On Thu, Jul 03, 2014 at 02:59:55PM +0200, Hugo Trippaers wrote: > > On to the actual point behind my comment, ASF policy is not very clear > about when we can or can’t put anything in our code that points to > something with a (L)GPL license. I would like some feedback from > people with a finer grasp of the policy to see if we can actually > include this dependency on mysql and the mysql connection in our wix > script. > > Cheers, > > Hugo
This is a bit tricky (and splitting hairs)... Obviously all of this is based on my understanding of past discussions and the relevant policies / licenses... but INAL and certainly not an expert here. Comments / disagreements welcome. In a non-platform specific sense, we have said that the MySQL connector jar file is a *system dependency*. Meaning... for our software to work, it needs to be installed by the user on the system before-hand. We have allowed it to be downloaded in certain maven profiles (specifically, IIRC, developer-centric profiles), as a convenience only (since those profiles aren't required for normal users). For the non-developer profiles, it is expected that mysql connector is already on your system prior to using the software. Above is all about users building from source, based on what we officially release.... Now, we DO provide scripts to help downstream projects and users build packages: Our DEB/RPM packaging scripts *do* reference this dependency. Since the project itself does *not* distribute packages, and since packages are designed to specify *system dependencies*, we believe this satisfies the ASF policies. OpenJDK is also a *system dependency* that we specify in our packages, and nobody would be confused about us expecting java to exist on the target environment for our software to work. (This was discussed with mentors back during incubation, but I can't seem to find the relevant links at the moment.) We do *NOT* include MySQL itself in our package scripts, only the connector. Now, dealing with the whole MSI thing (including the specific review in question, but also looking in other places related to the MSI), we have a different situation. *MySQL Itself* First, we are specifically taking action to download and install MySQL. This has to be taken out IMO, since it's quite a bit different from saying "here's a system package we expect to be there, like java itself". Since Windows doesn't have "package management" that pulls from a central repo, I understand why the download is there... but I'm -1 on it being in a release. *MySQL Connector* I see that we are doing the same thing with the connector in the pom files and the MSI - explicitly pulling it into the system. I'll defer to someone else about the specifics of that in the pom files, because I'm not a maven guy that knows what exactly is ocurring there. Can someone review and talk about how that directive behaves (and compare / contrast with the developer profiles)? In the packaging, same problem as MySQL... we are explicitly downloading GPL code. That also needs to be removed IMO. I'm -1 on that being in the codebase. Unfortunately, I *think* that we need to document MySQL and MySQL Connector.jar installations are being pre-requisites to installing ACS from an MSI. If a *downstream* project / product wants to include them in an installer, fine... but the Apache CloudStack project needs to remove them and add them as documented pre-requisites. -chip
