Skip to main content

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [iam-dev] Re: [technology-pmc] Eclipse IAM: Possible need for 3rd party dependency approval

Hey Eugene

Eugene Kuleshov wrote:
Jeff McAffer wrote:
If there is something in Maven that says that all archetypes in a repo have the same license and Maven asks the user to agree to the license for that repo when adding the repo then yes.
 I don't think there is any such thing in Maven
Otherwise, this is jumping the gun IMHO. Its like saying, enter a URL and then assuming that because the user entered the URL they are giving you implicit consent to agree to all licenses on all things in that repo.
Jeff, if I follow your logic, we have pretty much the same situation with CVS plugin distributed with Eclipse Platform. So, user can enter an CVS url and then checkout some projects with gazillion of dependencies and custom builders configured to run on JDT build. But there was not any license confirmation or anything in the CVS project checkout UI.
INAL but I think there si a difference here in that one is downloading source that the user will then see the license for (e.g., in the copyright headers) and is not yet shipping vs. downloading binary that is then combined with existing binaries and used/run. if this were not true then we would not be asking the license questions we ask in p2.
Of course do not support or encourage installing anything without the user consent. It was my perception that by providing the information to identify the archetype/artifact the user was already allowing access. You summarized it perfectly above.
While I am not that familiar with Maven, someone saying that they want to have a Foo is not equivalent to them saying, "hey I am ok with you installing GPL code". The if you are getting something on the user's behalf then the user should know about and be agreeing to the licenses. If this is the case then there should not be an issue with the repository since it is just another place to get stuff. The list of "known repos" should be open, modifiable/extensible but beyond that I don't see an IP issue.

of course, I could be completely off base here ...
Generally, all artifacts in Maven repositories have license placeholder (and artifacts that came from the Maven namespace are all APL licensed). The archetype license could be shown to the user, but as a user I think I will find it quite annoying if license confirmation would be shown to me every time I need to create project. Just imagine that new Java project wizard would ask you to confirm the EPL license every time. :-)
I'm not saying anything about how, when or how many times the license notice is show to the user except that how many >= 1 and when = before the licensed code is installed. Presumably you do not download/install the plugins for each project so doing it once the first time you encounter each plugin should be sufficient.

Sidenote: Ultimately it is likely out of scope for the IP team to mandate that you do this workflow whoever without this function there are quite some number of development shops that will not accept Maven tooling. There is a reason we have to ask the license questions that are asked in p2. It was driven by people wanting to ensure that the dev team knew the licenses for the tools they were using. Take these comments as you will.


Back to the top