[iot-pmc] [CQ 21907] org.hibernate:hibernate-core:5.0.12

[emo-ip-team@xxxxxxxxxxx]

http://dev.eclipse.org/ipzilla/show_bug.cgi?id=21907





--- Comment #11 from Kevin Olotu <kevin.olotu@xxxxxxxx>  2020-04-23 09:57:26 ---
(In reply to comment #10)
> > Then it looks like this slipped through the IP log review ...
> 
> I'm disappointed that I missed this in past reviews. Based on the date of the
> last IP Log review, I must have based my approval on the project downloads (the
> 0.12.0 release does not contain this library). 
> 
> How do consumers of the 0.12.0 release obtain this content?

To obtain the 0.12.0 release of Vorto, consumers can pull the artifacts through
maven or checkout the code and build it themselves.

> 
> Our new tools are based around the build, which gives us a much broader view of
> the actual dependencies.
> 
> To manage expectations, note that the EMO review of an IP Log is intended as a
> sanity check, not as an authoritative declaration.
> 
> > @Wayne: how should we proceed here? It looks like we have Vorto releases out
> > there in the wild which contain Hibernate artifacts for which there is no
> > approved CQ. I see two options:
> > 1. we get (retroactive) board approval for using Hibernate
> > 2. we live with that fact but replace Hibernate with e.g. EclipseLink
> 
> That the library is a dependency of a dependency leads me to believe that
> replacing it is going to be hard (it would be great to see the Spring Data
> component use EclipseLink instead, but that's going to take time).
> 
> My recommendation is that the PMC approve this CQ and ask the IP Team to
> initiate the process of seeking board approval to use the content under the
> current license.
> 
> IP Team: I am aware of at least one other project that is in a very similar
> situation, so my recommendation is that we ask the board for the broadest
> approval possible. It's likely that they will want us to approve this on a
> project-by-project basis, but we should ask for "all projects".
> 
> Since, AFAICT the project is not actively distributing the content in question
> from our download server, I suggest that we wait for the board's decision to
> decide what to do with the older downloads.
> 
Yes we do not actively distribute the content in question. 

Okay so we will wait for the approval of this CQ by the PMC and the board
approval requested by the IP team. 


-- 
Configure CQmail: http://dev.eclipse.org/ipzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the CQ.