > > > The Apache Dubbo (Incubating) Team
> > > >
> > > > ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > > > For additional commands, e-mail: general-help@incubator.apache.org
> > > >
> > >
> > >
> > > --
> > > Best Regards！
> > > Huxing
> >
> >
> >
> > --
> > Best Regards！
> > Huxing
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > For additional commands, e-mail: general-help@incubator.apache.org
> >
> >
--
Best Regards！
Huxing
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Huxing Zhang <hu...@apache.org>.
Hi,
On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu <wu...@gmail.com> wrote:
>
> Hi.
>
> > 1. Stop distribute the binary of incubator-dubbo-admin
>
> I think "stop distribute the binary" would NOT change the fact the source
> release could lead users to use `hiberante-core`. I doubt this is an option.
That option is based on my understanding that linking to
"hibernate-core" does not create a derivative work of
"hibernate-core".
Yes, when compiling the source code and run the incubator-dubbo-admin
code, the hibernate-core binary will be included, this
will create a derivative work of "hibernate-core". As long as user do
not distribute it, I think it is fine to use it.
This is the same case as using "spring-boot-starter-data-jpa".
However, it becomes a problem when user want to distributed the
incubator-dubbo-admin binary, it must not be licensed as Apache
license, but should only be GPL/LGPL licensed.
This creates a risk that some user won't use this software because of
the potential license issue, which is not what we want.
So as long as an Apache project does not distribute the binary, IMO it is fine.
That is my understanding of why this is an option. It is not a good
option, but I think it is an option.
>
> Also based on the license issue, you should consider canceling this vote,
> and move the further discussion to dev ml.
I agree that cancel this vote is the safest way for now, before
everything is cleared.
>
>
> Sheng Wu 吴晟
>
> Apache SkyWalking, ShardingSphere, Zipkin
> Twitter, wusheng1108
>
>
> Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
>
> > Hi,
> >
> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> > licensed library "hibernate-core", and can still be Apache 2.0
> > licensed.
> > I am reading [1]. In section 5 it says:
> >
> > A program that contains no derivative of any portion of the Library,
> > but is designed to work with the Library by being compiled or linked
> > with it, is called a "work that uses the Library". Such a work, in
> > isolation, is not a derivative work of the Library, and therefore
> > falls outside the scope of this License.
> >
> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> > "work that uses the Library".
> >
> > The source code of incubator-dubbo-admin should also falls into this
> > case, because it does not contain any portion of the hibernate-core.
> > Based on it and explanation here[2], I think the source code can be
> > released anyway. Is my understanding correct?
> >
> > Next, the LGPL license says:
> >
> > However, linking a "work that uses the Library" with the Library
> > creates an executable that is a derivative of the Library (because it
> > contains portions of the Library), rather than a "work that uses the
> > library". The executable is therefore covered by this License.
> >
> > The binary distribution of incuabator-dubbo-admin falls into this case
> > because it creates an executable that contains binary of
> > hibernate-core. Therefore it is a "work based on the library". As a
> > derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> > is not allowed as an Apache product, and eventually causes the
> > incompatibility.
> >
> > If my understanding is correct, there are at least 4 ways to solve this
> > issue:
> > 1. Stop distribute the binary of incubator-dubbo-admin
> > 2. Make the feature optional, as explained here[3]
> > 3. Stop depending on hiberante-core
> > 4. Choose other Apache compatible equivalent
> >
> > I recommend to go with number 3 in my last thread.
> >
> >
> > [1] https://opensource.org/licenses/LGPL-2.1
> > [2] https://www.apache.org/legal/resolved.html#prohibited
> > [3] https://www.apache.org/legal/resolved.html#optional
> >
> > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org> wrote:
> > >
> > > Hi,
> > >
> > > ccing dev@dubbo
> > >
> > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com>
> > wrote:
> > > >
> > > > Hi，
> > > >
> > > > I just checked the binary release kit, it has the third party
> > > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> > > > X[1], it cannot be included in Apache Product.
> > > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> > > > fix this issue, I just fill an issue here[2].
> > >
> > > I did some dig for this issue and confirm that this is introduced by
> > > this pull request[1].
> > > The purpose of this pull request is to introduce the pagination to
> > > service query.
> > > In this pull request a dependency to spring-boot-starter-data-jpa was
> > added,
> > > which introduce the LGPL licensed dependency hibernate-core.
