Re: Inclusion of MySQL in roller-mysql-database plugin
I applied this patch with some text changes and think the result is OK as far as legal issues. I tried to make the msyql-connector-java jar an optional dependency but maven insists on downloading it anyway. If we can prevent this I'd prefer it. The only reason for the dependency is so it gets copied into the plugin dependency list. The README now says: Roller with MySql Licensing: MySQL is Licensed under the GPL license: http://www.mysql.com/company/ legal/licensing/ and also under a FLOSS exception: http://www.mysql.com/company/legal/ licensing/foss-exception.html. Neither of these license terms are compatible with the goals of the ASF. The mysql-connector-java jar should not be needed to build the roller- mysql-database plugin (it is marked as an optional dependency) but for unknown reasons it is currently downloaded during the build. The only purpose of including the dependency in the pom is to get it into the geronimo plugin dependency list. The mysql-connector-java jar is listed as a prerequisite of the roller-mysql-database plugin. This has the effect of requiring the user to install the mysql jar themselves into their geronimo server before installing the roller-mysql-database plugin. The licensing issues are explained in text in the prerequisite specification. Roller with MySql Setup: At any time you can start using mysql as database back-end by installing the roller-mysql plugin module. Before installing the roller-mysql plugin create a empty mysql database called 'roller' with the user 'roller' and password 'roller'. After installing the roller-mysql plugin you may need to restart roller for the database change to take effect this can be done from Geronimos console via "Application" -->> "Web App WARs". The description of the prerequisite, which appears in the console when you try to install the plugin, reads: This module requires the mysql connector to be present in the Geronimo repository. MySQL is Licensed under the GPL license: http://www.mysql.com/company/legal/licensing/ MySQL is also available under a FLOSS exception: http://www.mysql.com/company/legal/licensing/foss- exception.html. The FLOSS exception only be applied to MySQL when it is used under an OSI-approved license. Neither of these licenses are compatible with the goals of the Apache Software Foundation. Thus, we cannot let the MySQL roller plugin automaticaly download the connector for you. How ever if either of the above license terms are acceptable to you, you may download the connector into the Geronimo repository yourself and re-select/install this module to enable roller with a mysql connector. I checked that the console plugin installer worked properly and it clearly prevents you from installing the plugin with mysql-connector- jar missing and you can see the prerequisite description. You also can't install it using the gshell list-plugins command but it is a lot harder to tell that it didn't install and the description is not presented. thanks david jencks On Feb 10, 2008, at 10:08 AM, Peter Petersson wrote: Kevan Miller wrote: All, I created a Jira to handle licensing issues involving the inclusion of MySQL in the roller-mysql-database plugin. See https://issues.apache.org/jira/browse/GERONIMO-3816 A patch that may resolve this issue have been posted to https:// issues.apache.org/jira/browse/GERONIMO-3816 regards Peter P I've insured that we will no longer build the roller-mysql- database plugin in our source code. However, there are multiple ways of handling this problem. Would like to hear opinions from the project. Ultimately, it's the PMC's responsibility to oversee the licensing of our distributions and to oversee the way we handle dependencies on artifacts that are covered by excluded licenses. The ASF Licensing Policy (currently it's a draft policy, but I think we should be following the guidelines documented there) are located here -- http://www.apache.org/legal/3party.html Discussion of how to handle Prohibited Works is here -- http:// people.apache.org/~rubys/3party.html#options Would be good for the project (in particular PMC) members to be familiar with these issues. Would like to hear how we think we should address this issue. As long as I feel the PMC is providing appropriate oversight, I'm happy with what ever decision we reach. --kevan
Re: Inclusion of MySQL in roller-mysql-database plugin
Kevan Miller wrote: All, I created a Jira to handle licensing issues involving the inclusion of MySQL in the roller-mysql-database plugin. See https://issues.apache.org/jira/browse/GERONIMO-3816 A patch that may resolve this issue have been posted to https://issues.apache.org/jira/browse/GERONIMO-3816 regards Peter P I've insured that we will no longer build the roller-mysql-database plugin in our source code. However, there are multiple ways of handling this problem. Would like to hear opinions from the project. Ultimately, it's the PMC's responsibility to oversee the licensing of our distributions and to oversee the way we handle dependencies on artifacts that are covered by excluded licenses. The ASF Licensing Policy (currently it's a draft policy, but I think we should be following the guidelines documented there) are located here -- http://www.apache.org/legal/3party.html Discussion of how to handle Prohibited Works is here -- http://people.apache.org/~rubys/3party.html#options Would be good for the project (in particular PMC) members to be familiar with these issues. Would like to hear how we think we should address this issue. As long as I feel the PMC is providing appropriate oversight, I'm happy with what ever decision we reach. --kevan
Re: Inclusion of MySQL in roller-mysql-database plugin
