Hello all. There has been some off-list discussion and research and some preparation to move forward on cleaning up the libraries used in OFBiz and clarify licensing issues. This is something we should have done a long time ago and then kept up over time as it can represent a liability for all users of OFBiz, but right now the driving force behind doing this is to move into compliance with Apache Software Foundation policies. ======================================== Some notes on licenses (after doing a little research): We can use and include libraries licensed with any BSD/MIT like license including Apache, etc. We can also change and redistribute these libraries. We can use and include libraries licensed with SPL (Sun), MPL (Mozilla), and similar licenses. We cannot change these and redistribute the changes though. These are a combination of the GPL and BSD licenses and make a distinction between "Covered Code" and "Larger Works". If we change the code the changes must be SPL/MPL/ whatever licensed, but we can use the libraries unmodified just fine. We can use, but can not include, libraries licensed with LGPL. The licensing quirk here is that we can write code that uses the libraries but can't include (distribute) the libraries themselves. This means that we have to have the build.xml files out of the box with exclusions for these source files. For each one we should document which jar files are needed, where they can be obtained, and which build.xml file(s) need to be changed to compile the Java files that depend on them. We cannot use nor include libraries licensed with the GPL. The use and distribution restrictions are simply too tight and there is no way around them. If there is any critical functionality that cannot be replaced by using another library or writing a "sane" amount of code, we will need to chat about this... One possibility is to start an "official" OFBiz-based project that is GPL licensed. We would probably host this in our own SVN repository and what not, and it would basically consist of probably just one component that can be dropped into OFBiz to get the needed functionality. ======================================== Jacopo has started a list of all libraries used in OFBiz and various details about them so we can get this started. It is on the Wiki here: http://ofbizwiki.go-integral.com/Wiki.jsp?page=LibrariesIncludedInOFBiz We could use some help filling in all of the details, and then we will probably create Jira issues for each library (LGPL and GPL mainly) that need attention. ======================================== On the technical side for handling LGPL stuff: we need a way to have code in the UI layer and such so that it can call LGPL dependent code and if it is not there result in a runtime error, but still allow everything else to compile and run regardless. Fortunately we have just such a mechanism! The Service Engine... This means that all code that uses an LGPL library should be wrapped in and called through a set of services. ======================================== We appreciate everyone's help on this and all of the effort that has gone into OFBiz in general and right now particularly in this move toward the ASF. For anyone that is not aware of what is happening and the discussion that has gone on, it is all very public and available in the archives of the [hidden email] mailing list. -David _______________________________________________ Dev mailing list [hidden email] http://lists.ofbiz.org/mailman/listinfo/dev smime.p7s (3K) Download Attachment |
Free forum by Nabble | Edit this page |