Re: Inclusion of MySQL in roller-mysql-database plugin

[Peter Petersson]

David Jencks wrote:

On Feb 9, 2008, at 8:17 PM, Davanum Srinivas wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Kevan,

You are right. We have a new mechanism for triggering prohibited 
works. We need to get this to the attention of the
legal-discuss folks so they cover that angle in addition to just the 
"ship" angle that they have looked at so far.

Would specifying "<scope>provided</scope>" provided in the pom.xml 
for mysql be enough to geronimo from downloading
mysql when the plugin is installed? I am not that worried about 
pulling in that jar into our maven repo when we
create/build our distribution, as long as we don't ship it.

The scope won't have any effect.  We do have the option of specifying 
the mysql jar as a prerequisite which will prevent installation of the 
plugin unless the mysql jar is already present, presumably because 
someone who is aware of the licensing concerns has explicitly 
installed it.

I don't know if we've checked that this works properly with a jar 
rather than car (geronimo plugin) dependency but theoretically it 
would work.
It works I will prepare a patch and put it in Kevan's JIRA 
https://issues.apache.org/jira/browse/GERONIMO-3816 for you to review.

I don't think this a very elegant solution but it may be the best we 
can do in the near term.  I guess I'm dreaming of a "license filter" 
that you can set up and then plugins can download dependencies 
consistent with the licenses you have allowed.

To reiterate, we (asf) would never be shipping the mysql jar, but as 
currently set up, anyone installing the mysql roller plugin would be 
installing the mysql jar into their geronimo server.

thanks
david jencks



thanks,
dims

Kevan Miller wrote:
|
| On Feb 9, 2008, at 2:01 PM, Davanum Srinivas wrote:
|
|> -----BEGIN PGP SIGNED MESSAGE-----
|> Hash: SHA1
|>
|> Kevan,
|>
|> I followed the discussion. You said that "Yes. The automatic download
|> is the issue.". I don't think that is the case...I
|> believe the "clear guidance" kicks in when we *ship* a distribution
|> with some other license on that page. So i thought
|> we should get clarification on that point.
|>
|> related question, Are we at this point picking/shipping either the
|> plugin or the mysql jars into our distribution?
|
|
| Hi Dims,
| The roller plugins are not included in Geronimo 2.1. We will want to
| release the roller plugin at some point. So, will need to clear up 
this
| point before then.
|
| Thanks for the clarification. So, is this your question?
|
| ****************
|
| Is it ok to release an Apache product which will automatically, 
without
| user prompting, download a prohibited work?
|
| The product in question is the Apache Geronimo roller-mysql-database
| plugin which has a dependency on a "prohibited work" (i.e. a MySQL jar
| which is GPL with a FLOSS exception). The building of the plugin would
| download a MySQL jar into a users maven repository. The MySQL jar 
would
| *not* be included in the Geronimo roller-mysql-database plugin binary.
| However, the subsequent installation of this plugin would cause the
| Geronimo server to automatically download and install the MySQL jar,
| without notifying the user.
|
| *****************
|
| IMO, the answer is no, you can't. Not by default and not without
| notifying the user. Am happy to get clarification, if you (or anyone
| else) think otherwise or aren't sure...
|
| I think the basic options are:
|
| 1. Don't make roller-mysql-database part of the standard build (and
| don't release a roller-mysql-database binary). The user can use a
| non-standard build option to create the plugin, as long as he/she is
| notified.
| 2. Make the roller-mysql-database part of the standard build, but 
remove
| the MySQL dependency. This binary can be built and released by our
| project. However, the MySQL jar must be installed -- either 
manually by
| the user or by some tool which properly notifies the user.
|
| --kevan
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)

iD8DBQFHrnrmgNg6eWEDv1kRAvXxAKDLSlpx83vB5a2iEzskKIOt8iIP+wCfdqfn
oUFOkxrqEIx5Yl+U2ao04vE=
=oWpQ
-----END PGP SIGNATURE-----