> > > The detailed dependency tree is shown below:
> > >
> > > [INFO] +-
> > org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> > > [INFO] | +-
> > org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> > > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> > > [INFO] | +-
> > org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> > > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> > > [INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> > > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> > > [INFO] | | +-
> > >
> > org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> > > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> > > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> > > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> > > [INFO] | | \-
> > >
> > org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> > > [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
> > > [INFO] | +-
> > org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> > > [INFO] | | +-
> > > org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> > > [INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> > > [INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> > > [INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
> > >
> > > Actually the hiberate-core dependency is never used when implementing
> > > the feature,
> > > I think it can be excluded quietly. This is the safest way to solve this
> > issue.
> > > To dig further, the only dependency that required to be added is just
> > > spring-data-commons,
> > > which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
> > > and start correctly with spring-data-commons,
> > > it might need to check more at runtime to ensure everything is working)
> > >
> > > We need to be very careful when new dependency is added, and ensure
> > > all the license (including transitive dependencies) are compatible
> > > with Apache.
> > >
> > > The community has identified several similar issues [3][4] for
> > > incubator-dubbo project, and similar actions should be done to
> > > incubator-dubbo-admin as well.
> > >
> > > To identify the issue automatically, I run the following command:
> > >
> > > mvn license:add-third-party -Dlicense.useMissingFile
> > >
> > > and grep the output:
> > >
> > > cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> > > grep "General Public License"
> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
> > > - http://logback.qos.ch/logback-classic)
> > > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> > > http://logback.qos.ch/logback-core)
> > > (GNU Lesser General Public License) Core Hibernate O/RM
> > > functionality (org.hibernate:hibernate-core:5.2.17.Final -
> > > http://hibernate.org)
> > > (GNU Lesser General Public License) Hibernate Commons Annotations
> > > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> > > http://hibernate.org)
> > >
> > > The last 2 are both introduced by hibernate-core. A script to check
> > > license issue for dependencies was on the way[5].
> > >
> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> > > [2]
> > https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> > > [3]
> > https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> > > [4]
> > https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> > > [5] https://github.com/apache/incubator-dubbo/issues/3840
> > >
> > > >
> > > > [1]https://www.apache.org/legal/resolved.html#category-x
> > > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> > > >
> > > > Willem Jiang
> > > >
> > > > Twitter: willemjiang
> > > > Weibo: 姜宁willem
> > > >
> > > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com>
> > wrote:
> > > > >
> > > > > Hello Incubator Community,
> > > > >
> > > > > The Apache Dubbo community has voted on and approved a proposal to
> > release
> > > > > Apache Dubbo Admin (Incubating) version 0.2.0.
> > > > >
> > > > > We now kindly request the Incubator PMC members review and vote on
> > this
> > > > > incubator release.
> > > > >
> > > > > Apache Dubbo™ (incubating) is a high-performance, java based, open
> > source
> > > > > RPC framework. Dubbo offers three key functionalities, which include
> > > > > interface based remote call, fault tolerance & load balancing, and
> > > > > automatic service registration & discovery.
> > > > >
> > > > >
> > > > > Dubbo community vote and result thread:
> > > > >
> > https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> > > > >
> > > > > The release candidates (RC3):
> > > > > *
> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> > > > > <
> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > >/*
> > > > >
> > > > >
> > > > > Git tag for the release (RC3):
> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > > >
> > > > > Hash for the release tag:
> > > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> > > > >
> > > > > Release Notes:
> > > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > > >
> > > > >
> > > > > The artifacts have been signed with Key :
> > > > > DA2108479B0C1E71, which can be
> > > > > found in the keys file:
> > > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
> > > > >
> > > > > The vote will be open for at least 72 hours or until necessary
> > number of
> > > > > votes are reached.
> > > > >
> > > > > Please vote accordingly:
> > > > >
> > > > > [ ] +1 approve
> > > > > [ ] +0 no opinion
> > > > > [ ] -1 disapprove with the reason
> > > > >
> > > > > Thanks,
> > > > > The Apache Dubbo (Incubating) Team
> > > >
> > > > ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > > > For additional commands, e-mail: general-help@incubator.apache.org
> > > >
> > >
> > >
> > > --
> > > Best Regards！
> > > Huxing
> >
> >
> >
> > --
> > Best Regards！
> > Huxing
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > For additional commands, e-mail: general-help@incubator.apache.org
> >
> >
--
Best Regards！
Huxing
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Sheng Wu <wu...@gmail.com>.
