[iot-pmc] [CQ 21907] org.hibernate:hibernate-core:5.0.12

[emo-ip-team@xxxxxxxxxxx]

http://dev.eclipse.org/ipzilla/show_bug.cgi?id=21907





--- Comment #9 from Kai Hudalla <kai.hudalla@xxxxxxxx>  2020-04-22 04:18:52 ---
(In reply to comment #8)
> (In reply to comment #7)
> > (In reply to comment #6)
> > > (In reply to comment #5)
> > > > (In reply to comment #4)
> > > > > (In reply to comment #3)
> > > > > Thanks for the advice - I wasn't aware of that. We will look into replacing
> > > > > Hibernate with EclipseLink. This will probably be a big change in the
> > > > > application, so it will take some weeks to analyze and come up with a way
> > > > > forward. 
> > > > > 
> > > > > > Kevin,
> > > > > > 
> > > > > > the LGPL license used by Hibernate is not in the list of generally approved
> > > > > > licenses to be used with Eclipse projects [1]. You might want to get board
> > > > > > approval for using it but in general we suggest using an alternative OR mapper
> > > > > > using an approved license e.g. EclipseLink. Would that be an option?
> > > > > > 
> > > > > > [1] https://www.eclipse.org/legal/EclipseLegalProcessPoster.pdf
> > > > > > 
> > > > > 
> > > > 
> > > > Does that mean that you are already using Hibernate in Vorto? If so, then you
> > > > might already have board approval for using it and can then, of course,
> > > > continue to do so. However, I couldn't find any approved Hibernate CQs for
> > > > Vorto ... 
> > > > 
> > > 
> > > Yes this is a transitive dependency of spring-boot-starter-data-jpa and that
> > > dependency has been there since 2018... How can we find out if we already have
> > > the approval for it? 
> > > 
> > 
> > The Hibernate artifacts should show up in the approved third-party dependencies
> > of your IP log [1] which is accessible from the PMI.
> > 
> > [1]
> > https://projects.eclipse.org/projects/iot.vorto/releases/0.13.0/iplog/preview
> > 
> Okay thanks - unfortunately they do not show up there as approved dependencies.
> Only this pending CQ does.
> 

Then it looks like this slipped through the IP log review ...

@Wayne: how should we proceed here? It looks like we have Vorto releases out
there in the wild which contain Hibernate artifacts for which there is no
approved CQ. I see two options:
1. we get (retroactive) board approval for using Hibernate
2. we live with that fact but replace Hibernate with e.g. EclipseLink

WDYT?


-- 
Configure CQmail: http://dev.eclipse.org/ipzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the CQ.