David Jencks wrote: On Feb 9, 2008, at 8:17 PM, Davanum Srinivas wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Kevan, You are right. We have a new mechanism for triggering prohibited works. We need to get this to the attention of the legal-discuss folks so they cover that angle in addition to just the "ship" angle that they have looked at so far. Would specifying "provided" provided in the pom.xml for mysql be enough to geronimo from downloading mysql when the plugin is installed? I am not that worried about pulling in that jar into our maven repo when we create/build our distribution, as long as we don't ship it. The scope won't have any effect. We do have the option of specifying the mysql jar as a prerequisite which will prevent installation of the plugin unless the mysql jar is already present, presumably because someone who is aware of the licensing concerns has explicitly installed it. I don't know if we've checked that this works properly with a jar rather than car (geronimo plugin) dependency but theoretically it would work. It works I will prepare a patch and put it in Kevan's JIRA https://issues.apache.org/jira/browse/GERONIMO-3816 for you to review. I don't think this a very elegant solution but it may be the best we can do in the near term. I guess I'm dreaming of a "license filter" that you can set up and then plugins can download dependencies consistent with the licenses you have allowed. To reiterate, we (asf) would never be shipping the mysql jar, but as currently set up, anyone installing the mysql roller plugin would be installing the mysql jar into their geronimo server. thanks david jencks thanks, dims Kevan Miller wrote: | | On Feb 9, 2008, at 2:01 PM, Davanum Srinivas wrote: | |> -BEGIN PGP SIGNED MESSAGE- |> Hash: SHA1 |> |> Kevan, |> |> I followed the discussion. You said that "Yes. The automatic download |> is the issue.". I don't think that is the case...I |> believe the "clear guidance" kicks in when we *ship* a distribution |> with some other license on that page. So i thought |> we should get clarification on that point. |> |> related question, Are we at this point picking/shipping either the |> plugin or the mysql jars into our distribution? | | | Hi Dims, | The roller plugins are not included in Geronimo 2.1. We will want to | release the roller plugin at some point. So, will need to clear up this | point before then. | | Thanks for the clarification. So, is this your question? | | | | Is it ok to release an Apache product which will automatically, without | user prompting, download a prohibited work? | | The product in question is the Apache Geronimo roller-mysql-database | plugin which has a dependency on a "prohibited work" (i.e. a MySQL jar | which is GPL with a FLOSS exception). The building of the plugin would | download a MySQL jar into a users maven repository. The MySQL jar would | *not* be included in the Geronimo roller-mysql-database plugin binary. | However, the subsequent installation of this plugin would cause the | Geronimo server to automatically download and install the MySQL jar, | without notifying the user. | | * | | IMO, the answer is no, you can't. Not by default and not without | notifying the user. Am happy to get clarification, if you (or anyone | else) think otherwise or aren't sure... | | I think the basic options are: | | 1. Don't make roller-mysql-database part of the standard build (and | don't release a roller-mysql-database binary). The user can use a | non-standard build option to create the plugin, as long as he/she is | notified. | 2. Make the roller-mysql-database part of the standard build, but remove | the MySQL dependency. This binary can be built and released by our | project. However, the MySQL jar must be installed -- either manually by | the user or by some tool which properly notifies the user. | | --kevan -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (Cygwin) iD8DBQFHrnrmgNg6eWEDv1kRAvXxAKDLSlpx83vB5a2iEzskKIOt8iIP+wCfdqfn oUFOkxrqEIx5Yl+U2ao04vE= =oWpQ -END PGP SIGNATURE-
Re: Inclusion of MySQL in roller-mysql-database plugin
On Feb 9, 2008, at 8:17 PM, Davanum Srinivas wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Kevan, You are right. We have a new mechanism for triggering prohibited works. We need to get this to the attention of the legal-discuss folks so they cover that angle in addition to just the "ship" angle that they have looked at so far. Would specifying "provided" provided in the pom.xml for mysql be enough to geronimo from downloading mysql when the plugin is installed? I am not that worried about pulling in that jar into our maven repo when we create/build our distribution, as long as we don't ship it. The scope won't have any effect. We do have the option of specifying the mysql jar as a prerequisite which will prevent installation of the plugin unless the mysql jar is already present, presumably because someone who is aware of the licensing concerns has explicitly installed it. I don't know if we've checked that this works properly with a jar rather than car (geronimo plugin) dependency but theoretically it would work. I don't think this a very elegant solution but it may be the best we can do in the near term. I guess I'm dreaming of a "license filter" that you can set up and then plugins can download dependencies consistent with the licenses you have allowed. To reiterate, we (asf) would never be shipping the mysql jar, but as currently set up, anyone installing the mysql roller plugin would be installing the mysql jar into their geronimo server. thanks david jencks thanks, dims Kevan Miller wrote: | | On Feb 9, 2008, at 2:01 PM, Davanum Srinivas wrote: | |> -BEGIN PGP SIGNED MESSAGE- |> Hash: SHA1 |> |> Kevan, |> |> I followed the discussion. You said that "Yes. The automatic download |> is the issue.". I don't think that is the case...I |> believe the "clear guidance" kicks in when we *ship* a distribution |> with some other license on that page. So i thought |> we should get clarification on that point. |> |> related question, Are we at this point picking/shipping either the |> plugin or the mysql jars into our distribution? | | | Hi Dims, | The roller plugins are not included in Geronimo 2.1. We will want to | release the roller plugin at some point. So, will need to clear up this | point before then. | | Thanks for the clarification. So, is this your question? | | | | Is it ok to release an Apache product which will automatically, without | user prompting, download a prohibited work? | | The product in question is the Apache Geronimo roller-mysql-database | plugin which has a dependency on a "prohibited work" (i.e. a MySQL jar | which is GPL with a FLOSS exception). The building of the plugin would | download a MySQL jar into a users maven repository. The MySQL jar would | *not* be included in the Geronimo roller-mysql-database plugin binary. | However, the subsequent installation of this plugin would cause the | Geronimo server to automatically download and install the MySQL jar, | without notifying the user. | | * | | IMO, the answer is no, you can't. Not by default and not without | notifying the user. Am happy to get clarification, if you (or anyone | else) think otherwise or aren't sure... | | I think the basic options are: | | 1. Don't make roller-mysql-database part of the standard build (and | don't release a roller-mysql-database binary). The user can use a | non-standard build option to create the plugin, as long as he/she is | notified. | 2. Make the roller-mysql-database part of the standard build, but remove | the MySQL dependency. This binary can be built and released by our | project. However, the MySQL jar must be installed -- either manually by | the user or by some tool which properly notifies the user. | | --kevan -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (Cygwin) iD8DBQFHrnrmgNg6eWEDv1kRAvXxAKDLSlpx83vB5a2iEzskKIOt8iIP+wCfdqfn oUFOkxrqEIx5Yl+U2ao04vE= =oWpQ -END PGP SIGNATURE-
Re: Inclusion of MySQL in roller-mysql-database plugin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Kevan, You are right. We have a new mechanism for triggering prohibited works. We need to get this to the attention of the legal-discuss folks so they cover that angle in addition to just the "ship" angle that they have looked at so far. Would specifying "provided" provided in the pom.xml for mysql be enough to geronimo from downloading mysql when the plugin is installed? I am not that worried about pulling in that jar into our maven repo when we create/build our distribution, as long as we don't ship it. thanks, dims Kevan Miller wrote: | | On Feb 9, 2008, at 2:01 PM, Davanum Srinivas wrote: | |> -BEGIN PGP SIGNED MESSAGE- |> Hash: SHA1 |> |> Kevan, |> |> I followed the discussion. You said that "Yes. The automatic download |> is the issue.". I don't think that is the case...I |> believe the "clear guidance" kicks in when we *ship* a distribution |> with some other license on that page. So i thought |> we should get clarification on that point. |> |> related question, Are we at this point picking/shipping either the |> plugin or the mysql jars into our distribution? | | | Hi Dims, | The roller plugins are not included in Geronimo 2.1. We will want to | release the roller plugin at some point. So, will need to clear up this | point before then. | | Thanks for the clarification. So, is this your question? | | | | Is it ok to release an Apache product which will automatically, without | user prompting, download a prohibited work? | | The product in question is the Apache Geronimo roller-mysql-database | plugin which has a dependency on a "prohibited work" (i.e. a MySQL jar | which is GPL with a FLOSS exception). The building of the plugin would | download a MySQL jar into a users maven repository. The MySQL jar would | *not* be included in the Geronimo roller-mysql-database plugin binary. | However, the subsequent installation of this plugin would cause the | Geronimo server to automatically download and install the MySQL jar, | without notifying the user. | | * | | IMO, the answer is no, you can't. Not by default and not without | notifying the user. Am happy to get clarification, if you (or anyone | else) think otherwise or aren't sure... | | I think the basic options are: | | 1. Don't make roller-mysql-database part of the standard build (and | don't release a roller-mysql-database binary). The user can use a | non-standard build option to create the plugin, as long as he/she is | notified. | 2. Make the roller-mysql-database part of the standard build, but remove | the MySQL dependency. This binary can be built and released by our | project. However, the MySQL jar must be installed -- either manually by | the user or by some tool which properly notifies the user. | | --kevan -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (Cygwin) iD8DBQFHrnrmgNg6eWEDv1kRAvXxAKDLSlpx83vB5a2iEzskKIOt8iIP+wCfdqfn oUFOkxrqEIx5Yl+U2ao04vE= =oWpQ -END PGP SIGNATURE-
Re: Inclusion of MySQL in roller-mysql-database plugin
Maybe one more clarification should be done the roller-mysql-database module is in no way needed for the geronimo roller plugin to work It is just one of hopefully more extra modules that will enhance the roller plugin, by default the roller tomcat and jetty modules setts up derby as db backend. regards Peter P Peter Petersson wrote: Hi all Thank you Kevan for bringing this to the table. Just to make sure everybody is clear on what the roller-mysql-database plugin dose, or more to the point dose not do. Jarek is exactly right when he says that the plugin dosen't actually include or distribute the mysql driver but it dose however automatically download the driver if it is not already present in the geronimo repository. As this automatic non user interaction convenience of the plugin, that dose not in a clear way tell the user what he/she is about to do (licence way) is the issue I would like to know if we have a consensus on using prerequsite in the plugin configuration (on the mysql driver being loaded beforehand) to satisfactory handle the licensing issue ? If I understand Kevan right a prerequisite on the driver would satisfy things so my suggestion (although I am just slightly involved in the roller plugin project and not in the PMC) would be to modify the plugin accordingly and reinstate it in the roller plugin assembly (as it is now it is disabled) what is your take on this? If we have consensus on this what would be a feasible text to put in the prerequisite section ? Although using prerequisite to fix this is (or may be) a available and viable option It would IMHO (although I don't know if it would satisfy the ASF Licensing Policy(?)) be more feasible (in cases like this) to somehow make the user aware of the licence statement and give him/here the option, after reading the licence (or what ever is necessary to satisfy the parties), to cancel the installation if he/she so chooses. regards Peter P Jarek Gawor wrote: Kevan, Can you explain what is the exact problem in this case? As far as I know, the roller plugin doesn't