2

We are using kie-server-api (Version 7.29.0.Final) and kie-server-client (7.29.0.Final) in one of our microservices:

//Drools - Java API
// https://mvnrepository.com/artifact/org.kie.server/kie-server-api
libraryDependencies += "org.kie.server" % "kie-server-api" % "7.29.0.Final"
// https://mvnrepository.com/artifact/org.kie.server/kie-server-client
libraryDependencies += "org.kie.server" % "kie-server-client" % "7.29.0.Final"

According to Maven both components are licenses under Apache 2.0. In contrast to that our license scanner found issues in these components:enter image description here

How can kie-server-api and kie-server-client be under Apache 2.0 and deep inside there are GPL-components with copy left???

Thank you for an explanation!

Michael

Michael
  • 31
  • 3
  • 2
    I'm not sure if I'm reading the output of your tool right, but does the licenses line indicate that both components are available under multiple different licenses? If so, that could be your answer. However, it seems odd that your tool would flag it unless both licenses were not permissible. Do you permit CDDL and/or GPL v2 with Classpath Exception? Or perhaps the permissability of these aren't defined, which is why it's being flagged. – Thomas Owens Dec 18 '19 at 13:03
  • For the first component (Java Beans...) that's the solution. It is possible to choose between CDDL and GPL v2. For the second line it seams to be a little bit more complicated... – Michael Dec 18 '19 at 14:52
  • As said we solved the JavaBeans issue... Can anyone help with "Java Architecture for XML Binding 2.3. (1.0.1.Final)"??? Our license scanner finds multiple licenses (see above)... Additionally it is not easy to find the git repository or maven link for it.... – Michael Dec 19 '19 at 07:48
  • Further information: org.jboss.spec.javax.xml.bind:jboss-jaxb-api_2.3_spec:1.0.1.Final

    https://mvnrepository.com/artifact/org.jboss.spec.javax.xml.bind/jboss-jaxb-api_2.3_spec

    License EDL 1.0???

     – Michael Dec 19 '19 at 07:54

1 Answers1

1

Digging down into the licensing of the components that make up the latest version of kie-server-api, all the dependencies of the code itself are Apache2, BSD, or MIT-licensed; jaxb-core and jaxb-impl are needed only for testing. We already have a question about the implications of using GPL-licensed components during testing, and I recommend it for your perusal.

The bigger problem here is your licence analysis tool, which doesn't seem very good at determining the exact nature of components - at least, not in the case of kie-server-api. How a piece of copylefted code is used in the production of your software is very important in determining the licensing implications for your software; for example, a piece of code might require a GPL'ed compiler in order to compile, but that almost never means that the resulting executable must be GPL also.

I'm no developer, so I can't shed much more light on exactly how those java components are used in this case, but I think we have good grounds to be suspicious of your automated tool. It might be time to actually start doing some legwork yourself.

MadHatter
  • 48,547
  • 4
  • 122
  • 166
  • Thankx for your answer.

    I think a lawyer has to be involved to discuss the point if test code can infect the rest of the project or not... If I am clear with that either i have to discuss this with FOSSA or not.

    Which automation tool(s) do you use?

     – Michael Jan 09 '20 at 09:58
  • I've linked to our question on the issue of the applicability of the licence of test tools; I don't think you'll get a better answer on this site. As for my tool choice, "I'm no developer", so I don't use any automated licence analysis tools at all - we sysadmins like our code nicely packaged, with all these issues already sorted out! – MadHatter Jan 09 '20 at 10:07
  • The discussion you linked presumes that we can decide weather to ship test coding or not to ship it to our customer. But this is not where we are... The problem mentioned above is hidden deep in a component we plan to ship linked with our coding! – Michael Jan 09 '20 at 14:06
  • As I say in my answer, the GPL/CDDL-licensed components are not built into the shipping package, but are only involved in the testing. I presume you're not shipping your test harness - you certainly don't say you are, and it would be unusual in my experience to do so - so I don't see the issue. – MadHatter Jan 09 '20 at 17:28
  • But Rathat ships testcoding in the libraries mentioned above... And as I said. Our scanner found those components in the Rehat dependency mentioned above. At the moment I can't choose between shipping or not... – Michael Jan 10 '20 at 06:34
  • Digging down into the components of kie-server-api, it shows that all the compile dependencies are non-copylefted; only the test dependencies are GPL. Are you saying that the project is wrong to make this separation, and that you cannot in fact ship the resulting product without the test infrastructure? And if by "RatHat" you mean RedHat, when did they get involved in this? – MadHatter Jan 10 '20 at 07:36
  • "KIE :: Execution Server :: API » 7.30.0.Final" is a REDHAT product. It seems like FOSSA can't make an seperation between "compile dependencies" and "test dependencies". I will scan my code with another tool which scans bytecode-based... – Michael Jan 10 '20 at 11:08
  • Yes, that would be very much the thrust of my answer! Thanks for the clarification on RedHat's authorship of the code. – MadHatter Jan 10 '20 at 23:49