Re: [VOTE] Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]

[Huxing Zhang]

Hi,

I vote with:  +1 release the software

 Are release files in correct location? Yes
 Do release files have the word incubating in their name? Yes
 Are the digital signature and hashes correct? Yes
 Does DISCLAIMER file exist? Yes
 Do LICENSE and NOTICE files exists? Yes
 Is the LICENSE and NOTICE text correct? Yes
 Is the NOTICE year correct? Yes
 Un-included software dependencies are not mentioned in LICENSE or NOTICE? Yes
 License information is not mentioned in NOTICE? Yes
Is there any 3rd party code contained inside the release? No

 Do all source files have ASF headers? Yes. some are missing but they
are minor issue.

./dubbo-admin-server/src/main/resources/META-INF/dubbo/internal/org.apache.dubbo.admin.registry.config.GovernanceConfiguration
./dubbo-admin-server/src/main/resources/META-INF/dubbo/internal/org.apache.dubbo.admin.registry.metadata.MetaDataCollector
./DISCLAIMER
./dubbo-admin-ui/.babelrc
./dubbo-admin-ui/.editorconfig
./dubbo-admin-ui/package.json
./dubbo-admin-ui/static/OpenSans.css
./dubbo-admin-ui/.eslintignore
./NOTICE
./codestyle/checkstyle.xml
./.travis.yml

 Do the contents of the release match with what's tagged in version
control? Yes. The following files are within expectation.

Only in incubator-dubbo-admin: .git
Only in incubator-dubbo-admin: .gitignore
Only in incubator-dubbo-admin: .mvn
Only in incubator-dubbo-admin/dubbo-admin-distribution/src: LICENSE
Only in incubator-dubbo-admin/dubbo-admin-distribution/src: NOTICE
Only in incubator-dubbo-admin/dubbo-admin-distribution/src:
bin-distribution-check.sh
Only in incubator-dubbo-admin/dubbo-admin-distribution/src: licenses
Only in incubator-dubbo-admin/dubbo-admin-ui: .gitignore
Only in incubator-dubbo-admin/dubbo-admin-ui/src: .gitrepo
Only in incubator-dubbo-admin/dubbo-admin-ui/src/assets: .gitkeep
Only in incubator-dubbo-admin/dubbo-admin-ui/static: .gitkeep
Only in incubator-dubbo-admin: mvnw
Only in incubator-dubbo-admin: mvnw.cmd

 Are there any unexpected binary files in the release? No.
 Can you compile from source? Are the instruction clear?

I also checked all the dependency under node_module. No license issues.
cd dubbo-admin-ui/node_module
grep -rin --include=**/*LICENSE "GPL" .

I also run bin-distribution-check.sh in the binary distribution, and
the license all look good.

Is the issue minor? Yes
Could it possibly be fixed in the next release? Yes


On Wed, Apr 10, 2019 at 11:51 AM Minxuan Zhuang  wrote:
>
> Hello Dubbo Community,
>
> This is a call for the vote to release Apache Dubbo  Admin(Incubating)
> version 0.2.0
>
> The release candidates(RC3):
> 0.2.0:
> *https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> *
>
> Git tag for this release:
> 0.2.0:  *https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> *
>
> Hash for the release tag:
> 0.2.0: 37e23a7354e3da50914e075eb4676c7c2875ffa7
>
> Release Notes:
> 0.2.0:
> https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
>
> The artifacts have been signed with Key: DA2108479B0C1E71, which can be
> found in
> the keys file:
>
> *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> *
>
> The vote will be open for at least 72 hours or until the necessary number
> of votes are reached.
>
> Please vote accordingly:
>
> [ ] +1 approve
> [ ] +0 no opinion
> [ ] -1 disapprove with the reason
>
> Thanks,
> The Apache Dubbo (Incubating) Team



--
Best Regards！
Huxing

Re: [VOTE] Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]

[Ian Luo]

[v] +1 approve

I checked the following items:

[v] Are release files in correct location?
[v] Do release files have the word incubating in their name?
[v] Are the digital signature and hashes correct?
[v] Does DISCLAIMER file exist?
[v] Do LICENSE and NOTICE files exists?
[v] Is the LICENSE and NOTICE text correct?
[v] Is the NOTICE year correct?
[v] Un-included software dependencies are not mentioned in LICENSE or
NOTICE?
[v] License information is not mentioned in NOTICE?
[x] Is there any 3rd party code contained inside the release?
[v] Do all source files have ASF headers?
[v] Do the contents of the release match with what's tagged in version
control?
[x] Are there any unexpected binary files in the release?
[v] Can you compile from source? Are the instruction clear?

Regards,
-Ian.


On Wed, Apr 10, 2019 at 11:51 AM Minxuan Zhuang  wrote:

> Hello Dubbo Community,
>
> This is a call for the vote to release Apache Dubbo  Admin(Incubating)
> version 0.2.0
>
> The release candidates(RC3):
> 0.2.0:
> *https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
>  >*
>
> Git tag for this release:
> 0.2.0:  *
> https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> *
>
> Hash for the release tag:
> 0.2.0: 37e23a7354e3da50914e075eb4676c7c2875ffa7
>
> Release Notes:
> 0.2.0:
> https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
>
> The artifacts have been signed with Key: DA2108479B0C1E71, which can be
> found in
> the keys file:
>
> *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> *
>
> The vote will be open for at least 72 hours or until the necessary number
> of votes are reached.
>
> Please vote accordingly:
>
> [ ] +1 approve
> [ ] +0 no opinion
> [ ] -1 disapprove with the reason
>
> Thanks,
> The Apache Dubbo (Incubating) Team
>

Re: [VOTE] Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]

[Jun Liu]

+1 to release

I checked:
* both source and binary signatures are good
* both have incubating in name
* DISCLAIMER, LICENSE and NOTICE exists
* All UTs can pass on my Mac OSX with command 'mvn clean test’
* All files has Apache License as header ''mvn clean compile  -Drat.skip=false 
-Dcheckstyle.skip=false’'
* Can deploy and run locally, I checked some pages by opening them in browser, 
all work fine.