actaully include or distribute the msql driver. The driver will be automatically downloaded at compile time (becuase it is specified as maven dependency) and when the plugin is installed (becuase it is specified as a plugin dependency). Is the automatic download the problem? If so, maybe we can remove the msql maven dependency and modify the plugin dependency to specify the driver as a prerequisite? Jarek On Feb 6, 2008 9:40 AM, Kevan Miller <[EMAIL PROTECTED]> wrote: All, I created a Jira to handle licensing issues involving the inclusion of MySQL in the roller-mysql-database plugin. See https://issues.apache.org/jira/browse/GERONIMO-3816 I've insured that we will no longer build the roller-mysql-database plugin in our source code. However, there are multiple ways of handling this problem. Would like to hear opinions from the project. Ultimately, it's the PMC's responsibility to oversee the licensing of our distributions and to oversee the way we handle dependencies on artifacts that are covered by excluded licenses. The ASF Licensing Policy (currently it's a draft policy, but I think we should be following the guidelines documented there) are located here -- http://www.apache.org/legal/3party.html Discussion of how to handle Prohibited Works is here -- http://people.apache.org/~rubys/3party.html#options Would be good for the project (in particular PMC) members to be familiar with these issues. Would like to hear how we think we should address this issue. As long as I feel the PMC is providing appropriate oversight, I'm happy with what ever decision we reach. --kevan
Re: Inclusion of MySQL in roller-mysql-database plugin
Kevan Miller wrote: On Feb 9, 2008, at 10:11 AM, Peter Petersson wrote: Hi all Thank you Kevan for bringing this to the table. Just to make sure everybody is clear on what the roller-mysql-database plugin dose, or more to the point dose not do. Jarek is exactly right when he says that the plugin dosen't actually include or distribute the mysql driver but it dose however automatically download the driver if it is not already present in the geronimo repository. As this automatic non user interaction convenience of the plugin, that dose not in a clear way tell the user what he/she is about to do (licence way) is the issue I would like to know if we have a consensus on using prerequsite in the plugin configuration (on the mysql driver being loaded beforehand) to satisfactory handle the licensing issue ? If I understand Kevan right a prerequisite on the driver would satisfy things so my suggestion (although I am just slightly involved in the roller plugin project and not in the PMC) would be to modify the plugin accordingly and reinstate it in the roller plugin assembly (as it is now it is disabled) what is your take on this? Hi Peter, Thanks for your note. Your suggestion is certainly welcome. I did not mean to imply (and hope that it wasn't taken this way) that only PMC members should participate in this discussion. I only meant that the PMC had responsibilities to insure we reached a satisfactory solution. It was not, I just felt I somehow should state my level of involvement to make way for others to have there say and I had to put that parenthesis in somewhere ;) If we have consensus on this what would be a feasible text to put in the prerequisite section ? I think some of the text that I put in the pom.xml could be reworded slightly and would be ok... oki doki As I really would like to see the roller-mysql-database module included in the assembly again and guesses that David and the rest of you have a loot of release work to focus on I will try to come up with something fore you to review. BTW if some of you have access to some other roller supported database (db2, mssql/jtds, oracle, postgresql for testing and validation) feel free to step in and add a db access module the more the merrier ;) Although using prerequisite to fix this is (or may be) a available and viable option It would IMHO (although I don't know if it would satisfy the ASF Licensing Policy(?)) be more feasible (in cases like this) to somehow make the user aware of the licence statement and give him/here the option, after reading the licence (or what ever is necessary to satisfy the parties), to cancel the installation if he/she so chooses. IMO, this would be satisfactory, also. Great even... As long as the user is properly informed of the licensing implications of his or her actions. Well maybe I am stretching things here a bit but in that case it is a pity that a reed dotted bordered licence notice message one some calm background in big friendly letters dose not look good on a console install ;) else maybe that would have been a sufficient thing to do for the module, maybe gshell someday could do the trick of rendering a css/html boxed licence notice or the like of it ;) (almost not kidding here). Having read http://www.mysql.com/company/legal/licensing/foss-exception.html and http://people.apache.org/~rubys/3party.html#options I am not sure much more would be needed but I am not a company lawyer and I can certainly have got things wrong. regards Peter P --kevan
Re: Inclusion of MySQL in roller-mysql-database plugin
On Feb 9, 2008, at 2:01 PM, Davanum Srinivas wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Kevan, I followed the discussion. You said that "Yes. The automatic download is the issue.". I don't think that is the case...I believe the "clear guidance" kicks in when we *ship* a distribution with some other license on that page. So i thought we should get clarification on that point. related question, Are we at this point picking/shipping either the plugin or the mysql jars into our distribution? Hi Dims, The roller plugins are not included in Geronimo 2.1. We will want to release the roller plugin at some point. So, will need to clear up this point before then. Thanks for the clarification. So, is this your question? Is it ok to release an Apache product which will automatically, without user prompting, download a prohibited work? The product in question is the Apache Geronimo roller-mysql-database plugin which has a dependency on a "prohibited work" (i.e. a MySQL jar which is GPL with a FLOSS exception). The building of the plugin would download a MySQL jar into a users maven repository. The MySQL jar would *not* be included in the Geronimo roller-mysql-database plugin binary. However, the subsequent installation of this plugin would cause the Geronimo server to automatically download and install the MySQL jar, without notifying the user. * IMO, the answer is no, you can't. Not by default and not without notifying the user. Am happy to get clarification, if you (or anyone else) think otherwise or aren't sure... I think the basic options are: 1. Don't make roller-mysql-database part of the standard build (and don't release a roller-mysql-database binary). The user can use a non- standard build option to create the plugin, as long as he/she is notified. 