[
https://issues.apache.org/jira/browse/FINERACT-2572?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18090326#comment-18090326
]
Adam Monsen commented on FINERACT-2572:
---------------------------------------
LGTM.
Dev only should be fine. According to FINERACT-2572, as long as we don't *ship*
[category X drivers|https://www.apache.org/legal/resolved.html#category-x] we
are good. Meaning, they can't be in
{{{}apache-fineract-bin-$VERSION.tar.gz{}}}, and they can only be in the Docker
image if they're added similar to how you might install an OS package (e.g.
{{{}apt-get install libfoo{}}}).
I just ran {{./gradlew srcDistTar binaryDistTar -x test}} and inspected
{{{}fineract-war/build/distributions/apache-fineract-bin-1.15.0-SNAPSHOT.tar.gz{}}}.
That tarball has {{fineract-provider-1.15.0-SNAPSHOT.jar}} and that jar has
only {{{}BOOT-INF/lib/postgresql-42.7.11.jar{}}}. So I think the binary release
will be clean.
To check the Docker image I built with {{./gradlew jibDockerBuild}} then
started a container with
docker run --rm -it --entrypoint sh fineract
I poked around in the container and the only db driver I see is
{{{}/app/libs/postgresql-42.7.11.jar{}}}.
> exclude license-incompatible libraries from distribution artifacts
> ------------------------------------------------------------------
>
> Key: FINERACT-2572
> URL: https://issues.apache.org/jira/browse/FINERACT-2572
> Project: Apache Fineract
> Issue Type: Improvement
> Components: Build
> Affects Versions: 1.14.0
> Reporter: Adam Monsen
> Assignee: Adam Monsen
> Priority: Minor
> Labels: beginner-friendly, licensing, mariadb, mysql
> Fix For: 1.15.0
>
>
> Our fineract-provider war and jar [must not
> include|https://www.apache.org/legal/resolved.html#prohibited] mysql and
> mariadb client libraries.
> ▶️ Exclude spotbugs, mysql and mariadb libraries from everything we
> distribute (e.g. binary release tarball and Docker image). Update
> {{binaryDistTar}} task and anything that task uses/depends on to build the
> binary release tarball.
> ▶️ Review {{war}} and {{bootJar}} tasks. Update only if/as necessary.
> ▶️ Create {{apache-fineract-bin-$VERSION.tar.gz}} and confirm it no longer
> includes spotbugs, mysql and mariadb libraries.
> ▶️ Review Henri's advice in LEGAL-726 and modify generated Docker image
> accordingly. Easiest/safest route (and Adam's recommendation): Exclude
> spotbugs, mysql, and mariadb libraries. Suggest alternatives to run Fineract
> with these
> ([deprecated|https://cwiki.apache.org/confluence/display/FINERACT/FSIP-9%3A+Standardize+on+PostgreSQL])
> RDBMSes, e.g. downloading the client libraries at runtime, building your own
> Docker image, or using Docker volume mounts.
> ▶️ Confirm instructions in top-level readme to separately download and use
> mysql and mariadb client libraries. Update as necessary.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
