During licensing review of Gradle 2.4 in Fedora we found out that it introduces a new dependency, aws-java-sdk, which is non-free.
Most of the code in aws-java-sdk is licensed under Apache License Version 2, just like Gradle, but a few utility classes used for JSON support are non-free. These classes contain a clause that contains usage restrictions (“The Software shall be used for Good, not Evil.”), see the license file and source of class com.amazonaws.util.json.JSONArray.
Such usage restriction makes the license incompatible with The Open Source Definition and The Free Software Definition. Because Gradle binary distribution includes this software, it effectively becomes proprietary software itself.
I think this is a serious issue and should be fixed ASAP.
The distribution of Gradle included in Fedora is already different (e.g. version of Ivy library used is changed). Would it be possible for 2.4 to simply exclude the AWS support?
We started a discussion internally on what we’d need to do in order to modify our build and release process to make it easier to create a Fedora compatible Gradle. That is, we’d add switches/flags to the build to omit functionality. Effectively, pushing the changes you upstream to us. We’d then incorporate testing of this distribution to our QA processes. It’s not clear yet what this would mean for us, but we are discussing it.
However, we’d really like to avoid holding up the release of 2.4 any longer. As such, we can’t put something like this in place for 2.4.
The implicitly loaded plugins at runtime are controlled by the generatedgradle-plugins.properties file, that is expected to be part of the gradle-core-«version».jar file in the lib directory of the distribution. The plugin gradle-resources-s3 will need to removed from that file.
You could either modify this file after the fact, or likely better, modify the build script to remove the s3 project here:
I understand that it may be too late to fix this in Gradle 2.4 and I hope this problem will be addressed in future releases.
Building Gradle in Fedora is not a problem. I was wondering whether I should build it with S3 plugin disabled or work on patching AWS code to remove non-free JSON classes, but now I think I will go with the first I solution. (I’m also working on upstreaming some of patches we carry in Fedora, I’m hoping to submit some pull requests next week.)