The CouchDB now has at least snapshots of three non-ASL licensed, non-
ASF developed projects in the SVN. The following message suggests
that mochiweb in the CouchDB repo is forked and incompatible with the
main distribution:
http://mail-archives.apache.org/mod_mbox/couchdb-user/200907.mbox/%3c000001ca0dbe$72ac9220$5805b6...@[email protected]%3E
Having an external code base in the SVN is an invitation to fork which
results in the ASF effectively publishing software under a license
other the the ASL v2. That is a whole different animal than having a
dependency on an non-ASL'd licensed piece of software.
erlang-oauth was introduced into the SVN yesterday to support the
couch_http_oauth authentication handler. It is optional, the recently
added oauth authentication handler would fail to load without it but
that should be all. There was no mention that the patch included
third-party developed software, no dev list discussion or vote or
Incubator PMC clearance. I have requested that it be removed from the
SVN pending review.
ibrowse was added initially added to the SVN in January and is an HTTP
client used in replication. I was unable to find any mailing list
discussion or Incubator review on the addition of this code base.
mochiweb was added in March 2008 and provides the http server included
in CouchDB. The Incubator PMC was aware of this dependency based on
the April 2008 Incubator PMC board report. In addition to the http
server, CouchDB also uses mochiweb routines for parsing query strings,
url encoding, etc.
Most of the other dependencies are used in the Futon management client.
To minimize the amount of effort that a user has to perform to satisfy
their license issues, I think we should consider modularizing couchdb
so that a user who isn't interested in OAuth does not have to research
its license, etc.
I'd see the parts as:
core: The database and non-network core of CouchDB. I would hope this
code have no dependencies other than OTP.
http: The http server dependent on MochiWeb's http services and core.
replicator: dependent on core and ibrowse
futon: HTTP admin console
oauth: OAuth authenticator, dependent on erlang-oauth
Ideally, the interfaces with mochiweb, ibrowse and the like should be
designed so that other providers could be substituted without huge
effort.
I do think the Incubator PMC should review the situation, but it would
be good to understand the issues and discuss a path forward before
asking for review.