2. Make the roller-mysql-database part of the standard build, but remove the MySQL dependency. This binary can be built and released by our project. However, the MySQL jar must be installed -- either manually by the user or by some tool which properly notifies the user. --kevan
Re: Inclusion of MySQL in roller-mysql-database plugin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Kevan, I followed the discussion. You said that "Yes. The automatic download is the issue.". I don't think that is the case...I believe the "clear guidance" kicks in when we *ship* a distribution with some other license on that page. So i thought we should get clarification on that point. related question, Are we at this point picking/shipping either the plugin or the mysql jars into our distribution? thanks, dims Kevan Miller wrote: | | On Feb 9, 2008, at 11:35 AM, Davanum Srinivas wrote: | |> -BEGIN PGP SIGNED MESSAGE- |> Hash: SHA1 |> |> Folks, |> |> Time to take this thread to legal-discuss AT apache.org. Someone |> please write up a detailed note and post it there please. | | Hi Dims, | What exactly needs to be resolved on legal-discuss? Seems like we have | pretty clear guidance from | http://people.apache.org/~rubys/3party.html#options | | IMO, this is a matter of reaching a community decision, but maybe I'm | wrong? | | --kevan | -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (Cygwin) iD8DBQFHrfhvgNg6eWEDv1kRAg2/AJ9HlecxIC5vK6S+qTFUDVqN9DitZgCffs1N Fg/iYoMzZ7z9rK/hZj/TX7Y= =O7jC -END PGP SIGNATURE-
Re: Inclusion of MySQL in roller-mysql-database plugin
On Feb 9, 2008, at 11:35 AM, Davanum Srinivas wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Folks, Time to take this thread to legal-discuss AT apache.org. Someone please write up a detailed note and post it there please. Hi Dims, What exactly needs to be resolved on legal-discuss? Seems like we have pretty clear guidance from http://people.apache.org/~rubys/3party.html#options IMO, this is a matter of reaching a community decision, but maybe I'm wrong? --kevan
Re: Inclusion of MySQL in roller-mysql-database plugin
On Feb 9, 2008, at 10:11 AM, Peter Petersson wrote: Hi all Thank you Kevan for bringing this to the table. Just to make sure everybody is clear on what the roller-mysql-database plugin dose, or more to the point dose not do. Jarek is exactly right when he says that the plugin dosen't actually include or distribute the mysql driver but it dose however automatically download the driver if it is not already present in the geronimo repository. As this automatic non user interaction convenience of the plugin, that dose not in a clear way tell the user what he/she is about to do (licence way) is the issue I would like to know if we have a consensus on using prerequsite in the plugin configuration (on the mysql driver being loaded beforehand) to satisfactory handle the licensing issue ? If I understand Kevan right a prerequisite on the driver would satisfy things so my suggestion (although I am just slightly involved in the roller plugin project and not in the PMC) would be to modify the plugin accordingly and reinstate it in the roller plugin assembly (as it is now it is disabled) what is your take on this? Hi Peter, Thanks for your note. Your suggestion is certainly welcome. I did not mean to imply (and hope that it wasn't taken this way) that only PMC members should participate in this discussion. I only meant that the PMC had responsibilities to insure we reached a satisfactory solution. If we have consensus on this what would be a feasible text to put in the prerequisite section ? I think some of the text that I put in the pom.xml could be reworded slightly and would be ok... Although using prerequisite to fix this is (or may be) a available and viable option It would IMHO (although I don't know if it would satisfy the ASF Licensing Policy(?)) be more feasible (in cases like this) to somehow make the user aware of the licence statement and give him/here the option, after reading the licence (or what ever is necessary to satisfy the parties), to cancel the installation if he/ she so chooses. IMO, this would be satisfactory, also. Great even... As long as the user is properly informed of the licensing implications of his or her actions. --kevan
Re: Inclusion of MySQL in roller-mysql-database plugin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Folks, Time to take this thread to legal-discuss AT apache.org. Someone please write up a detailed note and post it there please. - -- dims Peter Petersson wrote: | Hi all | | Thank you Kevan for bringing this to the table. Just to make sure | everybody is clear on what the roller-mysql-database plugin dose, or | more to the point dose not do. Jarek is exactly right when he says that | the plugin dosen't actually include or distribute the mysql driver but | it dose however automatically download the driver if it is not already | present in the geronimo repository. | | As this automatic non user interaction convenience of the plugin, that | dose not in a clear way tell the user what he/she is about to do | (licence way) is the issue I would like to know if we have a consensus | on using prerequsite in the plugin configuration (on the mysql driver | being loaded beforehand) to satisfactory handle the licensing issue ? | If I understand Kevan right a prerequisite on the driver would satisfy | things so my suggestion (although I am just slightly involved in the | roller plugin project and not in the PMC) would be to modify the plugin | accordingly and reinstate it in the roller