snappy-java ships GPL code

[jsievers]

this was discovered in the context of https://bugs.eclipse.org/bugs/show_bug.cgi?id=461974 where Tycho wants to use a newer version of plexus-archiver.

snappy-java was recently introduced as a dependency with
475505c

snappy-java is Apache licensed but ships GPL licensed code, details see xerial/snappy-java#113

This is a license compatibility problem according to http://www.apache.org/licenses/GPL-compatibility.html and we cannot upgrade to a newer version of plexus-archiver as long as this is not solved.

[krosenvold]

Ok, we'll give the snappy guys a little time to respond to their issue. In the mean time you should be fine with version 2.10.1. Unless that GPL taint issue is solved in a timely manner, I'll blow away snappy support entirely (snappy was the reason we moved to version 3.0, releases in the 2.x range are actually newer/better than the "3.X" branch right now.)

[jsievers]

thanks for the fast reply and workaround proposal; we'll give version 2.10.1 a shot

[ifedorenko]

out of curiosity, have you looked at pure-java snappy implementation https://github.com/dain/snappy ?

[jsievers]

while xerial/snappy-java#113 was closed as invalid, the eclipse legal team stated in the meantime that eclipse has a policy to
permit the use of GPL+Classpath Exception code with Board approval and on a case by case basis only.
Overall the effort to get this approved would not be worth it from Tycho's point of view.
Note this is the eclipse.org legal judgment in the context of EPL-licensed Tycho, Apache Foundation may have a different view on things for plexus-archiver in general.

That said we are happy with plexus-archiver 2.10.1 for now.

[jsievers]

thanks!