> > The hessian-lite module has already exist long before Dubbo joined ASF, I > am not sure if the original developers who did this still active in the > mailing list, so it’s hard to tell the whole story. But I think at least > something is sure about why we need to maintain a separate copy: > 1. The Caucho Hessian community[1], we’ve seen its activity in a very low > level for a really long time. To meet requirements we do have to maintain a > copy inside our community. > 2. Hessian works as a serialization protocol in Dubbo and has been widely > used by users. It’s the core part of an RPC framework, most users will stay > on Hessian and won’t change.
Justin, I totally agree with the reasons Jun gave above. We are not the original developers who made the decision to tailor Hessian library instead of contribute back, but after I take a brief at the release history of Hessian 4 [1], I guess I would make the similar decision. If it is legally fine (I think it is perfectly allowed), I suggest we have to live with the current situation. What we could change in the future is we should gracefully retire hessian-lite library and encourage Dubbo users to depend on the official Hessian 4 release. My conclusion is, this particular issue should not block the current release and the future potential releases. Thanks, -Ian. 1. https://mvnrepository.com/artifact/com.caucho/hessian On Mon, Mar 23, 2020 at 10:25 AM Jun Liu <[email protected]> wrote: > Hi > > > - NOTICE is missing > > > From what I can see now, we need an NOTICE file, inside which we should > mention the codes copy of of the Caucho Hessian Project. Do you think would > that change be enough for the next round of release? > > > It would be good to know more the history here and why this was done, > where there talks with the Caucho and they gave permission to do this? Or > are some of those developers involved here? > > The hessian-lite module has already exist long before Dubbo joined ASF, I > am not sure if the original developers who did this still active in the > mailing list, so it’s hard to tell the whole story. But I think at least > something is sure about why we need to maintain a separate copy: > 1. The Caucho Hessian community[1], we’ve seen its activity in a very low > level for a really long time. To meet requirements we do have to maintain a > copy inside our community. > 2. Hessian works as a serialization protocol in Dubbo and has been widely > used by users. It’s the core part of an RPC framework, most users will stay > on Hessian and won’t change. > > > are some of those developers involved here? > > I remember Xin Wang in our community has tried to contact the Caucho > Hessian community for some reasons months ago. Maybe he can give more > information on that. > > 1. http://hessian.caucho.com/ > > Jun > > > On Mar 20, 2020, at 11:49 AM, Justin Mclean <[email protected]> > wrote: > > > > Hi, > > > > -1 (binding) as the release is missing a NOTICE file and files missing > ASF headers > > > > I checked: > > - signature and hashes are fine > > - LICENSE exists > > - NOTICE is missing > > - no unexpected binary files > > - some files are ASF headers or unknown licensed 3rd party code e.g. [1] > (I just check a couple of file not all and found this) > > - can compile from source > > > > Is there any reason for the large number of files copyright "Copyright > (c) 2001-2008 Caucho Technology, Inc”? Was s software grant looked into? > > > > Thanks, > > Justin > > > > 1. > dubbo-hessian-lite-3.2.7-source-release/src/test/java/com/alibaba/com/caucho/hessian/io/writereplace/Hessian2WriteReplaceTest.java > >
