Resolving Licensing Conflicts in Apollo: Request for Community Input

[nobodyiam]

Background

Apollo is an open-source, distributed configuration center that operates under the Apache 2.0 license. Recently, we have identified some potential licensing conflicts in our project through the use of FOSSA, which warrant our attention.

For example, mysql-connector-j is under the GPL2 license. Though Apollo adheres to the GPL license since all its code is open source, users of Apollo may breach this license if they alter the code without subsequently making it open source.

Current Situation

For instance, to deal with the mysql-connector-j issue, many other projects opt to only support PostgreSQL or H2SQL by default in their installation packages. If users need to utilize MySQL databases, they are required to manually copy the mysql-connector-j JAR file to their classpath and configure it accordingly. Unfortunately, Apollo's support for PostgreSQL and H2SQL is still a work in progress and, as such, this approach is not currently viable.

Request for Community Input

As we explore potential solutions to this issue, we would like to involve our valuable community members in the process. Your input, suggestions, and experiences with similar situations can provide valuable insights that will help us make well-informed decisions moving forward.

Please consider sharing your thoughts and recommendations on how we can best address the licensing conflicts while maintaining the Apache 2.0 license for Apollo.

背景

Apollo 是一个采用 Apache 2.0 许可证的开源分布式配置中心。近期，我们通过 FOSSA 发现项目中有潜在的许可冲突问题，需要引起我们的重视。

例如 mysql-connector-j 采用的是 GPL 2 许可证，虽然 Apollo 没有违反 GPL 协议（因为所有代码都是开源的），但是如果 Apollo 的用户在修改代码后没有随之开源，他们可能会违反此许可证。

当前情况

例如，为了解决 mysql-connector-j 的问题，许多其他项目选择默认在安装包中仅支持 PostgreSQL 或 H2SQL。如果用户需要使用 MySQL 数据库，他们需要手动将 mysql-connector-j 的 JAR 文件复制到类路径并进行相应配置。遗憾的是，Apollo 对 PostgreSQL 和 H2SQL 的支持仍在进行中，因此目前尚不具备这个条件。

征求社区意见

在寻求解决这个问题的可能方案时，我们希望将我们的社区成员纳入其中。您的意见、建议以及在类似情况下的经验可以为我们提供宝贵的见解，帮助我们做出明智的决策。

请考虑分享您的想法和建议，以便我们在维护 Apollo 的 Apache 2.0 许可证的同时，最好地解决许可证冲突问题。

[hezhangjian]

I think we can use mariadb connector to replace mysql-connector. It works well and compatible. The only change is the jdbc url.
For the other dependencies. We must find an alternative or remove the features.

I can work on this.

[hezhangjian]

Also I want to know. Which of the following apollo functions depend on the two libraries? javax.mail and jaxb

[nobodyiam]

I think we can use mariadb connector to replace mysql-connector. It works well and compatible. The only change is the jdbc url.

I observed that MySQL offers a FOSS License Exception, which permits Apollo to utilize MySQL client libraries without modifying the license. However, this exception has been deprecated. MariaDB features a comparable Floss Exception, which might be the reason we can consider it as a replacement for MySQL?

[nobodyiam]

Also I want to know. Which of the following apollo functions depend on the two libraries? javax.mail and jaxb

It looks like the fossa check has some issues in determining the licenses. I check the mvnrepository for the licenses used by javax.mail and jaxb, it turns out they provided 2 licenses: CDDL and GPL, which I think we could choose to use CDDL instead.

[nobodyiam]

As apollo itself doesn't violate the GPL license, is it enough to simply put a notice in the project's README section to inform the users about the GPL license requirements so that we could keep the code as is?

For example:

License Information
Apollo is licensed under the Apache License 2.0. However, Apollo uses some third-party libraries that are licensed under different licenses, including GPL-licensed libraries:

• mysql-connector-j (GPL 2.0)
• ...

Please note that if you modify and distribute the Apollo source code or binaries that include these GPL-licensed libraries, you must comply with the GPL license requirements, which may include releasing your modified source code under the GPL license. For more information on GPL license requirements, please refer to the respective library's documentation and the GPL license text.

[hezhangjian]

@nobodyiam I think we can. But it would be useful if we also package mariadb-connector in to the release package. WDYT?

[nobodyiam]

Generally, it is acceptable to replace mysql-connector with mariadb-connector. However, there might be some issues regarding the jdbc url change which would cause issue in backward compatibility.

[zouyx]

Whether apollo violates GPL license can reference a book which is called 《开源软件之道》.
It mentioned when will opensouce project violate GPL license as below.
If opensource project is based on software which is included GPL license , opensouce project must use GPL license.So GPL license is a infectivity license.

[stale]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in 7 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.