Ken

> On Apr 10, 2019, at 11:50 AM, Minxuan Zhuang  wrote:
> 
> Hello Dubbo Community,
> 
> This is a call for the vote to release Apache Dubbo  Admin(Incubating)
> version 0.2.0
> 
> The release candidates(RC3):
> 0.2.0:
> *https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> *
> 
> Git tag for this release:
> 0.2.0:  *https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> *
> 
> Hash for the release tag:
> 0.2.0: 37e23a7354e3da50914e075eb4676c7c2875ffa7
> 
> Release Notes:
> 0.2.0:
> https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> 
> The artifacts have been signed with Key: DA2108479B0C1E71, which can be
> found in
> the keys file:
> 
> *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> *
> 
> The vote will be open for at least 72 hours or until the necessary number
> of votes are reached.
> 
> Please vote accordingly:
> 
> [ ] +1 approve
> [ ] +0 no opinion
> [ ] -1 disapprove with the reason
> 
> Thanks,
> The Apache Dubbo (Incubating) Team

Re: [VOTE] Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]

[Minxuan Zhuang]

We’ve received 3 +1 binding and 0 +1 non-binding votes:

+1 binding, Huxing Zhang
+1 binding, Ian Luo
+1 binding, Jun Liu

I will move to the incubator community voting

On Fri, Apr 12, 2019 at 10:41 AM Jun Liu  wrote:

> +1 to release
>
> I checked:
> * both source and binary signatures are good
> * both have incubating in name
> * DISCLAIMER, LICENSE and NOTICE exists
> * All UTs can pass on my Mac OSX with command 'mvn clean test’
> * All files has Apache License as header ''mvn clean compile
> -Drat.skip=false -Dcheckstyle.skip=false’'
> * Can deploy and run locally, I checked some pages by opening them in
> browser, all work fine.
>
> Ken
>
> > On Apr 10, 2019, at 11:50 AM, Minxuan Zhuang 
> wrote:
> >
> > Hello Dubbo Community,
> >
> > This is a call for the vote to release Apache Dubbo  Admin(Incubating)
> > version 0.2.0
> >
> > The release candidates(RC3):
> > 0.2.0:
> > *
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > <
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> >*
> >
> > Git tag for this release:
> > 0.2.0:  *
> https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > *
> >
> > Hash for the release tag:
> > 0.2.0: 37e23a7354e3da50914e075eb4676c7c2875ffa7
> >
> > Release Notes:
> > 0.2.0:
> > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> >
> > The artifacts have been signed with Key: DA2108479B0C1E71, which can be
> > found in
> > the keys file:
> >
> > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > *
> >
> > The vote will be open for at least 72 hours or until the necessary number
> > of votes are reached.
> >
> > Please vote accordingly:
> >
> > [ ] +1 approve
> > [ ] +0 no opinion
> > [ ] -1 disapprove with the reason
> >
> > Thanks,
> > The Apache Dubbo (Incubating) Team
>
>

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]

[Huxing Zhang]

Hi,

ccing dev@dubbo

On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang  wrote:
>
> Hi，
>
> I just checked the binary release kit, it has the third party
> dependency of LGPL (Hibernate core) which is belonged to Cataloge
> X[1],  it cannot be included in Apache Product.
> I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> fix this issue, I just fill an issue here[2].

I did some dig for this issue and confirm that this is introduced by
this pull request[1].
The purpose of this pull request is to introduce the pagination to
service query.
In this pull request a dependency to spring-boot-starter-data-jpa was added,
which introduce the LGPL licensed dependency hibernate-core.
The detailed dependency tree is shown below:

[INFO] +- 
org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
[INFO] |  +- 
org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
[INFO] |  |  \- org.aspectj:aspectjweaver:jar:1.8.13:compile
[INFO] |  +- 
org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
[INFO] |  |  +- com.zaxxer:HikariCP:jar:2.7.9:compile
[INFO] |  |  \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
[INFO] |  +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
[INFO] |  |  +-
org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
[INFO] |  |  +- antlr:antlr:jar:2.7.7:compile
[INFO] |  |  +- org.jboss:jandex:jar:2.0.3.Final:compile
[INFO] |  |  +- dom4j:dom4j:jar:1.6.1:compile
[INFO] |  |  \-
org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
[INFO] |  +- javax.transaction:javax.transaction-api:jar:1.2:compile
[INFO] |  +- org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
[INFO] |  |  +-
org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
[INFO] |  |  +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
[INFO] |  |  \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
[INFO] |  \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile

Actually the hiberate-core dependency is never used when implementing
the feature,
I think it can be excluded quietly. This is the safest way to solve this issue.
To dig further, the only dependency that required to be added is just
spring-data-commons,
which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
and start correctly with spring-data-commons,
it might need to check more at runtime to ensure everything is working)

We need to be very careful when new dependency is added,  and ensure
all the license (including transitive dependencies) are compatible
with Apache.

The community has identified several similar issues [3][4] for
incubator-dubbo project, and similar actions should be done to
incubator-dubbo-admin as well.

To identify the issue automatically, I run the following command:

mvn license:add-third-party -Dlicense.useMissingFile

and grep the output:

cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt|
grep "General Public License"
 (Eclipse Public License - v 1.0) (GNU Lesser General Public
License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3
- http://logback.qos.ch/logback-classic)
 (Eclipse Public License - v 1.0) (GNU Lesser General Public
License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
http://logback.qos.ch/logback-core)
 (GNU Lesser General Public License) Core Hibernate O/RM
functionality (org.hibernate:hibernate-core:5.2.17.Final -
http://hibernate.org)
 (GNU Lesser General Public License) Hibernate Commons Annotations
(org.hibernate.common:hibernate-commons-annotations:5.0.1.Final -
http://hibernate.org)

The last 2 are both introduced by hibernate-core. A script to check
license issue for dependencies was on the way[5].

