Dev - Licensing and Libraries used by OFBiz

[David E. Jones]

Hello all. There has been some off-list discussion and research and  
some preparation to move forward on cleaning up the libraries used in  
OFBiz and clarify licensing issues. This is something we should have  
done a long time ago and then kept up over time as it can represent a  
liability for all users of OFBiz, but right now the driving force  
behind doing this is to move into compliance with Apache Software  
Foundation policies.

========================================

Some notes on licenses (after doing a little research):

We can use and include libraries licensed with any BSD/MIT like  
license including Apache, etc. We can also change and redistribute  
these libraries.

We can use and include libraries licensed with SPL (Sun), MPL  
(Mozilla), and similar licenses. We cannot change these and  
redistribute the changes though. These are a combination of the GPL  
and BSD licenses and make a distinction between "Covered Code" and  
"Larger Works". If we change the code the changes must be SPL/MPL/
whatever licensed, but we can use the libraries unmodified just fine.

We can use, but can not include, libraries licensed with LGPL. The  
licensing quirk here is that we can write code that uses the  
libraries but can't include (distribute) the libraries themselves.  
This means that we have to have the build.xml files out of the box  
with exclusions for these source files. For each one we should  
document which jar files are needed, where they can be obtained, and  
which build.xml file(s) need to be changed to compile the Java files  
that depend on them.

We cannot use nor include libraries licensed with the GPL. The use  
and distribution restrictions are simply too tight and there is no  
way around them. If there is any critical functionality that cannot  
be replaced by using another library or writing a "sane" amount of  
code, we will need to chat about this... One possibility is to start  
an "official" OFBiz-based project that is GPL licensed. We would  
probably host this in our own SVN repository and what not, and it  
would basically consist of probably just one component that can be  
dropped into OFBiz to get the needed functionality.

========================================

Jacopo has started a list of all libraries used in OFBiz and various  
details about them so we can get this started. It is on the Wiki here:

http://ofbizwiki.go-integral.com/Wiki.jsp?page=LibrariesIncludedInOFBiz

We could use some help filling in all of the details, and then we  
will probably create Jira issues for each library (LGPL and GPL  
mainly) that need attention.

========================================

On the technical side for handling LGPL stuff: we need a way to have  
code in the UI layer and such so that it can call LGPL dependent code  
and if it is not there result in a runtime error, but still allow  
everything else to compile and run regardless.

Fortunately we have just such a mechanism! The Service Engine... This  
means that all code that uses an LGPL library should be wrapped in  
and called through a set of services.

========================================

We appreciate everyone's help on this and all of the effort that has  
gone into OFBiz in general and right now particularly in this move  
toward the ASF. For anyone that is not aware of what is happening and  
the discussion that has gone on, it is all very public and available  
in the archives of the [hidden email] mailing list.

-David


 
_______________________________________________
Dev mailing list
[hidden email]
http://lists.ofbiz.org/mailman/listinfo/dev