Hi.
> 1. Stop distribute the binary of incubator-dubbo-admin
I think "stop distribute the binary" would NOT change the fact the source
release could lead users to use `hiberante-core`. I doubt this is an option.
Also based on the license issue, you should consider canceling this vote,
and move the further discussion to dev ml.
Sheng Wu 吴晟
Apache SkyWalking, ShardingSphere, Zipkin
Twitter, wusheng1108
Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
> Hi,
>
> I am thinking why spring-boot-starter-data-jpa depends on LGPL
> licensed library "hibernate-core", and can still be Apache 2.0
> licensed.
> I am reading [1]. In section 5 it says:
>
> A program that contains no derivative of any portion of the Library,
> but is designed to work with the Library by being compiled or linked
> with it, is called a "work that uses the Library". Such a work, in
> isolation, is not a derivative work of the Library, and therefore
> falls outside the scope of this License.
>
> I think spring-boot-starter-data-jpa falls in to this case. It is a
> "work that uses the Library".
>
> The source code of incubator-dubbo-admin should also falls into this
> case, because it does not contain any portion of the hibernate-core.
> Based on it and explanation here[2], I think the source code can be
> released anyway. Is my understanding correct?
>
> Next, the LGPL license says:
>
> However, linking a "work that uses the Library" with the Library
> creates an executable that is a derivative of the Library (because it
> contains portions of the Library), rather than a "work that uses the
> library". The executable is therefore covered by this License.
>
> The binary distribution of incuabator-dubbo-admin falls into this case
> because it creates an executable that contains binary of
> hibernate-core. Therefore it is a "work based on the library". As a
> derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> is not allowed as an Apache product, and eventually causes the
> incompatibility.
>
> If my understanding is correct, there are at least 4 ways to solve this
> issue:
> 1. Stop distribute the binary of incubator-dubbo-admin
> 2. Make the feature optional, as explained here[3]
> 3. Stop depending on hiberante-core
> 4. Choose other Apache compatible equivalent
>
> I recommend to go with number 3 in my last thread.
>
>
> [1] https://opensource.org/licenses/LGPL-2.1
> [2] https://www.apache.org/legal/resolved.html#prohibited
> [3] https://www.apache.org/legal/resolved.html#optional
>
> On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org> wrote:
> >
> > Hi,
> >
> > ccing dev@dubbo
> >
> > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com>
> wrote:
> > >
> > > Hi，
> > >
> > > I just checked the binary release kit, it has the third party
> > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> > > X[1], it cannot be included in Apache Product.
> > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> > > fix this issue, I just fill an issue here[2].
> >
> > I did some dig for this issue and confirm that this is introduced by
> > this pull request[1].
> > The purpose of this pull request is to introduce the pagination to
> > service query.
> > In this pull request a dependency to spring-boot-starter-data-jpa was
> added,
> > which introduce the LGPL licensed dependency hibernate-core.
> > The detailed dependency tree is shown below:
> >
> > [INFO] +-
> org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> > [INFO] | +-
> org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> > [INFO] | +-
> org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> > [INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> > [INFO] | | +-
> >
> org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> > [INFO] | | \-
> >
> org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> > [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
> > [INFO] | +-
> org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> > [INFO] | | +-
> > org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> > [INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> > [INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> > [INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
> >
> > Actually the hiberate-core dependency is never used when implementing
> > the feature,
> > I think it can be excluded quietly. This is the safest way to solve this
> issue.
> > To dig further, the only dependency that required to be added is just
> > spring-data-commons,
> > which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
> > and start correctly with spring-data-commons,
> > it might need to check more at runtime to ensure everything is working)
> >
> > We need to be very careful when new dependency is added, and ensure
> > all the license (including transitive dependencies) are compatible
> > with Apache.
> >
> > The community has identified several similar issues [3][4] for
> > incubator-dubbo project, and similar actions should be done to
> > incubator-dubbo-admin as well.
> >
> > To identify the issue automatically, I run the following command:
> >
> > mvn license:add-third-party -Dlicense.useMissingFile
> >
> > and grep the output:
> >
> > cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> > grep "General Public License"
> > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
> > - http://logback.qos.ch/logback-classic)
> > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> > http://logback.qos.ch/logback-core)
> > (GNU Lesser General Public License) Core Hibernate O/RM
> > functionality (org.hibernate:hibernate-core:5.2.17.Final -
> > http://hibernate.org)
> > (GNU Lesser General Public License) Hibernate Commons Annotations
> > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> > http://hibernate.org)
> >
> > The last 2 are both introduced by hibernate-core. A script to check
> > license issue for dependencies was on the way[5].
