[cross posting to both lists, as I am hoping this would give me more chance of someone knowing what to do here]
As discussed previously, I am keen to integrate log4j Chainsaw v2 and VFS, to take advantage of VFS's features of transparency of where the files are located. We're also using Java Web Start as a basis for deploy. To recap a previous email, Web start requires that all jars used by the app are signed, and all jars must be accessed during launched from a single code-base url for security reasons (as far as I can tell from reading).
Fine, I can do that for all the Apache ones, but what do I do for the external ones like JSch ?(listed here http://jakarta.apache.org/commons/sandbox/vfs/download.html).
Theoretically I could download those jars, sign 'em, and upload them to the apache servers where the other jars are... Except... I'm/We are not allowed to host external jars on the Apache servers from what I've heard/read before. (licensing issues). Is that right?
The ASF will not distribute GPLed or LGPLed code. This is a pretty important rule. In case of breach, the board is likely to fire first and talk later. Hosting BSD licensed code is OK.
Paul Smith
-- Ceki G�lc�
For log4j documentation consider "The complete log4j manual"
ISBN: 2970036908 http://www.qos.ch/shop/products/clm_t.jsp
--------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