[1] https://github.com/apache/incubator-dubbo-admin/pull/324
[2] 
https://github.com/spring-projects/spring-data-commons/blob/master/src/main/resources/license.txt
[3] 
https://lists.apache.org/thread.html/2231c58509842fe4069f2091f00ea7fd5c4e6ae4bf8ce1a97b16e9c5@%3Cdev.dubbo.apache.org%3E
[4] 
https://lists.apache.org/thread.html/e3112c832415850779af2fe04aa7325d8d776144f3939cc63f5eab08@%3Cdev.dubbo.apache.org%3E
[5] https://github.com/apache/incubator-dubbo/issues/3840

>
> [1]https://www.apache.org/legal/resolved.html#category-x
> [2]https://github.com/apache/incubator-dubbo-admin/issues/366
>
> Willem Jiang
>
> Twitter: willemjiang
> Weibo: 姜宁willem
>
> On Mon, Apr 15, 2019 at 10:24 AM Minxuan Zhuang  wrote:
> >
> > Hello Incubator Community,
> >
> > The Apache Dubbo community has voted on and approved a proposal to release
> > Apache Dubbo Admin (Incubating) version 0.2.0.
> >
> > We now kindly request the Incubator PMC members review and vote on this
> > incubator release.
> >
> > Apache Dubbo™ (incubating) is a high-performance, java based, open source
> > RPC framework. Dubbo offers three key functionalities, which include
> > interface based remote cal

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]

[Huxing Zhang]

Hi,

I am thinking why spring-boot-starter-data-jpa depends on LGPL
licensed library "hibernate-core", and can still be Apache 2.0
licensed.
I am reading [1]. In section 5 it says:

A program that contains no derivative of any portion of the Library,
but is designed to work with the Library by being compiled or linked
with it, is called a "work that uses the Library". Such a work, in
isolation, is not a derivative work of the Library, and therefore
falls outside the scope of this License.

I think spring-boot-starter-data-jpa falls in to this case. It is a
"work that uses the Library".

The source code of incubator-dubbo-admin should also falls into this
case, because it does not contain any portion of the hibernate-core.
Based on it and explanation here[2], I think the source code can be
released anyway. Is my understanding correct?

Next, the LGPL license says:

However, linking a "work that uses the Library" with the Library
creates an executable that is a derivative of the Library (because it
contains portions of the Library), rather than a "work that uses the
library". The executable is therefore covered by this License.

The binary distribution of incuabator-dubbo-admin falls into this case
because it creates an executable that contains binary of
hibernate-core. Therefore it is a "work based on the library". As a
derivative of hibernate-core, it must be licensed with LGPL/GPL, which
is not allowed as an Apache product, and eventually causes the
incompatibility.

If my understanding is correct, there are at least 4 ways to solve this issue:
1. Stop distribute the binary of incubator-dubbo-admin
2. Make the feature optional, as explained here[3]
3. Stop depending on hiberante-core
4. Choose other Apache compatible equivalent

I recommend to go with number 3 in my last thread.


[1] https://opensource.org/licenses/LGPL-2.1
[2] https://www.apache.org/legal/resolved.html#prohibited
[3] https://www.apache.org/legal/resolved.html#optional

On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang  wrote:
>
> Hi,
>
> ccing dev@dubbo
>
> On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang  wrote:
> >
> > Hi，
> >
> > I just checked the binary release kit, it has the third party
> > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> > X[1],  it cannot be included in Apache Product.
> > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> > fix this issue, I just fill an issue here[2].
>
> I did some dig for this issue and confirm that this is introduced by
> this pull request[1].
> The purpose of this pull request is to introduce the pagination to
> service query.
> In this pull request a dependency to spring-boot-starter-data-jpa was added,
> which introduce the LGPL licensed dependency hibernate-core.
> The detailed dependency tree is shown below:
>
> [INFO] +- 
> org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> [INFO] |  +- 
> org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> [INFO] |  |  \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> [INFO] |  +- 
> org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> [INFO] |  |  +- com.zaxxer:HikariCP:jar:2.7.9:compile
> [INFO] |  |  \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> [INFO] |  +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> [INFO] |  |  +-
> org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> [INFO] |  |  +- antlr:antlr:jar:2.7.7:compile
> [INFO] |  |  +- org.jboss:jandex:jar:2.0.3.Final:compile
> [INFO] |  |  +- dom4j:dom4j:jar:1.6.1:compile
> [INFO] |  |  \-
> org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> [INFO] |  +- javax.transaction:javax.transaction-api:jar:1.2:compile
> [INFO] |  +- 
> org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> [INFO] |  |  +-
> org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> [INFO] |  |  +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> [INFO] |  |  \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> [INFO] |  \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
>
> Actually the hiberate-core dependency is never used when implementing
> the feature,
> I think it can be excluded quietly. This is the safest way to solve this 
> issue.
> To dig further, the only dependency that required to be added is just
> spring-data-commons,
> which is Apache 2.0 Licensed[2]. (I just confirm the code can compile
> and start correctly with spring-data-commons,
> it might need to check more at runtime to ensure everything is working)
>
> We need to be very careful when new dependency is added,  and ensure
> all the license (including transitive dependencies) are compatible
> with Apache.
>
> The community has identified several similar issues [3][4] for
> incubator-dubbo project, and similar actions should be done to
> incubator-dubbo-admin as well.
>
> To identify the issue automati

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]

[Sheng Wu]

Hi.

> 1. Stop distribute the binary of incubator-dubbo-admin

I think "stop distribute the binary" would NOT change the fact the source
release could lead users to use `hiberante-core`. I doubt this is an option.

Also based on the license issue, you should consider canceling this vote,
and move the further discussion to dev ml.


