BUG: GPL License Violation?

[philipbjorge]

Describe the bug

We're trying to bring Neptune into our codebases and it's flagging some license violations for us.

• Neptune (Apache 2.0)
  • bravado (BSD 3-Clause)
    • bravado-core (BSD 3-Clause)
      • jsonschema[format] (MIT)
        • rfc3987 (GPLv3)

Expected behavior

I would expect all the licenses in neptune's dependencies and transitive dependencies to be in compliance with your package's license.

I am not a lawyer, but I'm pretty sure the copyleft nature of GPL requires this package now to be GPL.

This is a downstream issue in bravado-core, but I wanted to raise awareness in case you had an easy path to exclude the bravado dependency from this package.

Yelp/bravado-core#261
Yelp/bravado-core#405

Workarounds

Untested, but I suspect we can fork bravado-core and remove the format extras in the requirements and use that.

I'm not sure if Neptune depends on any of those functionalities.

Thanks

Appreciate you looking at this issue -- I know licensing and transitive dependencies aren't the most fun :)

[Raalsky]

Hey @philipbjorge!

Thank you so much for raising this topic and I appreciate that you've done some research already 😉

This is a downstream issue in bravado-core, but I wanted to raise awareness in case you had an easy path to exclude the bravado dependency from this package.

That's one of our top priorities as Bravado doesn't look to be maintained regularly for a while. Sadly there is no easy way to go without it and it will take us some time.

I'm not sure if Neptune depends on any of those functionalities.

I've just checked that and it looks like all of our functional tests are passing without rfc* dependencies. We've been there but there are a couple of integrations that are doing deep dependency checks that were failing due to lack of jsonschema[format].

Based on all of the things above my suggestion is that you can uninstall this package on your side and there is probably no easy solution on our side to do that 😞

[SiddhantSadangi]

Hey @philipbjorge ,
I received the below response from our legal team looking into this:

While the GPLv3 license is in fact a copyleft and requires derivative works to be licensed under the same or compatible license, its impact on Neptune is limited due to this being a license with a classpath exception. This allows commercial use and modification while ensuring the core code remains open source. It permits software to use a GPL library without absorbing the GPL's obligations, and allows commercial use.

Please let me know if this helps, or if you need further clarification 🙏

[philipbjorge]

This is really helpful @SiddhantSadangi -- Thank you 👍
Will close this issue and hopefully it's helpful for someone else in the future 👍