[Java] EPL Dependencies

[martin-traverse]

Describe the bug, including details regarding any error messages, version, and platform.

Hi,

Please could I ask when and why the Eclipse Collections dependencies were introduced? This puts EPL dependencies into the dependency tree. Our clients are in the financial sector and these kind of licensing issues often cause a lot more pain that you might think they should!

We are a FINOS project and use their license classification scheme which is available here:

https://community.finos.org/docs/governance/software-projects/license-categories/

I see Apache has a similar policy:

https://apache.org/legal/resolved.html

The EPL is category B for both FINOS and Apache. We picked this up because it flagged with our license checks in CI. Although we can add an exception and start reproducing the license in NOTICE and LICENSE files, including it in our distribution packages etc., this doesn't help when clients have their own license scanning and acceptance process for getting software into the enterprise. For this reason, we generally try to stick to "Category A" licenses and count anything that pulls in category B dependencies as being category B. (We do use category B for testing, compliance checks and other non-shipped components).

Please can you share some info on the reasoning around this decision? Is there any appetite to reverse if the touch points are small and/or there are alternatives available, perhaps something from Apache Commons? More generally, do you have a view on your policy towards category B licenses going forward?

I'll be very interested to hear your thoughts on this subject!

Component(s)

Java

[lidavidm]

09d6ca7

Sorry about this. We were trying to eliminate a dependency on Netty from the core. Looking around I think our only choice is to use stdlib map and accept any potential performance hit, or to vendor the Netty implementation of this collection.

[lidavidm]

We also need to set up similar CI to prevent issues like this in the future.

[martin-traverse]

Thanks for the quick feedback - it is actually good from our point of view to hear that this is not intentional! Is there any chance the fix will be in version 16 or is it too late for that now?

For license scans we use Gradle-License-Report for Java, pip-licenses for Python and license-checker-rseidelsohn for JavaScript - appreciate you have a lot more languages to worry about!

[lidavidm]

I'm going to try to get this in ASAP. Actually, I just labeled this as a critical fix. I put together a basic Java-only license scan already. My schedule is about to go pear-shaped but hopefully I can get this done tonight/tomorrow.