Sheng Wu 吴晟

Apache SkyWalking, ShardingSphere, Zipkin
Twitter, wusheng1108


Huxing Zhang  于2019年4月21日周日 下午11:02写道：

> Hi,
>
> I am thinking why spring-boot-starter-data-jpa depends on LGPL
> licensed library "hibernate-core", and can still be Apache 2.0
> licensed.
> I am reading [1]. In section 5 it says:
>
> A program that contains no derivative of any portion of the Library,
> but is designed to work with the Library by being compiled or linked
> with it, is called a "work that uses the Library". Such a work, in
> isolation, is not a derivative work of the Library, and therefore
> falls outside the scope of this License.
>
> I think spring-boot-starter-data-jpa falls in to this case. It is a
> "work that uses the Library".
>
> The source code of incubator-dubbo-admin should also falls into this
> case, because it does not contain any portion of the hibernate-core.
> Based on it and explanation here[2], I think the source code can be
> released anyway. Is my understanding correct?
>
> Next, the LGPL license says:
>
> However, linking a "work that uses the Library" with the Library
> creates an executable that is a derivative of the Library (because it
> contains portions of the Library), rather than a "work that uses the
> library". The executable is therefore covered by this License.
>
> The binary distribution of incuabator-dubbo-admin falls into this case
> because it creates an executable that contains binary of
> hibernate-core. Therefore it is a "work based on the library". As a
> derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> is not allowed as an Apache product, and eventually causes the
> incompatibility.
>
> If my understanding is correct, there are at least 4 ways to solve this
> issue:
> 1. Stop distribute the binary of incubator-dubbo-admin
> 2. Make the feature optional, as explained here[3]
> 3. Stop depending on hiberante-core
> 4. Choose other Apache compatible equivalent
>
> I recommend to go with number 3 in my last thread.
>
>
> [1] https://opensource.org/licenses/LGPL-2.1
> [2] https://www.apache.org/legal/resolved.html#prohibited
> [3] https://www.apache.org/legal/resolved.html#optional
>
> On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang  wrote:
> >
> > Hi,
> >
> > ccing dev@dubbo
> >
> > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang 
> wrote:
> > >
> > > Hi，
> > >
> > > I just checked the binary release kit, it has the third party
> > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> > > X[1],  it cannot be included in Apache Product.
> > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> > > fix this issue, I just fill an issue here[2].
> >
> > I did some dig for this issue and confirm that this is introduced by
> > this pull request[1].
> > The purpose of this pull request is to introduce the pagination to
> > service query.
> > In this pull request a dependency to spring-boot-starter-data-jpa was
> added,
> > which introduce the LGPL licensed dependency hibernate-core.
> > The detailed dependency tree is shown below:
> >
> > [INFO] +-
> org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> > [INFO] |  +-
> org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> > [INFO] |  |  \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> > [INFO] |  +-
> org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.2.RELEASE:compile
> > [INFO] |  |  +- com.zaxxer:HikariCP:jar:2.7.9:compile
> > [INFO] |  |  \- org.springframework:spring-jdbc:jar:5.0.6.RELEASE:compile
> > [INFO] |  +- org.hibernate:hibernate-core:jar:5.2.17.Final:compile
> > [INFO] |  |  +-
> >
> org.hibernate.javax.persistence:hibernate-jpa-2.1-api:jar:1.0.0.Final:compile
> > [INFO] |  |  +- antlr:antlr:jar:2.7.7:compile
> > [INFO] |  |  +- org.jboss:jandex:jar:2.0.3.Final:compile
> > [INFO] |  |  +- dom4j:dom4j:jar:1.6.1:compile
> > [INFO] |  |  \-
> >
> org.hibernate.common:hibernate-commons-annotations:jar:5.0.1.Final:compile
> > [INFO] |  +- javax.transaction:javax.transaction-api:jar:1.2:compile
> > [INFO] |  +-
> org.springframework.data:spring-data-jpa:jar:2.0.7.RELEASE:compile
> > [INFO] |  |  +-
> > org.springframework.data:spring-data-commons:jar:2.0.7.RELEASE:compile
> > [INFO] |  |  +- org.springframework:spring-orm:jar:5.0.6.RELEASE:compile
> > [INFO] |  |  \- org.springframework:spring-tx:jar:5.0.6.RELEASE:compile
> > [INFO] |  \- org.springframework:spring-aspects:jar:5.0.6.RELEASE:compile
> >
> > Actually the hiberate-core dependency is never used when implementing
> > the feature,
> > I think it can be excluded quietly. This is the safest way to solve this
> issue.
> > To

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]

[Huxing Zhang]

Hi,

On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu  wrote:
>
> Hi.
>
> > 1. Stop distribute the binary of incubator-dubbo-admin
>
> I think "stop distribute the binary" would NOT change the fact the source
> release could lead users to use `hiberante-core`. I doubt this is an option.

That option is based on my understanding that linking to
"hibernate-core" does not create a derivative work of
"hibernate-core".
Yes, when compiling the source code and run the incubator-dubbo-admin
code, the hibernate-core binary will be included, this
will create a derivative work of "hibernate-core". As long as user do
not distribute it, I think it is fine to use it.
This is the same case as using "spring-boot-starter-data-jpa".
However, it becomes a problem when user want to distributed the
incubator-dubbo-admin binary, it must not be licensed as Apache
license, but should only be GPL/LGPL licensed.
This creates a risk that some user won't use this software because of
the potential license issue, which is not what we want.
So as long as an Apache project does not distribute the binary, IMO it is fine.
That is my understanding of why this is an option. It is not a good
option, but I think it is an option.

>
> Also based on the license issue, you should consider canceling this vote,
> and move the further discussion to dev ml.

I agree that cancel this vote is the safest way for now, before
everything is cleared.

>
>
> Sheng Wu 吴晟
>
> Apache SkyWalking, ShardingSphere, Zipkin
> Twitter, wusheng1108
>
>
> Huxing Zhang  于2019年4月21日周日 下午11:02写道：
>
> > Hi,
> >
> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> > licensed library "hibernate-core", and can still be Apache 2.0
> > licensed.
> > I am reading [1]. In section 5 it says:
> >
> > A program that contains no derivative of any portion of the Library,
> > but is designed to work with the Library by being compiled or linked
> > with it, is called a "work that uses the Library". Such a work, in
> > isolation, is not a derivative work of the Library, and therefore
> > falls outside the scope of this License.
> >
> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> > "work that uses the Library".
> >
> > The source code of incubator-dubbo-admin should also falls into this
> > case, because it does not contain any portion of the hibernate-core.
> > Based on it and explanation here[2], I think the source code can be
> > released anyway. Is my understanding correct?
> >
> > Next, the LGPL license says:
> >
> > However, linking a "work that uses the Library" with the Library
> > creates an executable that is a derivative of the Library (because it
> > contains portions of the Library), rather than a "work that uses the
> > library". The executable is therefore covered by this License.
> >
> > The binary distribution of incuabator-dubbo-admin falls into this case
> > because it creates an executable that contains binary of
> > hibernate-core. Therefore it is a "work based on the library". As a
> > derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> > is not allowed as an Apache product, and eventually causes the
> > incompatibility.
> >
> > If my understanding is correct, there are at least 4 ways to solve this
> > issue:
> > 1. Stop distribute the binary of incubator-dubbo-admin
> > 2. Make the feature optional, as explained here[3]
> > 3. Stop depending on hiberante-core
> > 4. Choose other Apache compatible equivalent
> >
> > I recommend to go with number 3 in my last thread.
> >
> >
> > [1] https://opensource.org/licenses/LGPL-2.1
> > [2] https://www.apache.org/legal/resolved.html#prohibited
> > [3] https://www.apache.org/legal/resolved.html#optional
> >
> > On Sun, Apr 21, 2019 at 10:40 AM Huxing Zhang  wrote:
> > >
> > > Hi,
> > >
> > > ccing dev@dubbo
> > >
> > > On Fri, Apr 19, 2019 at 8:24 AM Willem Jiang 
> > wrote:
> > > >
> > > > Hi，
> > > >
> > > > I just checked the binary release kit, it has the third party
> > > > dependency of LGPL (Hibernate core) which is belonged to Cataloge
> > > > X[1],  it cannot be included in Apache Product.
> > > > I had to vote -1 for it. We can change the ORM lib to Eclipse Link to
> > > > fix this issue, I just fill an issue here[2].
> > >
> > > I did some dig for this issue and confirm that this is introduced by
> > > this pull request[1].
> > > The purpose of this pull request is to introduce the pagination to
> > > service query.
> > > In this pull request a dependency to spring-boot-starter-data-jpa was
> > added,
> > > which introduce the LGPL licensed dependency hibernate-core.
> > > The detailed dependency tree is shown below:
> > >
> > > [INFO] +-
> > org.springframework.boot:spring-boot-starter-data-jpa:jar:2.0.2.RELEASE:compile
> > > [INFO] |  +-
> > org.springframework.boot:spring-boot-starter-aop:jar:2.0.2.RELEASE:compile
> > > [INFO] |  |  \- org.aspectj:aspectjweaver:jar:1.8.13:compile
> > > [INFO] |  +-
> > org.springframework.boot:spring-boot-starter-jdbc:jar:2.0.

Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]

[Huxing Zhang]

Hi,

On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94  wrote:
>
> Hi All,
>   I've excluded the `hibernate-core` dependency and verified as follows:
>
>
> $ mvn license:add-third-party -Dlicense.useMissingFile
> $ cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | 
> grep "General Public License"
>
>
> here is the output
>
>
>  (Eclipse Public License - v 1.0) (GNU Lesser General Public License) 
> Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 - 
> http://logback.qos.ch/logback-classic)
>  (Eclipse Public License - v 1.0) (GNU Lesser General Public License) 
> Logback Core Module (ch.qos.logback:logback-core:1.2.3 - 
> http://logback.qos.ch/logback-core)
>

These are dual licensed dependencies, so we can choose the most
permissive one. In this case EPL is compatible with Apache so no issue
here.
Be aware that General Public License is just on of the keyword, other
keywords might also be check like GPL.

>
> also, I've tested that the functionality introduced together with this 
> dependency[1] works well.
>
>
> I'll check the license next time when I need to introduce new dependencies.
> [1] https://github.com/apache/incubator-dubbo-admin/pull/324
>
>
> Thanks
>
>
> At 2019-04-22 10:17:43, "Huxing Zhang"  wrote:
> >Hi,
> >
> >On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu  wrote:
> >>
> >> Hi.
> >>
> >> > 1. Stop distribute the binary of incubator-dubbo-admin
> >>
> >> I think "stop distribute the binary" would NOT change the fact the source
> >> release could lead users to use `hiberante-core`. I doubt this is an 
> >> option.
> >
> >That option is based on my understanding that linking to
> >"hibernate-core" does not create a derivative work of
> >"hibernate-core".
> >Yes, when compiling the source code and run the incubator-dubbo-admin
> >code, the hibernate-core binary will be included, this
> >will create a derivative work of "hibernate-core". As long as user do
> >not distribute it, I think it is fine to use it.
> >This is the same case as using "spring-boot-starter-data-jpa".
> >However, it becomes a problem when user want to distributed the
> >incubator-dubbo-admin binary, it must not be licensed as Apache
> >license, but should only be GPL/LGPL licensed.
> >This creates a risk that some user won't use this software because of
> >the potential license issue, which is not what we want.
> >So as long as an Apache project does not distribute the binary, IMO it is 
> >fine.
> >That is my understanding of why this is an option. It is not a good
> >option, but I think it is an option.
> >
> >>
> >> Also based on the license issue, you should consider canceling this vote,
> >> and move the further discussion to dev ml.
> >
> >I agree that cancel this vote is the safest way for now, before
> >everything is cleared.
> >
> >>
> >>
> >> Sheng Wu 吴晟
> >>
> >> Apache SkyWalking, ShardingSphere, Zipkin
> >> Twitter, wusheng1108
> >>
> >>
> >> Huxing Zhang  于2019年4月21日周日 下午11:02写道：
> >>
> >> > Hi,
> >> >
> >> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> >> > licensed library "hibernate-core", and can still be Apache 2.0
> >> > licensed.
> >> > I am reading [1]. In section 5 it says:
> >> >
> >> > A program that contains no derivative of any portion of the Library,
> >> > but is designed to work with the Library by being compiled or linked
> >> > with it, is called a "work that uses the Library". Such a work, in
> >> > isolation, is not a derivative work of the Library, and therefore
> >> > falls outside the scope of this License.
> >> >
> >> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> >> > "work that uses the Library".
> >> >
> >> > The source code of incubator-dubbo-admin should also falls into this
> >> > case, because it does not contain any portion of the hibernate-core.
> >> > Based on it and explanation here[2], I think the source code can be
> >> > released anyway. Is my understanding correct?
> >> >
> >> > Next, the LGPL license says:
> >> >
> >> > However, linking a "work that uses the Library" with the Library
> >> > creates an executable that is a derivative of the Library (because it
> >> > contains portions of the Library), rather than a "work that uses the
> >> > library". The executable is therefore covered by this License.
> >> >
> >> > The binary distribution of incuabator-dubbo-admin falls into this case
> >> > because it creates an executable that contains binary of
> >> > hibernate-core. Therefore it is a "work based on the library". As a
> >> > derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> >> > is not allowed as an Apache product, and eventually causes the
> >> > incompatibility.
> >> >
> >> > If my understanding is correct, there are at least 4 ways to solve this
> >> > issue:
> >> > 1. Stop distribute the binary of incubator-dubbo-admin
> >> > 2. Make the feature optional, as explained here[3]
> >> > 3. Stop depending on hiberante-core
> >> > 4. Choose other Apache compatible equi

Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]

[Minxuan Zhuang]

Hi, this LGPL License issue has been fixed, thanks kezhenxu94, I'll cancel
this vote and start a new one

