[
https://issues.apache.org/jira/browse/LIVY-985?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17754411#comment-17754411
]
Damon Cortesi commented on LIVY-985:
------------------------------------
Spent some time going through mvn dependency:tree -Dincludes=package to figure
out where they're coming from.
* javax.xml.stream:stax-api:1.0-2 - Dependency of various hadoop imports, like
hadoop-yarn-common and hadoop-common, via jaxb-api. [Hudi specifically excluded
jaxb|https://github.com/apache/hudi/commit/ec965892b042b123e985db5676fdf599d934404c#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8]
per LEGAL-461.
* org.codehaus.jackson:jackson-jaxrs:1.8.3 - Also pulled in via hadoop.
* org.codehaus.jackson:jackson-xc:1.8.3 - Pulled in via hadoop.
* com.github.rwl:jtransforms:2.4.0 - Pulled in via spark-repl_2.11
* javax.xml.bind:jaxb-api:2.2.2 - Hadoop
* com.sun.xml.bind:jaxb-impl:2.2.3-1 - via hadoop-common
* javax.ws.rs:javax.ws.rs-api:2.0.1 - via spark-core
* com.sun.jersey:jersey-* - via various hadoop-common/hadoop-yarn-common
* com.sun.jersey.contribs:jersey-guice - hadoop-yarn-common
* org.javassist:javassist:3.18.1-GA - via spark-core
Most of these are either test or provided scope, so I think we can safely add
excludes in the relevant poms.
> Category X licenses in binary distribution
> ------------------------------------------
>
> Key: LIVY-985
> URL: https://issues.apache.org/jira/browse/LIVY-985
> Project: Livy
> Issue Type: Task
> Components: Build
> Affects Versions: 0.8.0
> Reporter: Damon Cortesi
> Assignee: Damon Cortesi
> Priority: Major
> Fix For: 0.8.0
>
>
> From the [VOTE
> thread|https://lists.apache.org/thread/k01z56h2fjr8k80c9z0nz6nqx5l97bh8]
> there are several GPL and LGPL licensed jars in the zip.
> [https://www.apache.org/legal/resolved.html#category-x]
> GNU General Public Library:
> * Streaming API for XML (javax.xml.stream:stax-api:1.0-2 - no url defined)
> GNU Lesser General Public License (LGPL), Version 2.1:
> * JAX-RS provider for JSON content type
> (org.codehaus.jackson:jackson-jaxrs:1.8.3 -
> [http://jackson.codehaus.org|http://jackson.codehaus.org/])
> * Xml Compatibility extensions for Jackson
> (org.codehaus.jackson:jackson-xc:1.8.3 -
> [http://jackson.codehaus.org|http://jackson.codehaus.org/])
> GPL:
> * JTransforms (com.github.rwl:jtransforms:2.4.0 -
> [http://sourceforge.net/projects/jtransforms/])
> GPL2 w/ CPE:
> * JAXB API bundle for GlassFish V3 (javax.xml.bind:jaxb-api:2.2.2
> [https://jaxb.dev.java.net/])
> * JAXB RI (com.sun.xml.bind:jaxb-impl:2.2.3-1 - [http://jaxb.java.net/])
> * javax.ws.rs-api (javax.ws.rs:javax.ws.rs-api:2.0.1
> -[http://jax-rs-spec.java.net|http://jax-rs-spec.java.net/])
> * jersey-client (com.sun.jersey:jersey-client:1.9
> -[https://jersey.java.net/jersey-client/])
> * jersey-core (com.sun.jersey:jersey-core:1.9
> -[https://jersey.java.net/jersey-core/])
> * jersey-guice (com.sun.jersey.contribs:jersey-guice:1.9 -
> [https://jersey.java.net/jersey-contribs/jersey-guice/])
> * jersey-json (com.sun.jersey:jersey-json:1.9 -
> [https://jersey.java.net/jersey-json/])
> * jersey-server (com.sun.jersey:jersey-server:1.9 -
> [https://jersey.java.net/jersey-server/])
> LGPL:
> * JTransforms (com.github.rwl:jtransforms:2.4.0 -
> [http://sourceforge.net/projects/jtransforms/])
> LGPL 2.1:
> * Javassist (org.javassist:javassist:3.18.1-GA - [http://www.javassist.org/])
>
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
