On Nov 5, 2009, at 8:13 AM, Josh Thompson wrote:

Hash: SHA1


Thanks for the feedback - more discussion inline.

On Wednesday November 04, 2009, Ralph Goers wrote:
Usual qualifications - I am not on the legal committee so this is just
my personal opinion.

On Nov 4, 2009, at 10:06 AM, Josh Thompson wrote:
Hash: SHA1



On Thursday October 29, 2009, Josh Thompson wrote:
Legal advisers,

We at the Apache VCL project are trying to get our first release
out.  VCL
is a cloud management framework.  It is written in perl and php.

While there is no third party software bundled with VCL, there are
types of third party software dependencies we have questions about.

The first, required perl modules, may not even be considered third
For the perl code, we have a script that will install all required
additional perl modules.  There's about 14 such modules (with the
possibility that some of them may already be installed).  Most of
modules say they are licensed under the same terms as perl itself.
A few
of them explicitly state they are licensed under one of "Artistic
GPL, or LGPL.  How should we go about listing these licenses?
Should they
be listed out in the README file, the NOTICE file, or somewhere
else?  The
script that installs them displays a message stating that it will
some items licensed under "Artistic License", GPL, and LGPL and
that you type YES to proceed with installing them.

http://www.apache.org/legal/src-headers.html should provide the
answers to where the attributions should appear. I like that you have
a script to install them.

My biggest concern is the one you didn't ask about. ASF policy is that
you can't have a required dependency on something with a category X
license (see http://www.apache.org/legal/resolved.html#category-x), so
you cannot distribute VCL until all the dependencies on these are
optional or are replaced with something with a compatible license. I
am also concerned with the GPL dependencies because of the FSF's
definition of what a derivative work is. If you have a required
dependency on something with a GPL license your code must also be
licensed under the GPL, not the Apace license (which is why it isn't

There's one part of VCL (notifications via Jabber) that's not really used that is the cause of a chunk of the additional perl modules. We'll remove that and see if there are any modules left that are not released under perl's

However, even given that, since the code is written in perl and PHP, those interpreters are required to run VCL. PHP's license is listed as okay on the page you linked to above. perl is released under the Artistic License, which
is not listed on that page at all.

Is ASF okay with the Artistic License? If not, things are looking pretty
bleak for our project...

The second type of third party software depends on how you want to
use VCL.
VCL can manage physical machines using xCAT (which must be set up
separately and is outside the scope of installing VCL), or VCL can
VMWare based systems, with other hypervisors to be added in later.
there is some experimental work being done to support intelligent
starting with NetApp filers.  Here's where things get a little more
complicated.  If using xCAT to deploy linux on any hardware, or to
windows on identical hardware, there is no third party software
(other than the perl modules already discussed).  However, if
windows to different types of hardware, you must download Sysprep
Microsoft, along with any drivers to support the different types of

If using VCL to manage VMWare systems, you need VMWare's perl
Similarly, if managing a NetApp filer, you need NetApp's perl

How do we need to list out/explain these dependencies?

Dependencies required for a specific platform are generally OK.  See
http://www.apache.org/legal/resolved.html#platform . This doesn't document
how to explain them. I would presume this
should go in the NOTICE file.


Okay - we'll list them in the NOTICE file.

Josh, just so we are on the same page in terms of what still needs to be done, can you create Jira issues that list what needs to be done on this front for the release?


Reply via email to