On Mon, Apr 22, 2019 at 3:09 PM Huxing Zhang  wrote:

> Hi,
>
> On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94  wrote:
> >
> > Hi All,
> >   I've excluded the `hibernate-core` dependency and verified as follows:
> >
> >
> > $ mvn license:add-third-party -Dlicense.useMissingFile
> > $ cat
> dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep
> "General Public License"
> >
> >
> > here is the output
> >
> >
> >  (Eclipse Public License - v 1.0) (GNU Lesser General Public
> License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 -
> http://logback.qos.ch/logback-classic)
> >  (Eclipse Public License - v 1.0) (GNU Lesser General Public
> License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> http://logback.qos.ch/logback-core)
> >
>
> These are dual licensed dependencies, so we can choose the most
> permissive one. In this case EPL is compatible with Apache so no issue
> here.
> Be aware that General Public License is just on of the keyword, other
> keywords might also be check like GPL.
>
> >
> > also, I've tested that the functionality introduced together with this
> dependency[1] works well.
> >
> >
> > I'll check the license next time when I need to introduce new
> dependencies.
> > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> >
> >
> > Thanks
> >
> >
> > At 2019-04-22 10:17:43, "Huxing Zhang"  wrote:
> > >Hi,
> > >
> > >On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu 
> wrote:
> > >>
> > >> Hi.
> > >>
> > >> > 1. Stop distribute the binary of incubator-dubbo-admin
> > >>
> > >> I think "stop distribute the binary" would NOT change the fact the
> source
> > >> release could lead users to use `hiberante-core`. I doubt this is an
> option.
> > >
> > >That option is based on my understanding that linking to
> > >"hibernate-core" does not create a derivative work of
> > >"hibernate-core".
> > >Yes, when compiling the source code and run the incubator-dubbo-admin
> > >code, the hibernate-core binary will be included, this
> > >will create a derivative work of "hibernate-core". As long as user do
> > >not distribute it, I think it is fine to use it.
> > >This is the same case as using "spring-boot-starter-data-jpa".
> > >However, it becomes a problem when user want to distributed the
> > >incubator-dubbo-admin binary, it must not be licensed as Apache
> > >license, but should only be GPL/LGPL licensed.
> > >This creates a risk that some user won't use this software because of
> > >the potential license issue, which is not what we want.
> > >So as long as an Apache project does not distribute the binary, IMO it
> is fine.
> > >That is my understanding of why this is an option. It is not a good
> > >option, but I think it is an option.
> > >
> > >>
> > >> Also based on the license issue, you should consider canceling this
> vote,
> > >> and move the further discussion to dev ml.
> > >
> > >I agree that cancel this vote is the safest way for now, before
> > >everything is cleared.
> > >
> > >>
> > >>
> > >> Sheng Wu 吴晟
> > >>
> > >> Apache SkyWalking, ShardingSphere, Zipkin
> > >> Twitter, wusheng1108
> > >>
> > >>
> > >> Huxing Zhang  于2019年4月21日周日 下午11:02写道：
> > >>
> > >> > Hi,
> > >> >
> > >> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> > >> > licensed library "hibernate-core", and can still be Apache 2.0
> > >> > licensed.
> > >> > I am reading [1]. In section 5 it says:
> > >> >
> > >> > A program that contains no derivative of any portion of the Library,
> > >> > but is designed to work with the Library by being compiled or linked
> > >> > with it, is called a "work that uses the Library". Such a work, in
> > >> > isolation, is not a derivative work of the Library, and therefore
> > >> > falls outside the scope of this License.
> > >> >
> > >> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> > >> > "work that uses the Library".
> > >> >
> > >> > The source code of incubator-dubbo-admin should also falls into this
> > >> > case, because it does not contain any portion of the hibernate-core.
> > >> > Based on it and explanation here[2], I think the source code can be
> > >> > released anyway. Is my understanding correct?
> > >> >
> > >> > Next, the LGPL license says:
> > >> >
> > >> > However, linking a "work that uses the Library" with the Library
> > >> > creates an executable that is a derivative of the Library (because
> it
> > >> > contains portions of the Library), rather than a "work that uses the
> > >> > library". The executable is therefore covered by this License.
> > >> >
> > >> > The binary distribution of incuabator-dubbo-admin falls into this
> case
> > >> > because it creates an executable that contains binary of
> > >> > hibernate-core. Therefore it is a "work based on the library". As a
> > >> > derivative of hibernate-core, it must be licensed with LGPL/GPL,
> which
> > >> > is n

Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]

[Huxing Zhang]

Hi,


On Mon, Apr 22, 2019 at 4:08 PM Minxuan Zhuang  wrote:
>
> Hi, this LGPL License issue has been fixed, thanks kezhenxu94, I'll cancel
> this vote and start a new one

Could you please cancel it on general@ as well?

