Bug 879615

Summary: maven-jflex-plugin: GPL code linked with GPL-incompatible libraries
Product: [Fedora] Fedora Reporter: Mikolaj Izdebski <mizdebsk>
Component: maven-jflex-pluginAssignee: Mikolaj Izdebski <mizdebsk>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 18CC: akurtako, java-sig-commits, tcallawa, tradej
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 879620 (view as bug list) Environment:
Last Closed: 2013-01-09 21:37:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 879620    

Description Mikolaj Izdebski 2012-11-23 12:49:28 UTC 
Description of problem:
maven-jflex-plugin is licensed under GPL (any version), but it links with GPL-incompatible code (at least classworlds, which is licensed under Plexus license [1], but it also likely that it is liked with CPL-licensed code of junit and some ASL 1.1 code somewhere).

Possible solutions:
1) rewrite the plugin from scratch (only ~400 lines of code)
2) remove the package from Fedora and port other packages not to depend on it
3) obtain GPL classpath exception from copyright holders (maven-jflex-plugin links to a GPL library - jflex, so the exception for this library would be needed too)

Version-Release number of selected component (if applicable):
1.4.3-8

[1] https://fedoraproject.org/wiki/Licensing/Plexus_Classworlds_License
Comment 1 Tom "spot" Callaway 2012-11-27 15:28:36 UTC 
I think this is something that needs to be raised with upstream.
Comment 2 Fedora Admin XMLRPC Client 2013-01-09 10:10:32 UTC 
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 3 Mikolaj Izdebski 2013-01-09 21:37:33 UTC 
Package not needed any longer (dependency removed from qdox package).
Release engineering has been notified to block this package:
https://fedorahosted.org/rel-eng/ticket/5440