> >
> > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> > [2]
> https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> > [3]
> https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> > [4]
> https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> > [5] https://github.com/apache/incubator-dubbo/issues/3840
> >
> > >
> > > [1]https://www.apache.org/legal/resolved.html#category-x
> > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> > >
> > > Willem Jiang
> > >
> > > Twitter: willemjiang
> > > Weibo: 姜宁willem
> > >
> > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com>
> wrote:
> > > >
> > > > Hello Incubator Community,
> > > >
> > > > The Apache Dubbo community has voted on and approved a proposal to
> release
> > > > Apache Dubbo Admin (Incubating) version 0.2.0.
> > > >
> > > > We now kindly request the Incubator PMC members review and vote on
> this
> > > > incubator release.
> > > >
> > > > Apache Dubbo™ (incubating) is a high-performance, java based, open
> source
> > > > RPC framework. Dubbo offers three key functionalities, which include
> > > > interface based remote call, fault tolerance & load balancing, and
> > > > automatic service registration & discovery.
> > > >
> > > >
> > > > Dubbo community vote and result thread:
> > > >
> https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> > > >
> > > > The release candidates (RC3):
> > > > *
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> > > > <
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> >/*
> > > >
> > > >
> > > > Git tag for the release (RC3):
> > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > >
> > > > Hash for the release tag:
> > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> > > >
> > > > Release Notes:
> > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > >
> > > >
> > > > The artifacts have been signed with Key :
> > > > DA2108479B0C1E71, which can be
> > > > found in the keys file:
> > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
> > > >
> > > > The vote will be open for at least 72 hours or until necessary
> number of
> > > > votes are reached.
> > > >
> > > > Please vote accordingly:
> > > >
> > > > [ ] +1 approve
> > > > [ ] +0 no opinion
> > > > [ ] -1 disapprove with the reason
> > > >
> > > > Thanks,
> > > > The Apache Dubbo (Incubating) Team
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > > For additional commands, e-mail: general-help@incubator.apache.org
> > >
> >
> >
> > --
> > Best Regards！
> > Huxing
>
>
>
> --
> Best Regards！
> Huxing
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Sheng Wu <wu...@gmail.com>.
Hi.
> 1. Stop distribute the binary of incubator-dubbo-admin
I think "stop distribute the binary" would NOT change the fact the source
release could lead users to use `hiberante-core`. I doubt this is an option.
Also based on the license issue, you should consider canceling this vote,
and move the further discussion to dev ml.
Sheng Wu 吴晟
Apache SkyWalking, ShardingSphere, Zipkin
Twitter, wusheng1108
Huxing Zhang <hu...@apache.org> 于2019年4月21日周日 下午11:02写道：
> Hi,
>
> I am thinking why spring-boot-starter-data-jpa depends on LGPL
> licensed library "hibernate-core", and can still be Apache 2.0
> licensed.
> I am reading [1]. In section 5 it says:
>
> A program that contains no derivative of any portion of the Library,
> but is designed to work with the Library by being compiled or linked
> with it, is called a "work that uses the Library". Such a work, in
> isolation, is not a derivative work of the Library, and therefore
> falls outside the scope of this License.
>
> I think spring-boot-starter-data-jpa falls in to this case. It is a
> "work that uses the Library".
>
> The source code of incubator-dubbo-admin should also falls into this
> case, because it does not contain any portion of the hibernate-core.
> Based on it and explanation here[2], I think the source code can be
> released anyway. Is my understanding correct?
>
> Next, the LGPL license says:
>
> However, linking a "work that uses the Library" with the Library
> creates an executable that is a derivative of the Library (because it
> contains portions of the Library), rather than a "work that uses the
> library". The executable is therefore covered by this License.
>
> The binary distribution of incuabator-dubbo-admin falls into this case
> because it creates an executable that contains binary of
> hibernate-core. Therefore it is a "work based on the library". As a
> derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> is not allowed as an Apache product, and eventually causes the
> incompatibility.
>
> If my understanding is correct, there are at least 4 ways to solve this
> issue:
> 1. Stop distribute the binary of incubator-dubbo-admin
> 2. Make the feature optional, as explained here[3]
> 3. Stop depending on hiberante-core
> 4. Choose other Apache compatible equivalent
>
> I recommend to go with number 3 in my last thread.
