GPL dependency?

[niclash]

I tried out Debricked analysis tool with OPS4J as a trial to see what comes out of it.

https://debricked.com/app/en/repository/25903?tab=4

Shows that it found GPL and LGPL (various versions of both) in the dependency chain "somehow". Not sure how to go looking for that, but thought I should let you guys know.

[grgrzybek]

I can't login to debricked.com...
And yes, I believe mysql driver (in pax.jdbc) is GPL that's why it got separate features file...

I'm not sure about pax.web - could you somehow attach the report here?

[niclash]

Don't you simply get a "Login with GitHub" button and that brings you to the page above? That is at least intended.

[grgrzybek]

@niclash I simply didn't check ;) I'll check on Monday.

[niclash]

[niclash]

[niclash]

F! The above report is for all of OPS4J... Grrr...

[niclash]

These are for Pax Web

[grgrzybek]

I found this for example: https://debricked.com/app/en/dependency/11673?repositoryId=25903
it's about test-scoped dependency org.glassfish.hk2:osgi-resource-locator...
Not sure what should I do about it.

[grgrzybek]

4 GPL deps total in Pax Web: https://debricked.com/app/en/repository/25903?tab=3&search=GPL-2.0
jakarta.ws.rs has (in POM):

    <licenses>
        <license>
            <name>EPL 2.0</name>
            <url>http://www.eclipse.org/legal/epl-2.0</url>
            <distribution>repo</distribution>
        </license>
        <license>
            <name>GPL2 w/ CPE</name>
            <url>https://www.gnu.org/software/classpath/license.html</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

so probably dual license.
Same for jaspic API (jakarta.security.auth.message):

    <licenses>
        <license>
            <name>EPL 2.0</name>
            <url>http://www.eclipse.org/legal/epl-2.0</url>
            <distribution>repo</distribution>
        </license>
        <license>
            <name>GPL2 w/ CPE</name>
            <url>https://www.gnu.org/software/classpath/license.html</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

Even if the report says "GPL-2.0"...

[grgrzybek]

@niclash hi, any idea how to proceed with this one?

[mattrpav]

Enhancement request with debricked to support CPE reporting?