We are using kie-server-api (Version 7.29.0.Final) and kie-server-client (7.29.0.Final) in one of our microservices:

//Drools - Java API
// https://mvnrepository.com/artifact/org.kie.server/kie-server-api
libraryDependencies += "org.kie.server" % "kie-server-api" % "7.29.0.Final"
// https://mvnrepository.com/artifact/org.kie.server/kie-server-client
libraryDependencies += "org.kie.server" % "kie-server-client" % "7.29.0.Final"

According to Maven both components are licenses under Apache 2.0. In contrast to that our license scanner found issues in these components:enter image description here

How can kie-server-api and kie-server-client be under Apache 2.0 and deep inside there are GPL-components with copy left???

Thank you for an explanation!


  • 2
    I'm not sure if I'm reading the output of your tool right, but does the licenses line indicate that both components are available under multiple different licenses? If so, that could be your answer. However, it seems odd that your tool would flag it unless both licenses were not permissible. Do you permit CDDL and/or GPL v2 with Classpath Exception? Or perhaps the permissability of these aren't defined, which is why it's being flagged. Dec 18 '19 at 13:03
  • For the first component (Java Beans...) that's the solution. It is possible to choose between CDDL and GPL v2. For the second line it seams to be a little bit more complicated...
    – Michael
    Dec 18 '19 at 14:52
  • As said we solved the JavaBeans issue... Can anyone help with "Java Architecture for XML Binding 2.3. (1.0.1.Final)"??? Our license scanner finds multiple licenses (see above)... Additionally it is not easy to find the git repository or maven link for it....
    – Michael
    Dec 19 '19 at 7:48
  • Further information: org.jboss.spec.javax.xml.bind:jboss-jaxb-api_2.3_spec:1.0.1.Final mvnrepository.com/artifact/org.jboss.spec.javax.xml.bind/… License EDL 1.0???
    – Michael
    Dec 19 '19 at 7:54

Digging down into the licensing of the components that make up the latest version of kie-server-api, all the dependencies of the code itself are Apache2, BSD, or MIT-licensed; jaxb-core and jaxb-impl are needed only for testing. We already have a question about the implications of using GPL-licensed components during testing, and I recommend it for your perusal.

The bigger problem here is your licence analysis tool, which doesn't seem very good at determining the exact nature of components - at least, not in the case of kie-server-api. How a piece of copylefted code is used in the production of your software is very important in determining the licensing implications for your software; for example, a piece of code might require a GPL'ed compiler in order to compile, but that almost never means that the resulting executable must be GPL also.

I'm no developer, so I can't shed much more light on exactly how those java components are used in this case, but I think we have good grounds to be suspicious of your automated tool. It might be time to actually start doing some legwork yourself.

  • Thankx for your answer. I think a lawyer has to be involved to discuss the point if test code can infect the rest of the project or not... If I am clear with that either i have to discuss this with FOSSA or not. Which automation tool(s) do you use?
    – Michael
    Jan 9 '20 at 9:58
  • I've linked to our question on the issue of the applicability of the licence of test tools; I don't think you'll get a better answer on this site. As for my tool choice, "I'm no developer", so I don't use any automated licence analysis tools at all - we sysadmins like our code nicely packaged, with all these issues already sorted out!
    – MadHatter
    Jan 9 '20 at 10:07
  • The discussion you linked presumes that we can decide weather to ship test coding or not to ship it to our customer. But this is not where we are... The problem mentioned above is hidden deep in a component we plan to ship linked with our coding!
    – Michael
    Jan 9 '20 at 14:06
  • As I say in my answer, the GPL/CDDL-licensed components are not built into the shipping package, but are only involved in the testing. I presume you're not shipping your test harness - you certainly don't say you are, and it would be unusual in my experience to do so - so I don't see the issue.
    – MadHatter
    Jan 9 '20 at 17:28
  • But Rathat ships testcoding in the libraries mentioned above... And as I said. Our scanner found those components in the Rehat dependency mentioned above. At the moment I can't choose between shipping or not...
    – Michael
    Jan 10 '20 at 6:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.