log4cxx dependencies (touches 3rd party draft and apr-util)

[Curt Arnold <ca...@apache.org>]

I've read http://people.apache.org/~rubys/3party.html, but still am  
vague the appropriate handling on non-ASL licensed dependencies in  
log4cxx.

log4cxx has mandatory dependencies on apr and apr-util both licensed  
under the ASL 2.

log4cxx has an optional dependency on libesmtp which is licensed under  
the LGPL 2.1.  By default, the SMTPAppender will report that SMTP  
support was not enabled.  If "--with-SMTP=libesmtp" in configuration,  
SMTPAppender.cpp will include the libesmtp header file by reference  
and make calls to the libesmtp API.  The only source file that  
references libesmtp is http://svn.apache.org/repos/asf/logging/log4cxx/trunk/src/main/cpp/smtpappender.cpp 
.  libesmtp header files are not included by reference in any log4cxx  
header files.

log4cxx could add an alternative optional dependency on libvmime which  
is licensed under the GPL 2 since libesmtp does not appear to support  
Windows and libvmime does.  The implementation approach would be very  
similar to the use of libesmtp.  It is unlikely that libvmime would be  
added, but it would be good to know if it would be unacceptable.

log4cxx has an optional dependency on an ODBC implementation.  By  
default, the ODBCAppender implementation will not be compiled into the  
library.  If "--with-ODBC=iODBC", "--with-ODBC=unixODBC" or "-with- 
ODBC=Microsoft" is specified in configuration, http://svn.apache.org/repos/asf/logging/log4cxx/trunk/src/main/cpp/odbcappender.cpp 
  will be compiled and the library linked against the appropriate  
implementation.  http://svn.apache.org/repos/asf/logging/log4cxx/trunk/src/main/include/log4cxx/db/odbcappender.h 
  references sqlext.h which would be provided by the ODBC  
implementation.  iODBC is dual licensed under LGPL 2 and BSD, unixODBC  
is licensed under LGPL 2.1, and the Microsoft option would be part of  
the Platform SDK.  It does look possible that the reference to  
sqlext.h in obdbappender.h could be eliminated.

The log4cxx unit tests have a mandatory dependency on cppunit which is  
licensed under the LGPL 2.1.  If "make check" is run and cppunit is  
installed, a test program is compiled and linked against cppunit and  
log4cxx and run to test the log4cxx implementation.

Currently there are no mention of these optional dependencies in the  
NOTICE or LICENSE file.  The options are explained in the INSTALL  
file, but not any license ramifications of the non-default options.

There is no anticipation of any binary releases by the project.

I reviewed apr-util which would appear to have similar issues with the  
database adapters for mysql, sqlite, etc but did not see any mention  
in the LICENSE or NOTICE to use as a pattern.

It would be good if the 3rd Party Licensing Policy could describe the  
specific notices that need to be added to LICENSE or NOTICE that  
correspond to the different scenarios.  It would be good if it could  
address the distinction between product code and testing code.

I'd appreciate any comments or suggestions to prepare log4cxx for a  
long delayed release.


---------------------------------------------------------------------
DISCLAIMER: Discussions on this list are informational and educational
only.  Statements made on this list are not privileged, do not
constitute legal advice, and do not necessarily reflect the opinions
and policies of the ASF.  See <http://www.apache.org/licenses/> for
official ASF policies and documents.
---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org