On Nov 5, 2009, at 8:13 AM, Josh Thompson wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Ralph,
Thanks for the feedback - more discussion inline.
On Wednesday November 04, 2009, Ralph Goers wrote:
Usual qualifications - I am not on the legal committee so this is
just
my personal opinion.
On Nov 4, 2009, at 10:06 AM, Josh Thompson wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Bump.
Anyone?
On Thursday October 29, 2009, Josh Thompson wrote:
Legal advisers,
We at the Apache VCL project are trying to get our first release
out. VCL
is a cloud management framework. It is written in perl and php.
While there is no third party software bundled with VCL, there are
two
types of third party software dependencies we have questions about.
The first, required perl modules, may not even be considered third
party.
For the perl code, we have a script that will install all required
additional perl modules. There's about 14 such modules (with the
possibility that some of them may already be installed). Most of
those
modules say they are licensed under the same terms as perl itself.
A few
of them explicitly state they are licensed under one of "Artistic
License",
GPL, or LGPL. How should we go about listing these licenses?
Should they
be listed out in the README file, the NOTICE file, or somewhere
else? The
script that installs them displays a message stating that it will
install
some items licensed under "Artistic License", GPL, and LGPL and
requires
that you type YES to proceed with installing them.
http://www.apache.org/legal/src-headers.html should provide the
answers to where the attributions should appear. I like that you have
a script to install them.
My biggest concern is the one you didn't ask about. ASF policy is
that
you can't have a required dependency on something with a category X
license (see http://www.apache.org/legal/resolved.html#category-x),
so
you cannot distribute VCL until all the dependencies on these are
optional or are replaced with something with a compatible license. I
am also concerned with the GPL dependencies because of the FSF's
definition of what a derivative work is. If you have a required
dependency on something with a GPL license your code must also be
licensed under the GPL, not the Apace license (which is why it isn't
allowed).
There's one part of VCL (notifications via Jabber) that's not really
used that
is the cause of a chunk of the additional perl modules. We'll
remove that
and see if there are any modules left that are not released under
perl's
license.
However, even given that, since the code is written in perl and PHP,
those
interpreters are required to run VCL. PHP's license is listed as
okay on the
page you linked to above. perl is released under the Artistic
License, which
is not listed on that page at all.
Is ASF okay with the Artistic License? If not, things are looking
pretty
bleak for our project...
The second type of third party software depends on how you want to
use VCL.
VCL can manage physical machines using xCAT (which must be set up
separately and is outside the scope of installing VCL), or VCL can
manage
VMWare based systems, with other hypervisors to be added in later.
Also,
there is some experimental work being done to support intelligent
storage,
starting with NetApp filers. Here's where things get a little more
complicated. If using xCAT to deploy linux on any hardware, or to
deploy
windows on identical hardware, there is no third party software
required
(other than the perl modules already discussed). However, if
deploying
windows to different types of hardware, you must download Sysprep
from
Microsoft, along with any drivers to support the different types of
hardware.
If using VCL to manage VMWare systems, you need VMWare's perl
libraries.
Similarly, if managing a NetApp filer, you need NetApp's perl
libraries.
How do we need to list out/explain these dependencies?
Dependencies required for a specific platform are generally OK. See
http://www.apache.org/legal/resolved.html#platform . This doesn't
document
how to explain them. I would presume this
should go in the NOTICE file.
Ralph
Okay - we'll list them in the NOTICE file.
Josh, just so we are on the same page in terms of what still needs to
be done, can you create Jira issues that list what needs to be done on
this front for the release?
Regards,
Alan