>
> On Mon, Apr 22, 2019 at 3:09 PM Huxing Zhang  wrote:
>
> > Hi,
> >
> > On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94  wrote:
> > >
> > > Hi All,
> > >   I've excluded the `hibernate-core` dependency and verified as follows:
> > >
> > >
> > > $ mvn license:add-third-party -Dlicense.useMissingFile
> > > $ cat
> > dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | grep
> > "General Public License"
> > >
> > >
> > > here is the output
> > >
> > >
> > >  (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > License) Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 -
> > http://logback.qos.ch/logback-classic)
> > >  (Eclipse Public License - v 1.0) (GNU Lesser General Public
> > License) Logback Core Module (ch.qos.logback:logback-core:1.2.3 -
> > http://logback.qos.ch/logback-core)
> > >
> >
> > These are dual licensed dependencies, so we can choose the most
> > permissive one. In this case EPL is compatible with Apache so no issue
> > here.
> > Be aware that General Public License is just on of the keyword, other
> > keywords might also be check like GPL.
> >
> > >
> > > also, I've tested that the functionality introduced together with this
> > dependency[1] works well.
> > >
> > >
> > > I'll check the license next time when I need to introduce new
> > dependencies.
> > > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> > >
> > >
> > > Thanks
> > >
> > >
> > > At 2019-04-22 10:17:43, "Huxing Zhang"  wrote:
> > > >Hi,
> > > >
> > > >On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu 
> > wrote:
> > > >>
> > > >> Hi.
> > > >>
> > > >> > 1. Stop distribute the binary of incubator-dubbo-admin
> > > >>
> > > >> I think "stop distribute the binary" would NOT change the fact the
> > source
> > > >> release could lead users to use `hiberante-core`. I doubt this is an
> > option.
> > > >
> > > >That option is based on my understanding that linking to
> > > >"hibernate-core" does not create a derivative work of
> > > >"hibernate-core".
> > > >Yes, when compiling the source code and run the incubator-dubbo-admin
> > > >code, the hibernate-core binary will be included, this
> > > >will create a derivative work of "hibernate-core". As long as user do
> > > >not distribute it, I think it is fine to use it.
> > > >This is the same case as using "spring-boot-starter-data-jpa".
> > > >However, it becomes a problem when user want to distributed the
> > > >incubator-dubbo-admin binary, it must not be licensed as Apache
> > > >license, but should only be GPL/LGPL licensed.
> > > >This creates a risk that some user won't use this software because of
> > > >the potential license issue, which is not what we want.
> > > >So as long as an Apache project does not distribute the binary, IMO it
> > is fine.
> > > >That is my understanding of why this is an option. It is not a good
> > > >option, but I think it is an option.
> > > >
> > > >>
> > > >> Also based on the license issue, you should consider canceling this
> > vote,
> > > >> and move the further discussion to dev ml.
> > > >
> > > >I agree that cancel this vote is the safest way for now, before
> > > >everything is cleared.
> > > >
> > > >>
> > > >>
> > > >> Sheng Wu 吴晟
> > > >>
> > > >> Apache SkyWalking, ShardingSphere, Zipkin
> > > >> Twitter, wusheng1108
> > > >>
> > > >>
> > > >> Huxing Zhang  于2019年4月21日周日 下午11:02写道：
> > > >>
> > > >> > Hi,
> > > >> >
> > > >> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> > > >> > licensed library "hibernate-core", and can still be Apache 2.0
> > > >> > licensed.
> > > >> > I am reading [1]. In section 5 it says:
> > > >> >
> > > >> > A program that contains no derivative of any portion of the Library,
> > > >> > but is designed to work with the Library by being compiled or linked
> > > >> > with it, is called a "work that uses the Library". Such a work, in
> > > >> > isolation, is not a derivative work of the Library, and therefore
> > > >> > falls outside the scope of this License.
> > > >> >
> > > >> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> > > >> > "work that uses the Library".
> > > >> >
> > > >> > The source code of incubator-dubbo-admin should also falls into this
> > > >> > case, because it does not contain any portion of the hibernate-core.
> > > >> > Based on it and explanation here[2], I think the source code can be
> > > >> > released anyway. Is my understanding correct?
> > > >> >
> > > >> > Next, the LGPL license says:
> > > >> >
> > > >> > However, linking a "work that uses the Library" with the Library
> > > >> > creates an executable that is a derivative of the Library (because
> > it
> > > >> > contains portions of the Library), rather than a "work that uses the
> > > >> > library". The executable 

Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]

[Willem Jiang]

I think we could put it into the wiki page to let other community
developers know about the policy.
BTW, we could also put the license check into the checklist of release
candidate.

Willem Jiang

Twitter: willemjiang
Weibo: 姜宁willem

On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94  wrote:
>
> Hi All,
>   I've excluded the `hibernate-core` dependency and verified as follows:
>
>
> $ mvn license:add-third-party -Dlicense.useMissingFile
> $ cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | 
> grep "General Public License"
>
>
> here is the output
>
>
>  (Eclipse Public License - v 1.0) (GNU Lesser General Public License) 
> Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 - 
> http://logback.qos.ch/logback-classic)
>  (Eclipse Public License - v 1.0) (GNU Lesser General Public License) 
> Logback Core Module (ch.qos.logback:logback-core:1.2.3 - 
> http://logback.qos.ch/logback-core)
>
>
> also, I've tested that the functionality introduced together with this 
> dependency[1] works well.
>
>
> I'll check the license next time when I need to introduce new dependencies.
> [1] https://github.com/apache/incubator-dubbo-admin/pull/324
>
>
> Thanks
>
>
> At 2019-04-22 10:17:43, "Huxing Zhang"  wrote:
> >Hi,
> >
> >On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu  wrote:
> >>
> >> Hi.
> >>
> >> > 1. Stop distribute the binary of incubator-dubbo-admin
> >>
> >> I think "stop distribute the binary" would NOT change the fact the source
> >> release could lead users to use `hiberante-core`. I doubt this is an 
> >> option.
> >
> >That option is based on my understanding that linking to
> >"hibernate-core" does not create a derivative work of
> >"hibernate-core".
> >Yes, when compiling the source code and run the incubator-dubbo-admin
> >code, the hibernate-core binary will be included, this
> >will create a derivative work of "hibernate-core". As long as user do
> >not distribute it, I think it is fine to use it.
> >This is the same case as using "spring-boot-starter-data-jpa".
> >However, it becomes a problem when user want to distributed the
> >incubator-dubbo-admin binary, it must not be licensed as Apache
> >license, but should only be GPL/LGPL licensed.
> >This creates a risk that some user won't use this software because of
> >the potential license issue, which is not what we want.
> >So as long as an Apache project does not distribute the binary, IMO it is 
> >fine.
> >That is my understanding of why this is an option. It is not a good
> >option, but I think it is an option.
> >
> >>
> >> Also based on the license issue, you should consider canceling this vote,
> >> and move the further discussion to dev ml.
> >
> >I agree that cancel this vote is the safest way for now, before
> >everything is cleared.
> >
> >>
> >>
> >> Sheng Wu 吴晟
> >>
> >> Apache SkyWalking, ShardingSphere, Zipkin
> >> Twitter, wusheng1108
> >>
> >>
> >> Huxing Zhang  于2019年4月21日周日 下午11:02写道：
> >>
> >> > Hi,
> >> >
> >> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> >> > licensed library "hibernate-core", and can still be Apache 2.0
> >> > licensed.
> >> > I am reading [1]. In section 5 it says:
> >> >
> >> > A program that contains no derivative of any portion of the Library,
> >> > but is designed to work with the Library by being compiled or linked
> >> > with it, is called a "work that uses the Library". Such a work, in
> >> > isolation, is not a derivative work of the Library, and therefore
> >> > falls outside the scope of this License.
> >> >
> >> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> >> > "work that uses the Library".
> >> >
> >> > The source code of incubator-dubbo-admin should also falls into this
> >> > case, because it does not contain any portion of the hibernate-core.
> >> > Based on it and explanation here[2], I think the source code can be
> >> > released anyway. Is my understanding correct?
> >> >
> >> > Next, the LGPL license says:
> >> >
> >> > However, linking a "work that uses the Library" with the Library
> >> > creates an executable that is a derivative of the Library (because it
> >> > contains portions of the Library), rather than a "work that uses the
> >> > library". The executable is therefore covered by this License.
> >> >
> >> > The binary distribution of incuabator-dubbo-admin falls into this case
> >> > because it creates an executable that contains binary of
> >> > hibernate-core. Therefore it is a "work based on the library". As a
> >> > derivative of hibernate-core, it must be licensed with LGPL/GPL, which
> >> > is not allowed as an Apache product, and eventually causes the
> >> > incompatibility.
> >> >
> >> > If my understanding is correct, there are at least 4 ways to solve this
> >> > issue:
> >> > 1. Stop distribute the binary of incubator-dubbo-admin
> >> > 2. Make the feature optional, as explained here[3]
> >> > 3. Stop depending on hiberante-core
> >> > 4. Choose other Apache compatible equivalent
> >> >
> >> > I

