Gradle 2.4-rc1 introduces a non-free dependency

issue-resolved
gradle-3478

(Mikolaj Izdebski) #1

During licensing review of Gradle 2.4 in Fedora we found out that it introduces a new dependency, aws-java-sdk, which is non-free.

Most of the code in aws-java-sdk is licensed under Apache License Version 2, just like Gradle, but a few utility classes used for JSON support are non-free. These classes contain a clause that contains usage restrictions (“The Software shall be used for Good, not Evil.”), see the license file and source of class com.amazonaws.util.json.JSONArray.

Such usage restriction makes the license incompatible with The Open Source Definition and The Free Software Definition. Because Gradle binary distribution includes this software, it effectively becomes proprietary software itself.

I think this is a serious issue and should be fixed ASAP.


(René Groeschke) #2

Thanks for reporting. Investigating…


(Luke Daley) #3

Hi @mizdebsk,

The distribution of Gradle included in Fedora is already different (e.g. version of Ivy library used is changed). Would it be possible for 2.4 to simply exclude the AWS support?

We started a discussion internally on what we’d need to do in order to modify our build and release process to make it easier to create a Fedora compatible Gradle. That is, we’d add switches/flags to the build to omit functionality. Effectively, pushing the changes you upstream to us. We’d then incorporate testing of this distribution to our QA processes. It’s not clear yet what this would mean for us, but we are discussing it.

However, we’d really like to avoid holding up the release of 2.4 any longer. As such, we can’t put something like this in place for 2.4.

Please let me know your thoughts.


(Luke Daley) #4

As for how you might do this…

The implicitly loaded plugins at runtime are controlled by the generated gradle-plugins.properties file, that is expected to be part of the gradle-core-«version».jar file in the lib directory of the distribution. The plugin gradle-resources-s3 will need to removed from that file.

You could either modify this file after the fact, or likely better, modify the build script to remove the s3 project here:


(Mikolaj Izdebski) #5

Hi @luke_daley,
thank you for your reply.

I understand that it may be too late to fix this in Gradle 2.4 and I hope this problem will be addressed in future releases.

Building Gradle in Fedora is not a problem. I was wondering whether I should build it with S3 plugin disabled or work on patching AWS code to remove non-free JSON classes, but now I think I will go with the first I solution. (I’m also working on upstreaming some of patches we carry in Fedora, I’m hoping to submit some pull requests next week.)


(Luke Daley) #6

There’s an open PR on the AWS SDK to remove this dependency:

You could add some weight (e.g. +1 comment) to that PR.


(Adrian Kelly) #7

It’s been removed in v1.11 of the AWS SDK. We should consider upgrading.


(Stefan Oehme) #8

This will be fixed in Gradle 3.0.