+dev <[email protected]> On Thu, May 28, 2020 at 11:55 AM Ken Barr <[email protected]> wrote:
> I am currently developing an IO that I would like to eventually submit to > Apache Beam project. The IO itself is Apache2.0 licensed. > Does every chained dependency I use need to be opensource? > The transitive dependency tree must have licenses from ASFs approved license list. See https://www.apache.org/legal/resolved.html for all the details. > If yes, how is this usually proven? > Typically the reviewer will ask you to provide the dependency tree and the licenses of those dependencies if the reviewer doesn't do this themselves or recognize the dependency itself. The reviewer will validate any information that you provide. > Is it enough that only Maven dependencies are used? > No.