>
>
> [1] https://opensource.org/licenses/LGPL-2.1
> [2] https://www.apache.org/legal/resolved.html#prohibited
> [3] https://www.apache.org/legal/resolved.html#optional
>
> On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org> wrote:
> >
> > Hi,
> >
> > ccing dev@dubbo
> >
> > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com>
> wrote:
> > >
> > > Hi，
> > >
> > > I just checked the binary release kit, it has the third party
> > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> > > X[1], it cannot be included in Apache Product.
> > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> > > fix this issue, I just fill an issue here[2].
> >
> > I did some dig for this issue and confirm that this is introduced by
> > this pull request[1].
> > The purpose of this pull request is to introduce the pagination to
> > service query.
> > In this pull request a dependency to spring-boot-starter-data-jpa was
> added,
> > which introduce the LGPL licensed dependency hibernate-core.
> > The detailed dependency tree is shown below:
> >
> > [INFO] +-
> org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> > [INFO] | +-
> org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> > [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> > [INFO] | +-
> org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> > [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> > [INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> > [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> > [INFO] | | +-
> >
> org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> > [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> > [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> > [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> > [INFO] | | \-
> >
> org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> > [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
> > [INFO] | +-
> org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> > [INFO] | | +-
> > org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> > [INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> > [INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> > [INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
> >
> > Actually the hiberate-core dependency is never used when implementing
> > the feature,
> > I think it can be excluded quietly. This is the safest way to solve this
> issue.
> > To dig further, the only dependency that required to be added is just
> > spring-data-commons,
> > which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
> > and start correctly with spring-data-commons,
> > it might need to check more at runtime to ensure everything is working)
> >
> > We need to be very careful when new dependency is added, and ensure
> > all the license (including transitive dependencies) are compatible
> > with Apache.
> >
> > The community has identified several similar issues [3][4] for
> > incubator-dubbo project, and similar actions should be done to
> > incubator-dubbo-admin as well.
> >
> > To identify the issue automatically, I run the following command:
> >
> > mvn license:add-third-party -Dlicense.useMissingFile
> >
> > and grep the output:
> >
> > cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> > grep "General Public License"
> > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
> > - http://logback.qos.ch/logback-classic)
> > (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> > http://logback.qos.ch/logback-core)
> > (GNU Lesser General Public License) Core Hibernate O/RM
> > functionality (org.hibernate:hibernate-core:5.2.17.Final -
> > http://hibernate.org)
> > (GNU Lesser General Public License) Hibernate Commons Annotations
> > (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> > http://hibernate.org)
> >
> > The last 2 are both introduced by hibernate-core. A script to check
> > license issue for dependencies was on the way[5].
> >
> > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> > [2]
> https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> > [3]
> https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> > [4]
> https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> > [5] https://github.com/apache/incubator-dubbo/issues/3840
> >
> > >
> > > [1]https://www.apache.org/legal/resolved.html#category-x
> > > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> > >
> > > Willem Jiang
> > >
> > > Twitter: willemjiang
> > > Weibo: 姜宁willem
> > >
> > > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com>
> wrote:
> > > >
> > > > Hello Incubator Community,
> > > >
> > > > The Apache Dubbo community has voted on and approved a proposal to
> release
> > > > Apache Dubbo Admin (Incubating) version 0.2.0.
> > > >
> > > > We now kindly request the Incubator PMC members review and vote on
> this
> > > > incubator release.
> > > >
> > > > Apache Dubbo™ (incubating) is a high-performance, java based, open
> source
> > > > RPC framework. Dubbo offers three key functionalities, which include
> > > > interface based remote call, fault tolerance & load balancing, and
> > > > automatic service registration & discovery.
> > > >
> > > >
> > > > Dubbo community vote and result thread:
> > > >
> https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> > > >
> > > > The release candidates (RC3):
> > > > *
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> > > > <
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> >/*
> > > >
> > > >
> > > > Git tag for the release (RC3):
> > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > >
> > > > Hash for the release tag:
> > > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> > > >
> > > > Release Notes:
> > > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > >
> > > >
> > > > The artifacts have been signed with Key :
> > > > DA2108479B0C1E71, which can be
> > > > found in the keys file:
> > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
> > > >
> > > > The vote will be open for at least 72 hours or until necessary
> number of
> > > > votes are reached.
