I'm using the javax.activation package in a project that is deployed as a monolithic jar. The mentioned package is licensed under CDDL 1.0 and up to now part of the Java distribution but is now deprecated in Java 9 and will be removed from Standard Edition in later versions.

To be future-proof, I'm including the standalone replacement project as dependency in my projects Maven configuration and would include the compiled code in my jar as not to introduce an obstacle to the intended users.

The javax.activation package license was no problem until now, because my jar only linked to the code in the Java distribution.

If I'm not able to release the source of my application, what are my options?

  • Include the external code in my jar file
  • Bundle my jar with the dependencies jar and distribute both as a zip file
  • Only distribute my jar and let the users cope with getting the right dependencies themselfes
  • Force the users to stay with up to Java 8

Edit: The package version on Github actually uses CDDL 1.1, while on mvnrepository.com it's listed as CDDL 1.0.


The CDDL 1.1 license does not require you to release your own source code.

To comply with the license, if you include the javax.activation package in your distribution, you should mention in your documentation that you are using the javax.activation package, which license that package is under and where people can obtain the source code.
You can just include the package in your monolithic jar file.

Only if you make changes to the javax.activation package itself or if you physically copy code from that package to other files are you requires to make source code public.

| improve this answer | |
  • I updated my question to reflect that the package actually uses CDDL 1.1. – user2011659 Jan 26 '18 at 6:36
  • @user2011659: That doesn't materially change my answer, as I based it on the actual license text found with the package. – Bart van Ingen Schenau Jan 27 '18 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.