incubator-general mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Li,De(BDG)" <>
Subject Re: Looking for Champion
Date Sat, 09 Jun 2018 08:44:07 GMT
Hi Dave,

Thank you for your response.

As you mentioned that mongoose.h, it is serious mistake to replace license when updating Apache
license with a automatic script.

I have fixed it as following:

By the way, I wonder Palo just use OpenLdap with binary way, is it still have license issue?

Best Regards,

发件人: Dave Fisher <<>>
答复: <<>>
日期: 2018年6月9日 星期六 上午2:10
至: <<>>
主题: Re: Looking for Champion

Yuck. That’s a mess. That is one very large diff.

I see a few files related to AES the were GPL converted to Apache which not allowed.
Copyrights were changed too which is also incorrect.

Changes to this file be/src/http/mongoose.h<>
violate license and copyright of Sergey Lyubka

GitHub makes you expand each diff after awhile.

There are dependency licenses that might be issues too.

These licenses have not been evaluated by LEGAL.
* OpenLdap (OpenLDAP Software License);a=blob;f=LICENSE;hb=e5f8117f0ce088d0bd7a8e18ddf37eaa40eb09b1
* rapidjson (Tencent)
* cyrus-sasl (CMU License)

Lots of work in evaluating licenses.

On Jun 8, 2018, at 9:46 AM, Ted Dunning <<>>


The copyright in question was attached to code from the source code for
mySQL. There is no way that code can be in an Apache project.

Given the cut and paste history, it seems like it will require a very
detailed audit of code history or web searches to find where the original
code came from. The my_aes.c and .h files, for instance, have no hint in
their history that they came from GPL'ed code.

Yeah. Lot’s of oversight.

If we accept this proposal we need a Mentor who has time to help with this mess.

I don’t know that I have the time to lead that effort. Anyone?


On Fri, Jun 8, 2018 at 5:37 PM Todd Lipcon <<>>


+1. Also briefly browsing the code I found suspicious commits like this

... in which a GPL license copyright by Oracle was "fixed" to be an Apache
license copyright Baidu.

So if this project does enter incubation I think we should be extra careful
to audit the origins of all of the source code.

  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message