> > > >
> > > > Please vote accordingly:
> > > >
> > > > [ ] +1 approve
> > > > [ ] +0 no opinion
> > > > [ ] -1 disapprove with the reason
> > > >
> > > > Thanks,
> > > > The Apache Dubbo (Incubating) Team
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > > For additional commands, e-mail: general-help@incubator.apache.org
> > >
> >
> >
> > --
> > Best Regards！
> > Huxing
>
>
>
> --
> Best Regards！
> Huxing
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Huxing Zhang <hu...@apache.org>.
Hi,
I am thinking why spring-boot-starter-data-jpa depends on LGPL
licensed library "hibernate-core", and can still be Apache 2.0
licensed.
I am reading [1]. In section 5 it says:
A program that contains no derivative of any portion of the Library,
but is designed to work with the Library by being compiled or linked
with it, is called a "work that uses the Library". Such a work, in
isolation, is not a derivative work of the Library, and therefore
falls outside the scope of this License.
I think spring-boot-starter-data-jpa falls in to this case. It is a
"work that uses the Library".
The source code of incubator-dubbo-admin should also falls into this
case, because it does not contain any portion of the hibernate-core.
Based on it and explanation here[2], I think the source code can be
released anyway. Is my understanding correct?
Next, the LGPL license says:
However, linking a "work that uses the Library" with the Library
creates an executable that is a derivative of the Library (because it
contains portions of the Library), rather than a "work that uses the
library". The executable is therefore covered by this License.
The binary distribution of incuabator-dubbo-admin falls into this case
because it creates an executable that contains binary of
hibernate-core. Therefore it is a "work based on the library". As a
derivative of hibernate-core, it must be licensed with LGPL/GPL, which
is not allowed as an Apache product, and eventually causes the
incompatibility.
If my understanding is correct, there are at least 4 ways to solve this issue:
1. Stop distribute the binary of incubator-dubbo-admin
2. Make the feature optional, as explained here[3]
3. Stop depending on hiberante-core
4. Choose other Apache compatible equivalent
I recommend to go with number 3 in my last thread.
[1] https://opensource.org/licenses/LGPL-2.1
[2] https://www.apache.org/legal/resolved.html#prohibited
[3] https://www.apache.org/legal/resolved.html#optional
On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org> wrote:
>
> Hi,
>
> ccing dev@dubbo
>
> On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com> wrote:
> >
> > Hi，
> >
> > I just checked the binary release kit, it has the third party
> > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> > X[1], it cannot be included in Apache Product.
> > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> > fix this issue, I just fill an issue here[2].
>
> I did some dig for this issue and confirm that this is introduced by
> this pull request[1].
> The purpose of this pull request is to introduce the pagination to
> service query.
> In this pull request a dependency to spring-boot-starter-data-jpa was added,
> which introduce the LGPL licensed dependency hibernate-core.
> The detailed dependency tree is shown below:
>
> [INFO] +- org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> [INFO] | +- org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> [INFO] | +- org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> [INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> [INFO] | | +-
> org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> [INFO] | | \-
> org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
> [INFO] | +- org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> [INFO] | | +-
> org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> [INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> [INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> [INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
>
> Actually the hiberate-core dependency is never used when implementing
> the feature,
> I think it can be excluded quietly. This is the safest way to solve this issue.
> To dig further, the only dependency that required to be added is just
> spring-data-commons,
> which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
> and start correctly with spring-data-commons,
> it might need to check more at runtime to ensure everything is working)
>
> We need to be very careful when new dependency is added, and ensure
> all the license (including transitive dependencies) are compatible
> with Apache.
>
> The community has identified several similar issues [3][4] for
> incubator-dubbo project, and similar actions should be done to
> incubator-dubbo-admin as well.
>
> To identify the issue automatically, I run the following command:
>
> mvn license:add-third-party -Dlicense.useMissingFile
>
> and grep the output:
>
> cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> grep "General Public License"
> (Eclipse Public License - v 1.0) (GNU Lesser General Public
> License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
> - http://logback.qos.ch/logback-classic)
> (Eclipse Public License - v 1.0) (GNU Lesser General Public
> License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> http://logback.qos.ch/logback-core)
> (GNU Lesser General Public License) Core Hibernate O/RM
> functionality (org.hibernate:hibernate-core:5.2.17.Final -
> http://hibernate.org)
> (GNU Lesser General Public License) Hibernate Commons Annotations
> (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> http://hibernate.org)
>
> The last 2 are both introduced by hibernate-core. A script to check
> license issue for dependencies was on the way[5].
