Axis2 Licensing issues

Question

One of our potential customers will be running a "License scanning tool" in order to identify any libraries that we might be using, and that have a "taboo" software license.

Knowing that we use Axis2 1.6.2 as our SOAP framework, some of the framework's dependencies have non-acceptable licenses, mainly "activation-1.1.jar" and "mail-1.4.jar" which have the CDDL V1.0 software license.

My question is, how do I solve this problem while still using Axis2? I mean, is there a way to replace both jars with some other jars with an Apache license for example? I just want to make sure that no code changes are made (If any changes were required, they should be minor given the amount of work that's required for all the projects that we have).

Thanks.

Answer 1

Short answer:

You can safely replace them with the corresponding JARs from the Apache Geronimo project. They can be found here:

http://repo1.maven.org/maven2/org/apache/geronimo/specs/

Long answer:

Activation and JavaMail are used by Axis2 in two places:

• The support for SwA and MTOM. Here it is primarily the DataHandler class and related classes that are used.
• As implementation of the POP3/IMAP/SMTP protocols in the mail transport.

The SwA/MTOM support is actually provided by the Apache Axiom project which itself uses the Geronimo JARs. Axiom has an extensive unit test suite and there are no known issues related to the usage of the Geronimo JARs. Therefore it is safe to use them with Axis2 as well (for the SwA/MTOM support).

There are several reasons why Axis2 overrides the dependencies of the Axiom project to use the Sun/Oracle JARs instead of the Geronimo JARs:

• Early versions of the Geronimo JARs had bugs that affected SwA/MTOM, but this is no longer the case (see above).
• Since the POP3/IMAP/SMTP code is much more complex than the DataHandler stuff, the Geronimo JARs may still cause issues if the Axis2 mail transport is used.
• Most third party projects use the Sun/Oracle JARs. Axis2 has chosen to use these JARs to avoid ending up with the two sets of JARs when combining Axis2 with other projects.
• The ASF doesn't consider (actually, no longer considers) that the licenses of the Sun/Oracle JARs are incompatible with the ASL.