lucenenet-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Rob Vesse <>
Subject Re: SharpZipLib Dependency?
Date Fri, 02 Nov 2012 23:41:24 GMT
Thanks for the clarification Chris. I likely only noticed this because I'm
transitioning a project that relies on Lucene.Net to use NuGet for all
dependencies rather than keeping copies of the binaries directly.

The real concern I have with this dependency is that that the Lucene.Net
PMC may have fallen afoul (albeit unintentionally) of some of the Apache
guidance in how you distribute SharpZipLib without correctly following the
legal guidance.

I apologize if the following is going to come across as somewhat anal but
as a fellow Apache and open source developer I want the Lucene.Net project
to succeed because I use it in my own projects.  So it's in the interest
of the project and the ASF that you guys get this sorted sooner rather
than later if there is a problem.  And I'm not any sort of legal
professional so apologies if my interpretation of Apache policy is a
little off in places.

The issue is that SharpZipLib is GPL which makes it a prohibited work by
the Apache rules ( so you
can't include it directly in Apache releases.

As far as I can see you haven't included it directly which is great.

The official Apache release (the source package) does not contain the
binary (which is good) it does contain a section in the ReadMe stating
that additional libraries are required (which is also fine).  However
there is a problem in that you point users to download it from
which is on a Apache server.

The Apache guidelines state "YOU MUST NOT distribute a prohibited work
from an server" which you are clearly violating here

Whether you need to remove those files from Apache SVN is likely a
question for Apache Legal or your Incubation mentors (if they are still
around post-graduation).  For future releases I would suggest that you
likely want to link to the relevant websites where those third party
dependencies can be obtained from.  If the PMC wants I believe they can
choose to host copies of these libraries elsewhere provided they aren't on
Apache infrastructure and it isn't an official action of the PMC.

The binary release is also fine from the standpoint that dependencies
aren't included but suffers from the same issue that you point people to
download them from an Apache server.

I assume this hosting of the dependencies is primarily a holdover from
Incubation where podlings are allowed a little more freedom in their
interpretation of the legal guidelines as they work towards becoming a TLP

As for NuGet I believe you are fine because it's a non-Apache release.  I
think ideally the package should require license acceptance and say that
it requires installing a GPL dependency though you can probably get by
without this change for the time being.  (Btw I filed a RFE on NuGet on
requiring license acceptance on a per-dependency basis which would make
this easier -

Sorry to be a pain in the ass, thanks again for all the work you guys do
in making Lucene available to .Net developers.  Hopefully this issue is
fairly trivial for you guys to address in the grand scheme of things.



On 11/2/12 12:50 PM, "Christopher Currens" <> wrote:

>We've had the SharpZipLib dependency for a very long time.  It might
>be possible that it was included in an earlier nuget package instead
>of listed as a dependency.  It's there to support compressed fields in
>an index, which have been removed in the 3.0.3 API.  However, to
>support backwards compatibility, the package still needs to include
>the library in order to read indexes that were made pre-3.x that use
>compressed fields.
>I'm not 100% sure, but even if you don't use compressed fields, you
>might not be able to run without it.  I think there is a specific
>support class that checks for its existence.
>On Fri, Nov 2, 2012 at 11:56 AM, Rob Vesse <> wrote:
>> I noticed in upgrading to 3.0.3 that SharpZipLib is now a dependency and
>> will be auto-installed when using the NuGet package.  I don't remember
>> being the case with 2.9.2/2.9.4 and never had any problems using those
>> versions without it
>> Is SharpZipLib a required dependency or is it only used for some
>> functionality?
>> Rob

View raw message