>
> [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> [2] https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> [3] https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> [4] https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> [5] https://github.com/apache/incubator-dubbo/issues/3840
>
> >
> > [1]https://www.apache.org/legal/resolved.html#category-x
> > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> >
> > Willem Jiang
> >
> > Twitter: willemjiang
> > Weibo: 姜宁willem
> >
> > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com> wrote:
> > >
> > > Hello Incubator Community,
> > >
> > > The Apache Dubbo community has voted on and approved a proposal to release
> > > Apache Dubbo Admin (Incubating) version 0.2.0.
> > >
> > > We now kindly request the Incubator PMC members review and vote on this
> > > incubator release.
> > >
> > > Apache Dubbo™ (incubating) is a high-performance, java based, open source
> > > RPC framework. Dubbo offers three key functionalities, which include
> > > interface based remote call, fault tolerance & load balancing, and
> > > automatic service registration & discovery.
> > >
> > >
> > > Dubbo community vote and result thread:
> > > https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> > >
> > > The release candidates (RC3):
> > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/>/*
> > >
> > >
> > > Git tag for the release (RC3):
> > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > >
> > > Hash for the release tag:
> > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> > >
> > > Release Notes:
> > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > >
> > >
> > > The artifacts have been signed with Key :
> > > DA2108479B0C1E71, which can be
> > > found in the keys file:
> > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
> > >
> > > The vote will be open for at least 72 hours or until necessary number of
> > > votes are reached.
> > >
> > > Please vote accordingly:
> > >
> > > [ ] +1 approve
> > > [ ] +0 no opinion
> > > [ ] -1 disapprove with the reason
> > >
> > > Thanks,
> > > The Apache Dubbo (Incubating) Team
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > For additional commands, e-mail: general-help@incubator.apache.org
> >
>
>
> --
> Best Regards！
> Huxing
--
Best Regards！
Huxing
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]
Posted by Huxing Zhang <hu...@apache.org>.
Hi,
I am thinking why spring-boot-starter-data-jpa depends on LGPL
licensed library "hibernate-core", and can still be Apache 2.0
licensed.
I am reading [1]. In section 5 it says:
A program that contains no derivative of any portion of the Library,
but is designed to work with the Library by being compiled or linked
with it, is called a "work that uses the Library". Such a work, in
isolation, is not a derivative work of the Library, and therefore
falls outside the scope of this License.
I think spring-boot-starter-data-jpa falls in to this case. It is a
"work that uses the Library".
The source code of incubator-dubbo-admin should also falls into this
case, because it does not contain any portion of the hibernate-core.
Based on it and explanation here[2], I think the source code can be
released anyway. Is my understanding correct?
Next, the LGPL license says:
However, linking a "work that uses the Library" with the Library
creates an executable that is a derivative of the Library (because it
contains portions of the Library), rather than a "work that uses the
library". The executable is therefore covered by this License.
The binary distribution of incuabator-dubbo-admin falls into this case
because it creates an executable that contains binary of
hibernate-core. Therefore it is a "work based on the library". As a
derivative of hibernate-core, it must be licensed with LGPL/GPL, which
is not allowed as an Apache product, and eventually causes the
incompatibility.
If my understanding is correct, there are at least 4 ways to solve this issue:
1. Stop distribute the binary of incubator-dubbo-admin
2. Make the feature optional, as explained here[3]
3. Stop depending on hiberante-core
4. Choose other Apache compatible equivalent
I recommend to go with number 3 in my last thread.
[1] https://opensource.org/licenses/LGPL-2.1
[2] https://www.apache.org/legal/resolved.html#prohibited
[3] https://www.apache.org/legal/resolved.html#optional
On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang <hu...@apache.org> wrote:
>
> Hi,
>
> ccing dev@dubbo
>
> On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang <wi...@gmail.com> wrote:
> >
> > Hi，
> >
> > I just checked the binary release kit, it has the third party
> > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> > X[1], it cannot be included in Apache Product.
> > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> > fix this issue, I just fill an issue here[2].
>
> I did some dig for this issue and confirm that this is introduced by
> this pull request[1].
> The purpose of this pull request is to introduce the pagination to
> service query.
> In this pull request a dependency to spring-boot-starter-data-jpa was added,
> which introduce the LGPL licensed dependency hibernate-core.
