-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Kevan,
You are right. We have a new mechanism for triggering prohibited works. We need to get this to the attention of the legal-discuss folks so they cover that angle in addition to just the "ship" angle that they have looked at so far. Would specifying "<scope>provided</scope>" provided in the pom.xml for mysql be enough to geronimo from downloading mysql when the plugin is installed? I am not that worried about pulling in that jar into our maven repo when we create/build our distribution, as long as we don't ship it. thanks, dims Kevan Miller wrote: | | On Feb 9, 2008, at 2:01 PM, Davanum Srinivas wrote: | |> -----BEGIN PGP SIGNED MESSAGE----- |> Hash: SHA1 |> |> Kevan, |> |> I followed the discussion. You said that "Yes. The automatic download |> is the issue.". I don't think that is the case...I |> believe the "clear guidance" kicks in when we *ship* a distribution |> with some other license on that page. So i thought |> we should get clarification on that point. |> |> related question, Are we at this point picking/shipping either the |> plugin or the mysql jars into our distribution? | | | Hi Dims, | The roller plugins are not included in Geronimo 2.1. We will want to | release the roller plugin at some point. So, will need to clear up this | point before then. | | Thanks for the clarification. So, is this your question? | | **************** | | Is it ok to release an Apache product which will automatically, without | user prompting, download a prohibited work? | | The product in question is the Apache Geronimo roller-mysql-database | plugin which has a dependency on a "prohibited work" (i.e. a MySQL jar | which is GPL with a FLOSS exception). The building of the plugin would | download a MySQL jar into a users maven repository. The MySQL jar would | *not* be included in the Geronimo roller-mysql-database plugin binary. | However, the subsequent installation of this plugin would cause the | Geronimo server to automatically download and install the MySQL jar, | without notifying the user. | | ***************** | | IMO, the answer is no, you can't. Not by default and not without | notifying the user. Am happy to get clarification, if you (or anyone | else) think otherwise or aren't sure... | | I think the basic options are: | | 1. Don't make roller-mysql-database part of the standard build (and | don't release a roller-mysql-database binary). The user can use a | non-standard build option to create the plugin, as long as he/she is | notified. | 2. Make the roller-mysql-database part of the standard build, but remove | the MySQL dependency. This binary can be built and released by our | project. However, the MySQL jar must be installed -- either manually by | the user or by some tool which properly notifies the user. | | --kevan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Cygwin) iD8DBQFHrnrmgNg6eWEDv1kRAvXxAKDLSlpx83vB5a2iEzskKIOt8iIP+wCfdqfn oUFOkxrqEIx5Yl+U2ao04vE= =oWpQ -----END PGP SIGNATURE-----
