> What we could change in the future is
we should gracefully retire hessian-lite library and encourage Dubbo users
to depend on the official Hessian 4 release
I think dealing with this component is a hassle, I'll tell you what I know :
1. History of using Hessian in Dubbo
Hessian[1] is a serialization component specially developed by caucho
company and provided to resin.
The official has been disclosing the code on their company's SVN until
2017 Feb.
Probably from the beginning of Dubbo's creation of repo in GitHub in
2012, he copied a 2009 code named
Hessian-lite from the official of Hessian until now.
2. In a sense, after the 2017 Feb, the official Hessian is no longer a
standard open source project
Although the official Hessian has been releasing binary packages
recently, the source code has not been opened to the public since 2017, see
[2]
I set up a Hessian Group [3], which collects the clients of each language
of Hessian [4].
I also wrote an email to the caucho official, expecting them to open source
to GitHub and let everyone
participate in the development. The official answer is:
> Generally, Hessian needs to be super stable both in terms of API and
reliability for the sake of Resin. If there's a bug or feature request,
》》> feel free to file it at bugs.caucho.com. With that said, we
whole-heartedly support people to fork Hessian.
So my suggestions are as follows:
1. Hessian-lite needs to continue to be published in the Apache community
2. In view of the dependence of Dubbo project on hessian, many users use
Hessian in production, so we still have to try to contact more with the
official maintainers of Hessian
[1] http://hessian.caucho.com/
[2] https://github.com/ebourg/hessian
[3] https://github.com/hessian-group
[4] https://github.com/hessian-group/awesome-hessian
Ian Luo <[email protected]> 于2020年3月23日周一 上午11:55写道：
> >
> > The hessian-lite module has already exist long before Dubbo joined ASF,
> I
> > am not sure if the original developers who did this still active in the
> > mailing list, so it’s hard to tell the whole story. But I think at least
> > something is sure about why we need to maintain a separate copy:
> > 1. The Caucho Hessian community[1], we’ve seen its activity in a very low
> > level for a really long time. To meet requirements we do have to
> maintain a
> > copy inside our community.
> > 2. Hessian works as a serialization protocol in Dubbo and has been widely
> > used by users. It’s the core part of an RPC framework, most users will
> stay
> > on Hessian and won’t change.
>
>
> Justin, I totally agree with the reasons Jun gave above. We are not the
> original developers who made the decision to tailor Hessian library instead
> of contribute back, but after I take a brief at the release history of
> Hessian 4 [1], I guess I would make the similar decision.
>
> If it is legally fine (I think it is perfectly allowed), I suggest we have
> to live with the current situation. What we could change in the future is
> we should gracefully retire hessian-lite library and encourage Dubbo users
> to depend on the official Hessian 4 release.
>
> My conclusion is, this particular issue should not block the current
> release and the future potential releases.
>
> Thanks,
> -Ian.
>
>
> 1. https://mvnrepository.com/artifact/com.caucho/hessian
>
>
> On Mon, Mar 23, 2020 at 10:25 AM Jun Liu <[email protected]> wrote:
>
> > Hi
> >
> > > - NOTICE is missing
> >
> >
> > From what I can see now, we need an NOTICE file, inside which we should
> > mention the codes copy of of the Caucho Hessian Project. Do you think
> would
> > that change be enough for the next round of release?
> >
> > > It would be good to know more the history here and why this was done,
> > where there talks with the Caucho and they gave permission to do this? Or
> > are some of those developers involved here?
> >
> > The hessian-lite module has already exist long before Dubbo joined ASF,
> I
> > am not sure if the original developers who did this still active in the
> > mailing list, so it’s hard to tell the whole story. But I think at least
> > something is sure about why we need to maintain a separate copy:
> > 1. The Caucho Hessian community[1], we’ve seen its activity in a very low
> > level for a really long time. To meet requirements we do have to
> maintain a
> > copy inside our community.
> > 2. Hessian works as a serialization protocol in Dubbo and has been widely
> > used by users. It’s the core part of an RPC framework, most users will
> stay
> > on Hessian and won’t change.
> >
> > > are some of those developers involved here?
> >
> > I remember Xin Wang in our community has tried to contact the Caucho
> > Hessian community for some reasons months ago. Maybe he can give more
> > information on that.
> >
> > 1. http://hessian.caucho.com/
> >
> > Jun
> >
> > > On Mar 20, 2020, at 11:49 AM, Justin Mclean <[email protected]>
> > wrote:
> > >
> > > Hi,
> > >
> > > -1 (binding) as the release is missing a NOTICE file and files missing
> > ASF headers
> > >
> > > I checked:
> > > - signature and hashes are fine
> > > - LICENSE exists
> > > - NOTICE is missing
> > > - no unexpected binary files
> > > - some files are ASF headers or unknown licensed 3rd party code e.g.
> [1]
> > (I just check a couple of file not all and found this)
> > > - can compile from source
> > >
> > > Is there any reason for the large number of files copyright "Copyright
> > (c) 2001-2008 Caucho Technology, Inc”? Was s software grant looked into?
> > >
> > > Thanks,
> > > Justin
> > >
> > > 1.
> >
> dubbo-hessian-lite-3.2.7-source-release/src/test/java/com/alibaba/com/caucho/hessian/io/writereplace/Hessian2WriteReplaceTest.java
> >
> >
>
