[
https://issues.apache.org/jira/browse/HDFS-11161?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18068592#comment-18068592
]
ASF GitHub Bot commented on HDFS-11161:
---------------------------------------
yangdong2398 commented on PR #8347:
URL: https://github.com/apache/hadoop/pull/8347#issuecomment-4133580524
> @yangdong2398 I have conducted some analysis on the dependencies of this
module with cc and summarized them as follows:
>
> ## Compile-Scope Dependency Tree
> ```
> org.apache.hadoop:hadoop-bos:3.6.0-SNAPSHOT
> └── com.baidubce:bce-java-sdk:0.10.330
> ├── org.apache.commons:commons-lang3:3.18.0
> ├── org.slf4j:slf4j-api:1.7.36
> ├── commons-codec:commons-codec:1.15
> ├── commons-io:commons-io:2.16.1
> ├── org.apache.httpcomponents:httpasyncclient:4.0.2
> │ ├── org.apache.httpcomponents:httpcore:4.4.13
> │ ├── org.apache.httpcomponents:httpcore-nio:4.3.2
> │ ├── org.apache.httpcomponents:httpclient:4.5.13
> │ └── commons-logging:commons-logging:1.3.0
> ├── joda-time:joda-time:2.3
> ├── org.eclipse.paho:org.eclipse.paho.client.mqttv3:1.2.1
> ├── javax.validation:validation-api:1.1.0.Final
> └── org.bouncycastle:bcprov-jdk15on:1.59
> ```
>
> ## License Summary
> Artifact Version License ASF Category APL 2.0?
> com.baidubce:bce-java-sdk 0.10.330 Apache License 2.0 A
Yes
> org.apache.commons:commons-lang3 3.18.0 Apache License 2.0 A
Yes
> org.slf4j:slf4j-api 1.7.36 MIT License A Compatible
> commons-codec:commons-codec 1.15 Apache License 2.0 A
Yes
> commons-io:commons-io 2.16.1 Apache License 2.0 A Yes
> org.apache.httpcomponents:httpasyncclient 4.0.2 Apache License 2.0
A Yes
> org.apache.httpcomponents:httpcore 4.4.13 Apache License 2.0 A
Yes
> org.apache.httpcomponents:httpcore-nio 4.3.2 Apache License 2.0
A Yes
> org.apache.httpcomponents:httpclient 4.5.13 Apache License 2.0
A Yes
> commons-logging:commons-logging 1.3.0 Apache License 2.0 A
Yes
> joda-time:joda-time 2.3 Apache License 2.0 A Yes
> **org.eclipse.paho:org.eclipse.paho.client.mqttv3** **1.2.1**
**EPL 1.0 / EDL 1.0** **B** **No**
> javax.validation:validation-api 1.1.0.Final Apache License 2.0
A Yes
> org.bouncycastle:bcprov-jdk15on 1.59 MIT License (Bouncy Castle
Licence) A Compatible
> **Result:** 12 of 14 dependencies are Apache License 2.0. Two (slf4j-api,
bcprov-jdk15on) are MIT — ASF Category A, fully compatible. **One dependency
(`org.eclipse.paho:org.eclipse.paho.client.mqttv3`) is EPL 1.0 — ASF Category
B, requiring special handling.**
>
> ## Open-Source License Risks
> ### Risk 1: `org.eclipse.paho:org.eclipse.paho.client.mqttv3:1.2.1` — EPL
1.0 (ASF Category B)
> **JAR:** `org.eclipse.paho.client.mqttv3-1.2.1.jar`
>
> **Risk:** This library is dual-licensed under **EPL 1.0** (Eclipse Public
License) and **EDL 1.0** (Eclipse Distribution License / BSD-3-Clause). EPL 1.0
is classified as **ASF Category B** — weak copyleft. Per [ASF third-party
licensing policy](https://www.apache.org/legal/resolved.html):
>
> * Category B dependencies **must not** appear in source releases
> * Category B dependencies **may** appear in binary distributions, but
**must** be prominently labeled in `LICENSE-binary` and/or `NOTICE-binary`
> * The PR description claims _"No changes required to LICENSE,
LICENSE-binary, or NOTICE-binary files as dependencies are shaded and not
exposed in distribution"_ — **this is incorrect**. Shading does not eliminate
licensing obligations; the EPL-licensed bytecode is still present in the shaded
JAR
>
> **How to address (Option A — Preferred):** Exclude the dependency in
`pom.xml`. This is an MQTT client library with no obvious relevance to a Baidu
Object Storage connector — it is almost certainly an unused transitive
dependency of `bce-java-sdk`:
>
> ```
> <dependency>
> <groupId>com.baidubce</groupId>
> <artifactId>bce-java-sdk</artifactId>
> <version>${bce-java-sdk.version}</version>
> <exclusions>
> <!
> Incorporate Baidu Yun BOS file system implementation
> ----------------------------------------------------
>
> Key: HDFS-11161
> URL: https://issues.apache.org/jira/browse/HDFS-11161
> Project: Hadoop HDFS
> Issue Type: New Feature
> Components: fs
> Reporter: Faen Zhang
> Priority: Major
> Labels: pull-request-available
> Original Estimate: 840h
> Remaining Estimate: 840h
>
> Baidu Yun ( https://cloud.baidu.com/ ) is one of top tier cloud computing
> provider. Baidu Yun BOS is widely used among China's cloud users, but
> currently it is not easy to access data laid on BOS storage from user's
> Hadoop/Spark application, because of no original support for BOS in Hadoop.
> This work aims to integrate Baidu Yun BOS with Hadoop. By simple
> configuration, Spark/Hadoop applications can read/write data from BOS without
> any code change. Narrowing the gap between user's APP and data storage, like
> what have been done for S3 and Aliyun OSS in Hadoop.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
