Hi Eric,
I still see a lot of jars without propert NOTICE/LICENSE.
I tried building apache rat whiskers and to run it against the binary
artifact but I didn't understand how to use it: Robert???
My latest attempt was to copy the whisker jar to the root and also
licensing.xml to the root and then run this command, but no success:
java -cp .;apache-whisker-cli-0.1-SNAPSHOT-shaded.jar
org.apache.rat.whisker.cli.Main -l licensing.xml -a -s lib
I also tried to copy the LICENSE/NOTICE stuff in the lib folder, but
again no success.
I've only been able to use the "generation" option to generate LICENSE
starting from licensing.xml just with "mvn install" of whisker and
then manually invoking the mvn
org.apache.rat.whisker:apache-whisker-plugin4maven:generate
-DapacheWhiskerDescriptor=src/main/licensing/app/licensing.xml goal .
One thing to do to try to make it simpler to deal with licensing, is
to make sure to remove each jar we don't really need.
So, I started with adding some "<scope>provided</scope>" for some of
the jars that are not needed in a java 6 environment (jaxb,
activation) or for which we have alternatives in the lib (javamail).
<dependency>
<groupId>javax.xml.bind</groupId>
<artifactId>jaxb-api</artifactId>
<version>2.1</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>javax.activation</groupId>
<artifactId>activation</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.apache.geronimo.specs</groupId>
<artifactId>geronimo-activation_1.1_spec</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.apache.geronimo.javamail</groupId>
<artifactId>geronimo-javamail_1.4_mail</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>stax</groupId>
<artifactId>stax-api</artifactId>
<version>1.0.1</version>
<scope>provided</scope>
</dependency>
Then I see there are a bunch of libraries coming in as transient
dependencies for the hadoop/hbase stuff. I tried to download their
binaries package in the hope they provided good LICENSE/NOTICE for
their parts, but this is not the case. So we have to document them by
hand making sure that each 3rd party jar we bundle has a reference in
the LICENSE (and in NOTICE when required). Most of non spring/apache
(apache licensed), non oracle (CDDL licensed) jars we have in the tree
are hadoop/hbase dependencies.
Then we still have some jar, like the jcr 2.0 api jar, that I
investigated and found this:
http://jackrabbit.510166.n4.nabble.com/jcr-1-0-jar-Day-Spec-License-td3933735.html
Maybe the links in tha threads helps finding out what are the
LICENSE/NOTICE requirements to redistribute it.
Maybe the easier option is to simply remove hbase/hadoop jars (anche
maybe also JCR?) and dependencies from the binary distro, asking users
to download them if they want to use hbase/hadoop/jcr.
Unfortunately I won't have more time to help with fixing this PITA soon.
Stefano
2012/3/15 Eric Charles <[email protected]>:
> Hi All,
>
> Before launching the vote for the 3.0beta4 app release, it will be good that
> you review the NOTICE file or any other stuff you can think to.
>
> I will start the vote after this weekend on Monday 19 March.
>
> Thx.
> --
> eric | http://about.echarles.net | @echarles
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