> The detailed dependency tree is shown below:
>
> [INFO] +- org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> [INFO] | +- org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> [INFO] | | \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> [INFO] | +- org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> [INFO] | | +- com.zaxxer:HikariCP:jar:2.7.9:compile
> [INFO] | | \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> [INFO] | +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> [INFO] | | +-
> org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> [INFO] | | +- antlr:antlr:jar:2.7.7:compile
> [INFO] | | +- org.jboss:jandex:jar:2.0.3.Final:compile
> [INFO] | | +- dom4j:dom4j:jar:1.6.1:compile
> [INFO] | | \-
> org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> [INFO] | +- javax.transaction:javax.transaction-api:jar:1.2:compile
> [INFO] | +- org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> [INFO] | | +-
> org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> [INFO] | | +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> [INFO] | | \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> [INFO] | \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
>
> Actually the hiberate-core dependency is never used when implementing
> the feature,
> I think it can be excluded quietly. This is the safest way to solve this issue.
> To dig further, the only dependency that required to be added is just
> spring-data-commons,
> which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
> and start correctly with spring-data-commons,
> it might need to check more at runtime to ensure everything is working)
>
> We need to be very careful when new dependency is added, and ensure
> all the license (including transitive dependencies) are compatible
> with Apache.
>
> The community has identified several similar issues [3][4] for
> incubator-dubbo project, and similar actions should be done to
> incubator-dubbo-admin as well.
>
> To identify the issue automatically, I run the following command:
>
> mvn license:add-third-party -Dlicense.useMissingFile
>
> and grep the output:
>
> cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
> grep "General Public License"
> (Eclipse Public License - v 1.0) (GNU Lesser General Public
> License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
> - http://logback.qos.ch/logback-classic)
> (Eclipse Public License - v 1.0) (GNU Lesser General Public
> License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> http://logback.qos.ch/logback-core)
> (GNU Lesser General Public License) Core Hibernate O/RM
> functionality (org.hibernate:hibernate-core:5.2.17.Final -
> http://hibernate.org)
> (GNU Lesser General Public License) Hibernate Commons Annotations
> (org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
> http://hibernate.org)
>
> The last 2 are both introduced by hibernate-core. A script to check
> license issue for dependencies was on the way[5].
>
> [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> [2] https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
> [3] https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
> [4] https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
> [5] https://github.com/apache/incubator-dubbo/issues/3840
>
> >
> > [1]https://www.apache.org/legal/resolved.html#category-x
> > [2]https://github.com/apache/incubator-dubbo-admin/issues/366
> >
> > Willem Jiang
> >
> > Twitter: willemjiang
> > Weibo: 姜宁willem
> >
> > On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang <z8...@gmail.com> wrote:
> > >
> > > Hello Incubator Community,
> > >
> > > The Apache Dubbo community has voted on and approved a proposal to release
> > > Apache Dubbo Admin (Incubating) version 0.2.0.
> > >
> > > We now kindly request the Incubator PMC members review and vote on this
> > > incubator release.
> > >
> > > Apache Dubbo™ (incubating) is a high-performance, java based, open source
> > > RPC framework. Dubbo offers three key functionalities, which include
> > > interface based remote call, fault tolerance & load balancing, and
> > > automatic service registration & discovery.
> > >
> > >
> > > Dubbo community vote and result thread:
> > > https://lists.apache.org/thread.html/fc71a5f8c93b8c3606338b97a08c044af64ca3165e226aed37295a45@%3Cdev.dubbo.apache.org%3E
> > >
> > > The release candidates (RC3):
> > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0
> > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/>/*
> > >
> > >
> > > Git tag for the release (RC3):
> > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > >
> > > Hash for the release tag:
> > > 37e23a7354e3da50914e075eb4676c7c2875ffa7
> > >
> > > Release Notes:
> > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > >
> > >
> > > The artifacts have been signed with Key :
> > > DA2108479B0C1E71, which can be
> > > found in the keys file:
> > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > > <https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS>*
> > >
> > > The vote will be open for at least 72 hours or until necessary number of
> > > votes are reached.
> > >
> > > Please vote accordingly:
> > >
> > > [ ] +1 approve
> > > [ ] +0 no opinion
> > > [ ] -1 disapprove with the reason
> > >
> > > Thanks,
> > > The Apache Dubbo (Incubating) Team
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > For additional commands, e-mail: general-help@incubator.apache.org
> >
>
>
> --
> Best Regards！
> Huxing
--
Best Regards！
Huxing