plugin assembly (as it is now | it is disabled) what is your take on this? | | If we have consensus on this what would be a feasible text to put in the | prerequisite section ? | | Although using prerequisite to fix this is (or may be) a available and | viable option It would IMHO (although I don't know if it would satisfy | the ASF Licensing Policy(?)) be more feasible (in cases like this) to | somehow make the user aware of the licence statement and give him/here | the option, after reading the licence (or what ever is necessary to | satisfy the parties), to cancel the installation if he/she so chooses. | | regards | Peter P | | Jarek Gawor wrote: |> Kevan, |> |> Can you explain what is the exact problem in this case? As far as I |> know, the roller plugin doesn't actaully include or distribute the |> msql driver. The driver will be automatically downloaded at compile |> time (becuase it is specified as maven dependency) and when the plugin |> is installed (becuase it is specified as a plugin dependency). Is the |> automatic download the problem? If so, maybe we can remove the msql |> maven dependency and modify the plugin dependency to specify the |> driver as a prerequisite? |> |> Jarek |> |> On Feb 6, 2008 9:40 AM, Kevan Miller <[EMAIL PROTECTED]> wrote: |> |>> All, |>> I created a Jira to handle licensing issues involving the inclusion of |>> MySQL in the roller-mysql-database plugin. See |>> https://issues.apache.org/jira/browse/GERONIMO-3816 |>> |>> I've insured that we will no longer build the roller-mysql-database |>> plugin in our source code. However, there are multiple ways of |>> handling this problem. Would like to hear opinions from the project. |>> Ultimately, it's the PMC's responsibility to oversee the licensing of |>> our distributions and to oversee the way we handle dependencies on |>> artifacts that are covered by excluded licenses. |>> |>> The ASF Licensing Policy (currently it's a draft policy, but I think |>> we should be following the guidelines documented there) are located |>> here -- http://www.apache.org/legal/3party.html |>> |>> Discussion of how to handle Prohibited Works is here -- |>> http://people.apache.org/~rubys/3party.html#options |>> |>> Would be good for the project (in particular PMC) members to be |>> familiar with these issues. Would like to hear how we think we should |>> address this issue. As long as I feel the PMC is providing appropriate |>> oversight, I'm happy with what ever decision we reach. |>> |>> --kevan |>> |>> |>> |>> |>> | -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (Cygwin) iD8DBQFHrdZjgNg6eWEDv1kRApoeAKCjLfcolYlrKokPkb+kH9KALjKkLACeKFYx 2yQ7c6vlK+n4hJl9iEnPDbs= =oCrU -END PGP SIGNATURE-
Re: Inclusion of MySQL in roller-mysql-database plugin
Hi all Thank you Kevan for bringing this to the table. Just to make sure everybody is clear on what the roller-mysql-database plugin dose, or more to the point dose not do. Jarek is exactly right when he says that the plugin dosen't actually include or distribute the mysql driver but it dose however automatically download the driver if it is not already present in the geronimo repository. As this automatic non user interaction convenience of the plugin, that dose not in a clear way tell the user what he/she is about to do (licence way) is the issue I would like to know if we have a consensus on using prerequsite in the plugin configuration (on the mysql driver being loaded beforehand) to satisfactory handle the licensing issue ? If I understand Kevan right a prerequisite on the driver would satisfy things so my suggestion (although I am just slightly involved in the roller plugin project and not in the PMC) would be to modify the plugin accordingly and reinstate it in the roller plugin assembly (as it is now it is disabled) what is your take on this? If we have consensus on this what would be a feasible text to put in the prerequisite section ? Although using prerequisite to fix this is (or may be) a available and viable option It would IMHO (although I don't know if it would satisfy the ASF Licensing Policy(?)) be more feasible (in cases like this) to somehow make the user aware of the licence statement and give him/here the option, after reading the licence (or what ever is necessary to satisfy the parties), to cancel the installation if he/she so chooses. regards Peter P Jarek Gawor wrote: Kevan, Can you explain what is the exact problem in this case? As far as I know, the roller plugin doesn't actaully include or distribute the msql driver. The driver will be automatically downloaded at compile time (becuase it is specified as maven dependency) and when the plugin is installed (becuase it is specified as a plugin dependency). Is the automatic download the problem? If so, maybe we can remove the msql maven dependency and modify the plugin dependency to specify the driver as a prerequisite? Jarek On Feb 6, 2008 9:40 AM, Kevan Miller <[EMAIL PROTECTED]> wrote: All, I created a Jira to handle licensing issues involving the inclusion of MySQL in the roller-mysql-database plugin. See https://issues.apache.org/jira/browse/GERONIMO-3816 I've insured that we will no longer build the roller-mysql-database plugin in our source code. However, there are multiple ways of handling this problem. Would like to hear opinions from the project. Ultimately, it's the PMC's responsibility to oversee the licensing of our distributions and to oversee the way we handle dependencies on artifacts that are covered by excluded licenses. The ASF Licensing Policy (currently it's a draft policy, but I think we should be following the guidelines documented there) are located here -- http://www.apache.org/legal/3party.html Discussion of how to handle Prohibited Works is here -- http://people.apache.org/~rubys/3party.html#options Would be good for the project (in particular PMC) members to be familiar with these issues. Would like to hear how we think we should address this issue. As long as I feel the PMC is providing appropriate oversight, I'm happy with what ever decision we reach. --kevan
Re: Inclusion of MySQL in roller-mysql-database plugin
