Re: Licensing issue advice for Solr.

[Shawn Heisey]

On 3/24/2017 11:53 AM, russell.lemas...@comcast.net wrote:
> I'm just getting started with Solr (6.4.2) and am trying to get
> approval for usage in my workplace. I know that the product in general
> is licensed as Apache 2.0, but unfortunately there are packages
> included in the build that are considered "non-permissive" by my
> company and as such, means that I am having trouble getting things
> approved. It appears that the vast majority of the licensing issues
> are within the contrib directory. I know these provide significant
> functionality for Solr, but I was wondering if there is an official
> build that contains just the Solr and Lucene server distribution
> (minus demos and contrib). Some of the packages are dual licensed so I
> am able to deal with that by selecting which we wish to use, but there
> are some that are either not licensed at all or are only
> non-permissive (ie: not Apache, BSD, MIT, etc.) like GPL, CDDL, etc. 

The big questions, which Hoss already mentioned: What modules in Solr do
you need where the license is unacceptable, where are you looking to
confirm that the unacceptable license applies, and why are those
particular licenses unacceptable?

If something is included with Solr, then it's almost guaranteed that one
of the licenses for it will be compatible with the Apache 2.0 license,
and perfectly acceptable to use in a commercial setting.  The Apache
Software Foundation takes licenses seriously, and the Lucene/Solr
project is no exception.

The GPL is an example of something that is not compatible with the
Apache license.  This means that if something is ONLY licensed under the
GPL, including it with Solr is not allowed, and we need to remove it. 
Some of the libraries used by Solr's dependenciesare licensed under the
LGPL, which IS compatible with Apache 2.0.

The CDDL is mentioned in Apache's legal area as an acceptable license
for binary inclusion in an Apache project.  It will not conflict with
the Apache license.  This is particularly important with Solr, because
if you're not OK with the CDDL, you basically can't run Solr at all. 
The Java Servlet API is licensed CDDL.  This API is necessary in order
to create a servlet application, which is what Solr is.

https://www.apache.org/legal/resolved.html#category-b

Thanks,
Shawn

Re: Licensing issue advice for Solr.

[Chris Hostetter]

: I know that the product in general is licensed as Apache 2.0, but 
unfortunately there are packages 
: included in the build that are considered "non-permissive" by my company and 
as such, means that 
...
: It appears that the vast majority of the licensing issues are within the 
contrib directory. I know these 
...
: just the Solr and Lucene server distribution (minus demos and contrib). Some 
of the packages are 
: dual licensed so I am able to deal with that by selecting which we wish to 
use, but there are some 
: that are either not licensed at all or are only non-permissive (ie: not 
Apache, BSD, MIT, etc.) like 
: GPL, CDDL, etc. 

Can you give a specific example of a dependency that you are seeing used 
in contrib that is not (dual) licensed under a "permissive" license?

Every jar Lucene/Solr depends on has a corrisponding file in our 
*/licenses directories -- so I'm not sure what you mean by "not licensed 
at all"  There should most cerntainly not be anything that's licensed as 
GPL (w/o a dual license option that's more permissive).  

Granted: If you consider CDDL to be problematic then you will certainly 
have some problems since the javax.servlet *API* is itself under the 
CDDL, so you're kind of going to be out of luck as far as being able to 
run Solr ... or any java based app that uses servlets.


Having said all of that

If your legal department feels (for whatever reasons) that solr-core's 
dependencies are "ok", but there are contribs with deps that are "not ok", 
then there is an easy solution:

1) download a "src" release
2) run "cd solr/webapp && ant dist"

You'll now have a fully functionaly copy of the solr app you can run, and 
only the compile dependencies for the core server & solrj will have been 
downloaded to your machine -- nothing in contrib will be built, let alone 
have any 3rd party deps downloaded.


-Hoss
http://www.lucidworks.com/

Re: Licensing issue advice for Solr.

[Alexandre Rafalovitch]

There is no official build with minimal Solr configuration. Some
downstream projects may do so, but we don't keep track of their
installation specifics.

If it is an issue with contrib directory I would think you should be
able to just not use it or even delete it.

As to the searching, you've already been shown Markmail. There is also
http://search-lucene.com/?project=Solr=mail+_hash_+user=license

Regards,
   Alex.

http://www.solr-start.com/ - Resources for Solr users, new and experienced


On 24 March 2017 at 13:53,   wrote:
> Hi all,
>
> I'm just getting started with Solr (6.4.2) and am trying to get approval for 
> usage in my workplace.
> I know that the product in general is licensed as Apache 2.0, but 
> unfortunately there are packages
> included in the build that are considered "non-permissive" by my company and 
> as such, means that
> I am having trouble getting things approved.
>
> It appears that the vast majority of the licensing issues are within the 
> contrib directory. I know these
> provide significant functionality for Solr, but I was wondering if there is 
> an official build that contains
> just the Solr and Lucene server distribution (minus demos and contrib). Some 
> of the packages are
> dual licensed so I am able to deal with that by selecting which we wish to 
> use, but there are some
> that are either not licensed at all or are only non-permissive (ie: not 
> Apache, BSD, MIT, etc.) like
> GPL, CDDL, etc.
>
> Has anyone had to deal with this in the past. My apologies if this has been 
> discussed before, but
> it doesn't appear that the mail list archive has a search option (correct me 
> if I'm wrong on that).
>
> Thanks
>
>

Re: Licensing issue advice for Solr.

[Pablo Pita Leira]

No answer from my side, but if you like to search the mailing list, you 
can try this:


http://markmail.org/search/?q=license+list%3Aorg.apache.lucene.solr-user


On 24.03.2017 18:53, russell.lemas...@comcast.net wrote:

Hi all,

I'm just getting started with Solr (6.4.2) and am trying to get approval for 
usage in my workplace.
I know that the product in general is licensed as Apache 2.0, but unfortunately 
there are packages
included in the build that are considered "non-permissive" by my company and as 
such, means that
I am having trouble getting things approved.

It appears that the vast majority of the licensing issues are within the 
contrib directory. I know these
provide significant functionality for Solr, but I was wondering if there is an 
official build that contains
just the Solr and Lucene server distribution (minus demos and contrib). Some of 
the packages are
dual licensed so I am able to deal with that by selecting which we wish to use, 
but there are some
that are either not licensed at all or are only non-permissive (ie: not Apache, 
BSD, MIT, etc.) like
GPL, CDDL, etc.

Has anyone had to deal with this in the past. My apologies if this has been 
discussed before, but
it doesn't appear that the mail list archive has a search option (correct me if 
I'm wrong on that).

Thanks