[HBASE-21371] Hbase unable to compile against Hadoop trunk (3.3.0-SNAPSHOT) due to license error

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha-1, 2.2.0, 2.0.3, 2.1.2
• Hadoop Flags: Reviewed
• Assignee: Wei-Chiu Chuang
• Reporter: Wei-Chiu Chuang
• Created: 23/Oct/18 17:31
• Updated: 02/Oct/19 17:14
• Resolved: 29/Oct/18 21:50

Description

Hadoop 3.3.0 (trunk) updated various dependencies, which adds additional licenses that break HBase's license check plugin.

CDDL/GPLv2+CE license

This product includes JavaBeans Activation Framework API jar licensed under the CDDL/GPLv2+CE.

CDDL or GPL version 2 plus the Classpath Exception
ERROR: Please check ^^^^^^^^^^^^ this License for acceptability here:

https://www.apache.org/legal/resolved

If it is okay, then update the list named 'non_aggregate_fine' in the LICENSE.vm file.
If it isn't okay, then revert the change that added the dependency.

More info on the dependency:

<groupId>javax.activation</groupId>
<artifactId>javax.activation-api</artifactId>
<version>1.2.0</version>

maven central search
g:javax.activation AND a:javax.activation-api AND v:1.2.0

project website
http://java.net/all/javax.activation-api/
project source
https://github.com/javaee/activation/javax.activation-api

Bouncy Castle License 

–
This product includes Bouncy Castle PKIX, CMS, EAC, TSP, PKCS, OCSP, CMP, and CRMF APIs licensed under the Bouncy Castle Licence.

ERROR: Please check ^^^^^^^^^^^^ this License for acceptability here:

https://www.apache.org/legal/resolved

If it is okay, then update the list named 'non_aggregate_fine' in the LICENSE.vm file.
If it isn't okay, then revert the change that added the dependency.

More info on the dependency:

<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
<version>1.60</version>

maven central search
g:org.bouncycastle AND a:bcpkix-jdk15on AND v:1.60

project website
http://www.bouncycastle.org/java.html
project source
https://github.com/bcgit/bc-java
–

 

And a long list of "Apache Software License - Version 2.0" licensed Jetty dependencies like this:

This product includes Jetty :: Servlet Annotations licensed under the Apache Software License - Version 2.0.

ERROR: Please check ^^^^^^^^^^^^ this License for acceptability here:

https://www.apache.org/legal/resolved

If it is okay, then update the list named 'non_aggregate_fine' in the LICENSE.vm file.
If it isn't okay, then revert the change that added the dependency.

More info on the dependency:

<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-annotations</artifactId>
<version>9.3.19.v20170502</version>

maven central search
g:org.eclipse.jetty AND a:jetty-annotations AND v:9.3.19.v20170502

project website
http://www.eclipse.org/jetty
project source
https://github.com/eclipse/jetty.project/jetty-annotations

Issue Links

• breaks: HBASE-22359 Backport of HBASE-21371 misses activation-api license information
• is related to: HBASE-22953 Supporting Hadoop 3.3.0
• relates to: HADOOP-15874 Add Bouncy Castle License
• relates to: HADOOP-15873 Add JavaBeans Activation Framework API to LICENSE.txt