On Feb 6, 2008, at 11:15 AM, Jarek Gawor wrote: Kevan, Can you explain what is the exact problem in this case? As far as I know, the roller plugin doesn't actaully include or distribute the msql driver. The driver will be automatically downloaded at compile time (becuase it is specified as maven dependency) and when the plugin is installed (becuase it is specified as a plugin dependency). Is the automatic download the problem? If so, maybe we can remove the msql maven dependency and modify the plugin dependency to specify the driver as a prerequisite? Yes. The automatic download is the issue. Just documenting the dependency is fine. --kevan
Re: Inclusion of MySQL in roller-mysql-database plugin
On Feb 6, 2008, at 11:07 AM, Jay D. McHugh wrote: Hello all, It looks like MySQL has specifically granted an exception to their usual GPL license requirement for a list of FLOSS licenses - ASF 2.0 included: http://www.mysql.com/company/legal/licensing/foss-exception.html In fact, the Apache Portable Runtime library is the only specifically listed library/package listed on that exclusion page. So I think we could distribute the roller-mysql-database plugin if we wanted to - there is already a precedent at the ASF. The MySQL FLOSS exception *only* applies when used under the terms of an OSI license. Apache allows it's software to be re-licensed under any license (open source or proprietary). The FLOSS exception prevents this. Or, could we change the way that the plugin is built so that it just has a dependency on a MySQL driver being loaded in the repository? That way, we could give a fairly simple set of instructions on downloading the library from MySQL and loading the jar files into the repository before trying to load the plugin. In my personal setup, I already had a MySQL driver loaded - having one bundled just means that now I have two. Yes. However, it should not be something which maven (or Geronimo) does automatically or implicitly (e.g. without the user's awareness). The user must be aware of his actions and the implications of these actions. I haven't played with creating any plugins yet, so I don't know if the system we have now allows for creating a plugin that doesn't bundle in the dependencies. Is that something that can be done? If we can build plugins that do not necessarily bundle in the dependencies then I think that would be the best way of handling plugins that would bring up licensing questions. If we cannot, then it looks like we will need to put some procedure in place to review plugins that include third party code before they can be hosted by us. Right. As long as there is an explicit user action that causes the download/installation to occur and as long as we make it clear to the user that this action is retrieving a GPL/FLOSS licensed artifact, we should be good. --kevan
Re: Inclusion of MySQL in roller-mysql-database plugin
On Feb 6, 2008, at 8:15 AM, Jarek Gawor wrote: Kevan, Can you explain what is the exact problem in this case? As far as I know, the roller plugin doesn't actaully include or distribute the msql driver. The driver will be automatically downloaded at compile time (becuase it is specified as maven dependency) and when the plugin is installed (becuase it is specified as a plugin dependency). Is the automatic download the problem? If so, maybe we can remove the msql maven dependency and modify the plugin dependency to specify the driver as a prerequisite? At the moment I'd rather not distribute the plugin than make the maven dependencies inaccurate. I think using prerequisites is definitely an idea worth pursuing. thanks david jencks Jarek On Feb 6, 2008 9:40 AM, Kevan Miller <[EMAIL PROTECTED]> wrote: All, I created a Jira to handle licensing issues involving the inclusion of MySQL in the roller-mysql-database plugin. See https:// issues.apache.org/jira/browse/GERONIMO-3816 I've insured that we will no longer build the roller-mysql-database plugin in our source code. However, there are multiple ways of handling this problem. Would like to hear opinions from the project. Ultimately, it's the PMC's responsibility to oversee the licensing of our distributions and to oversee the way we handle dependencies on artifacts that are covered by excluded licenses. The ASF Licensing Policy (currently it's a draft policy, but I think we should be following the guidelines documented there) are located here -- http://www.apache.org/legal/3party.html Discussion of how to handle Prohibited Works is here -- http:// people.apache.org/~rubys/3party.html#options Would be good for the project (in particular PMC) members to be familiar with these issues. Would like to hear how we think we should address this issue. As long as I feel the PMC is providing appropriate oversight, I'm happy with what ever decision we reach. --kevan
Re: Inclusion of MySQL in roller-mysql-database plugin
I'm pretty sure I don't completely understand the issues but... just because mysql has granted an exemption that means the tranql code is not automatically gpl (since it is asf 2.0 licensed) does not mean that the mysql binary can be distributed from the asf. IIUC the asf wants to only be involved in distributing code that is asf licensed or licensed under similar terms: the mysql driver is definitely not licensed under similar terms. So, it appears to be ok to have code to build the roller-mysql plugin at apache, but it should not be run without the user taking special steps that indicate they are aware of the licensing consequences and the result should not be distributed from apache. There's a lot of recent discussion on legal-discuss on this. thanks david jencks On Feb 6, 2008, at 8:07 AM, Jay D. McHugh wrote: Hello all, It looks like MySQL has specifically granted an exception to their usual GPL license requirement for a list of FLOSS licenses - ASF 2.0 included: http://www.mysql.com/company/legal/licensing/foss-exception.html In fact, the Apache Portable Runtime library is the only specifically listed library/package listed on that exclusion page. So I think we could distribute the roller-mysql-database plugin if we wanted to - there is already a precedent at the ASF. Or, could we change the way that the plugin is built so that it just has a dependency on a MySQL driver being loaded in the repository? That way, we could give a fairly simple set of instructions on downloading the library from MySQL and loading the jar files