Dependencies with no license

[ralf0131]

When examine the license file of Dubbo dependencies, the following command is executed:

 mvn license:add-third-party -Dlicense.useMissingFile -Dlicense.includeOptional=true

The following output shows there are 2 dependencies with no license:

[INFO] Missing file ~/work/apache-dubbo/incubator-dubbo/dubbo-registry/dubbo-registry-nacos/src/license/THIRD-PARTY.properties is up-to-date.
[WARNING] There are 2 dependencies with no license :
[WARNING]  - javax.xml.bind--jsr173_api--1.0
[WARNING]  - net.jcip--jcip-annotations--1.0

Need to check the actually license of the two dependencies, to see if it is compatible with Dubbo.

Below is a partial output of the mvn dependency:tree in the dubbo-registry-nacos module.

[INFO] +- org.jboss.resteasy:resteasy-jaxrs:jar:3.0.19.Final:test
[INFO] |  +- org.jboss.spec.javax.ws.rs:jboss-jaxrs-api_2.0_spec:jar:1.0.0.Final:test
[INFO] |  +- org.jboss.spec.javax.annotation:jboss-annotations-api_1.2_spec:jar:1.0.0.Final:test
[INFO] |  +- javax.activation:activation:jar:1.1.1:test
[INFO] |  +- org.apache.httpcomponents:httpclient:jar:4.5.3:test
[INFO] |  |  \- org.apache.httpcomponents:httpcore:jar:4.4.6:test
[INFO] |  +- commons-io:commons-io:jar:2.1:compile
[INFO] |  +- net.jcip:jcip-annotations:jar:1.0:test
[INFO] |  \- org.jboss.logging:jboss-logging:jar:3.1.4.GA:test
...
[INFO] +- org.jboss.resteasy:resteasy-jaxb-provider:jar:3.0.19.Final:test
[INFO] |  \- com.sun.xml.bind:jaxb-impl:jar:2.2.7:test
[INFO] |     +- com.sun.xml.bind:jaxb-core:jar:2.2.7:test
[INFO] |     |  +- javax.xml.bind:jaxb-api:jar:2.2.7:test
[INFO] |     |  \- com.sun.istack:istack-commons-runtime:jar:2.16:test
[INFO] |     \- com.sun.xml.fastinfoset:FastInfoset:jar:1.2.12:test
[INFO] |        \- javax.xml.bind:jsr173_api:jar:1.0:test

[htynkn]

jcip-annotations: https://github.com/stephenc/jcip-annotations/blob/master/LICENSE.txt
jsr173_api:http://svn.apache.org/repos/asf/beehive/trunk/LICENSE.jsr173-api

[ralf0131]

jsr173_api seems BEA licensed, and according to previous discussion, it seems incompatible with Apache License.
I think we should either contact Nacos community to fix it, or exclude this dependency explicitly.

[ralf0131]

I've filed an issue on Nacos community alibaba/nacos#1057. Given it is a test dependency I think we can try to quickly fix it by excluding it explicitly.

[ralf0131]

[INFO] +- org.jboss.resteasy:resteasy-jaxb-provider:jar:3.0.19.Final:test
[INFO] |  \- com.sun.xml.bind:jaxb-impl:jar:2.2.7:test
[INFO] |     +- com.sun.xml.bind:jaxb-core:jar:2.2.7:test
[INFO] |     |  +- javax.xml.bind:jaxb-api:jar:2.2.7:test
[INFO] |     |  \- com.sun.istack:istack-commons-runtime:jar:2.16:test
[INFO] |     \- com.sun.xml.fastinfoset:FastInfoset:jar:1.2.12:test
[INFO] |        \- javax.xml.bind:jsr173_api:jar:1.0:test

Sorry, I have made a mistake. Actually the dependency is introduced by dubbo-registry-nacos, not on the Nacos side.