Re: Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC3]

[Huxing Zhang]

Hi,

On Tue, Apr 23, 2019 at 9:54 AM Willem Jiang  wrote:
>
> I think we could put it into the wiki page to let other community
> developers know about the policy.
> BTW, we could also put the license check into the checklist of release
> candidate.

I've already added to release guide:
https://github.com/apache/incubator-dubbo-website/blob/asf-site/docs/en-us/developers/committer-guide/release-guide_dev.md#check-third-party-dependencies

>
> Willem Jiang
>
> Twitter: willemjiang
> Weibo: 姜宁willem
>
> On Mon, Apr 22, 2019 at 1:38 PM kezhenxu94  wrote:
> >
> > Hi All,
> >   I've excluded the `hibernate-core` dependency and verified as follows:
> >
> >
> > $ mvn license:add-third-party -Dlicense.useMissingFile
> > $ cat dubbo-admin-server/target/generated-sources/license/THIRD-PARTY.txt | 
> > grep "General Public License"
> >
> >
> > here is the output
> >
> >
> >  (Eclipse Public License - v 1.0) (GNU Lesser General Public License) 
> > Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 - 
> > http://logback.qos.ch/logback-classic)
> >  (Eclipse Public License - v 1.0) (GNU Lesser General Public License) 
> > Logback Core Module (ch.qos.logback:logback-core:1.2.3 - 
> > http://logback.qos.ch/logback-core)
> >
> >
> > also, I've tested that the functionality introduced together with this 
> > dependency[1] works well.
> >
> >
> > I'll check the license next time when I need to introduce new dependencies.
> > [1] https://github.com/apache/incubator-dubbo-admin/pull/324
> >
> >
> > Thanks
> >
> >
> > At 2019-04-22 10:17:43, "Huxing Zhang"  wrote:
> > >Hi,
> > >
> > >On Sun, Apr 21, 2019 at 11:11 PM Sheng Wu  
> > >wrote:
> > >>
> > >> Hi.
> > >>
> > >> > 1. Stop distribute the binary of incubator-dubbo-admin
> > >>
> > >> I think "stop distribute the binary" would NOT change the fact the source
> > >> release could lead users to use `hiberante-core`. I doubt this is an 
> > >> option.
> > >
> > >That option is based on my understanding that linking to
> > >"hibernate-core" does not create a derivative work of
> > >"hibernate-core".
> > >Yes, when compiling the source code and run the incubator-dubbo-admin
> > >code, the hibernate-core binary will be included, this
> > >will create a derivative work of "hibernate-core". As long as user do
> > >not distribute it, I think it is fine to use it.
> > >This is the same case as using "spring-boot-starter-data-jpa".
> > >However, it becomes a problem when user want to distributed the
> > >incubator-dubbo-admin binary, it must not be licensed as Apache
> > >license, but should only be GPL/LGPL licensed.
> > >This creates a risk that some user won't use this software because of
> > >the potential license issue, which is not what we want.
> > >So as long as an Apache project does not distribute the binary, IMO it is 
> > >fine.
> > >That is my understanding of why this is an option. It is not a good
> > >option, but I think it is an option.
> > >
> > >>
> > >> Also based on the license issue, you should consider canceling this vote,
> > >> and move the further discussion to dev ml.
> > >
> > >I agree that cancel this vote is the safest way for now, before
> > >everything is cleared.
> > >
> > >>
> > >>
> > >> Sheng Wu 吴晟
> > >>
> > >> Apache SkyWalking, ShardingSphere, Zipkin
> > >> Twitter, wusheng1108
> > >>
> > >>
> > >> Huxing Zhang  于2019年4月21日周日 下午11:02写道：
> > >>
> > >> > Hi,
> > >> >
> > >> > I am thinking why spring-boot-starter-data-jpa depends on LGPL
> > >> > licensed library "hibernate-core", and can still be Apache 2.0
> > >> > licensed.
> > >> > I am reading [1]. In section 5 it says:
> > >> >
> > >> > A program that contains no derivative of any portion of the Library,
> > >> > but is designed to work with the Library by being compiled or linked
> > >> > with it, is called a "work that uses the Library". Such a work, in
> > >> > isolation, is not a derivative work of the Library, and therefore
> > >> > falls outside the scope of this License.
> > >> >
> > >> > I think spring-boot-starter-data-jpa falls in to this case. It is a
> > >> > "work that uses the Library".
> > >> >
> > >> > The source code of incubator-dubbo-admin should also falls into this
> > >> > case, because it does not contain any portion of the hibernate-core.
> > >> > Based on it and explanation here[2], I think the source code can be
> > >> > released anyway. Is my understanding correct?
> > >> >
> > >> > Next, the LGPL license says:
> > >> >
> > >> > However, linking a "work that uses the Library" with the Library
> > >> > creates an executable that is a derivative of the Library (because it
> > >> > contains portions of the Library), rather than a "work that uses the
> > >> > library". The executable is therefore covered by this License.
> > >> >
> > >> > The binary distribution of incuabator-dubbo-admin falls into this case
> > >> > because it creates an executable that contains binary of
> > >> > hibernate-core. Therefore it is a "work based on the library". As a
>