into the repository before trying to load the plugin. In my personal setup, I already had a MySQL driver loaded - having one bundled just means that now I have two. I haven't played with creating any plugins yet, so I don't know if the system we have now allows for creating a plugin that doesn't bundle in the dependencies. Is that something that can be done? If we can build plugins that do not necessarily bundle in the dependencies then I think that would be the best way of handling plugins that would bring up licensing questions. If we cannot, then it looks like we will need to put some procedure in place to review plugins that include third party code before they can be hosted by us. Jay Kevan Miller wrote: All, I created a Jira to handle licensing issues involving the inclusion of MySQL in the roller-mysql-database plugin. See https://issues.apache.org/jira/browse/GERONIMO-3816 I've insured that we will no longer build the roller-mysql- database plugin in our source code. However, there are multiple ways of handling this problem. Would like to hear opinions from the project. Ultimately, it's the PMC's responsibility to oversee the licensing of our distributions and to oversee the way we handle dependencies on artifacts that are covered by excluded licenses. The ASF Licensing Policy (currently it's a draft policy, but I think we should be following the guidelines documented there) are located here -- http://www.apache.org/legal/3party.html Discussion of how to handle Prohibited Works is here -- http:// people.apache.org/~rubys/3party.html#options Would be good for the project (in particular PMC) members to be familiar with these issues. Would like to hear how we think we should address this issue. As long as I feel the PMC is providing appropriate oversight, I'm happy with what ever decision we reach. --kevan
Re: Inclusion of MySQL in roller-mysql-database plugin
Kevan, Can you explain what is the exact problem in this case? As far as I know, the roller plugin doesn't actaully include or distribute the msql driver. The driver will be automatically downloaded at compile time (becuase it is specified as maven dependency) and when the plugin is installed (becuase it is specified as a plugin dependency). Is the automatic download the problem? If so, maybe we can remove the msql maven dependency and modify the plugin dependency to specify the driver as a prerequisite? Jarek On Feb 6, 2008 9:40 AM, Kevan Miller <[EMAIL PROTECTED]> wrote: > All, > I created a Jira to handle licensing issues involving the inclusion of > MySQL in the roller-mysql-database plugin. See > https://issues.apache.org/jira/browse/GERONIMO-3816 > > I've insured that we will no longer build the roller-mysql-database > plugin in our source code. However, there are multiple ways of > handling this problem. Would like to hear opinions from the project. > Ultimately, it's the PMC's responsibility to oversee the licensing of > our distributions and to oversee the way we handle dependencies on > artifacts that are covered by excluded licenses. > > The ASF Licensing Policy (currently it's a draft policy, but I think > we should be following the guidelines documented there) are located > here -- http://www.apache.org/legal/3party.html > > Discussion of how to handle Prohibited Works is here -- > http://people.apache.org/~rubys/3party.html#options > > Would be good for the project (in particular PMC) members to be > familiar with these issues. Would like to hear how we think we should > address this issue. As long as I feel the PMC is providing appropriate > oversight, I'm happy with what ever decision we reach. > > --kevan > > > >
Re: Inclusion of MySQL in roller-mysql-database plugin
Hello all, It looks like MySQL has specifically granted an exception to their usual GPL license requirement for a list of FLOSS licenses - ASF 2.0 included: http://www.mysql.com/company/legal/licensing/foss-exception.html In fact, the Apache Portable Runtime library is the only specifically listed library/package listed on that exclusion page. So I think we could distribute the roller-mysql-database plugin if we wanted to - there is already a precedent at the ASF. Or, could we change the way that the plugin is built so that it just has a dependency on a MySQL driver being loaded in the repository? That way, we could give a fairly simple set of instructions on downloading the library from MySQL and loading the jar files into the repository before trying to load the plugin. In my personal setup, I already had a MySQL driver loaded - having one bundled just means that now I have two. I haven't played with creating any plugins yet, so I don't know if the system we have now allows for creating a plugin that doesn't bundle in the dependencies. Is that something that can be done? If we can build plugins that do not necessarily bundle in the dependencies then I think that would be the best way of handling plugins that would bring up licensing questions. If we cannot, then it looks like we will need to put some procedure in place to review plugins that include third party code before they can be hosted by us. Jay Kevan Miller wrote: All, I created a Jira to handle licensing issues involving the inclusion of MySQL in the roller-mysql-database plugin. See https://issues.apache.org/jira/browse/GERONIMO-3816 I've insured that we will no longer build the roller-mysql-database plugin in our source code. However, there are multiple ways of handling this problem. Would like to hear opinions from the project. Ultimately, it's the PMC's responsibility to oversee the licensing of our distributions and to oversee the way we handle dependencies on artifacts that are covered by excluded licenses. The ASF Licensing Policy (currently it's a draft policy, but I think we should be following the guidelines documented there) are located here -- http://www.apache.org/legal/3party.html Discussion of how to handle Prohibited Works is here -- http://people.apache.org/~rubys/3party.html#options Would be good for the project (in particular PMC) members to be familiar with these issues. Would like to hear how we think we should address this issue. As long as I feel the PMC is providing appropriate oversight, I'm happy with what ever decision we reach. --kevan
