Using a self build EAP binary in production

[r.reimann]

The are more and more contradictions comming up with every new post about using EAP in production without subscription. It would be helpful if the FAQ at http://www.jboss.org/jbossas/faq could clarify under which circumstances it is allowed to build and use EAP in production without having a subscription.

I value the subscription and inherently recommend it to our customers but if they are either not able or willing to follow my advice i would like to offer them a reliable alternative by building EAP themselfes. So even if i'm aware that Red Hat might not like to promote the self build option due to understandable reasons i would appreciate if the following questions could be answered:

Can i take the EAP 6.1.0.Beta sources and the maven repository from the locations [1] and [2], build an EAP binary from that and use it it internally in production without further modifications (like removing red hat branding/trademarks)?

[1] ftp://ftp.redhat.com/redhat/jbeap/6.1.0/en/source/

[2] http://maven.repository.redhat.com/techpreview/eap6/6.1.0.Beta1/

Can i do the same with the EAP 6.1.0.Final sources and repository as soon as they are available?

[nickarls]

I'm also interested (out of curiosity) as to if I can't take the binary and use it for production but if I can build the sources and use that one in production, what must be changed?

Because if the build produces exactly the same binaries then for all approximation, it's the same as using the pre-built thing, right?

[stoty2]

Actually, I have tried to do just that, and it does not build, as it uses Red Hat specific maven package versions that are not available publicly. (some of them are not in the repo at [2], either)

You need to make some fairily trivial (for someone who, unlike me, actually knows maven) changes to the maven setup and pom dependencies both in the sources and in (a local mirror of) that repo to get it to build. The resulting binary looks good, and based on the nature of changes I have had to make, I do not see any reason for it to work differently from the Red Hat built package.

I have glanced at both the sources, and the repo, and only found the LGPL lincence, and some disclaimers in the EULA, but no reference to needing a subscription for the sources. However there IS a disclaimer at the repo to the effect that it is provided as a convinience, and it may go away anytime. My uneducated guess is that it should be legal to use it internally (due to the LGPL), but not to distribute (due to the trademarks).

The neccessary patches are about 5Kbyte zipped, and I am willing to share them, but this forum is probably not the right place to post them.

[smillidge]

IANAL so this is not legal advice but my understanding as a Red Hat partner is that JBoss EAP is licensed via the LGPL and the JBoss EULA. The EULA prevents redistribution of the Red Hat trademarks (logos etc.), so neither of those licenses restrict your use of JBoss EAP within your own organisation. Once you have signed up for a support subscription you must agree by the terms of the subscription during the term of the subscription. Once the subscription has expired you are then bound by the LGPL and JBoss EULA.

If my understanding is incorrect I welcome some clarification.

[nickarls]

So your understanding is that if I do s/Red Hat/Dead Hat and take away the logos, I'm fine?

[smillidge]

For internal use (i.e. you are not redistributing) I don't think you need to do that.

I'm taking this from http://www.redhat.com/licenses/jboss_eula.html which I recommend you read as that has the definitive answer. An excerpt is below with my highlighting in bold italic.

1.  License Grant.  Subject to the following terms, Red Hat, Inc. ("Red Hat") grants to you a perpetual, worldwide license to the Programs (each of which may include multiple software components) pursuant to the GNU Lesser General Public License v. 2.1.   With the exception of certain image files identified in Section 2 below, each software component is governed by a license that permits you to run, copy, modify, and redistribute (subject to certain obligations in some cases) the software component.

Therefore my interpretation is that you may use the software under LGPL. However there are restrictions on redistribution related to Red Hat trademarks which are specific image files. Also if you read http://www.redhat.com/f/pdf/corp/RH-3573_284204_TM_Gd.pdf this defines the restrictions on redistributions.

If this is for your own internal use then my understanding is that you will not have problems as JBoss is open source software licensed under the LGPL.

Again IANAL so this is just my opinion not legal advice.

To be honest if you do want to run EAP binaries in production I would just get a subscription as it is actually very cheap for the benefits you gain. For US pricing see http://www.redhat.com/f/html/jboss_channel_skus.html. A list price 16 core standard subscription will allow you to run a 4 x Quad core Xeon server cluster for $5,500 (US prices from the link above) per annum for support and patching. You know it makes sense ;-)

[fcorneli]

www.centas.org anyone?

[manarh]

stoty2 wrote:

Actually, I have tried to do just that, and it does not build, as it uses Red Hat specific maven package versions that are not available publicly. (some of them are not in the repo at [2], either)

You need to make some fairily trivial (for someone who, unlike me, actually knows maven) changes to the maven setup and pom dependencies both in the sources and in (a local mirror of) that repo to get it to build. The resulting binary looks good, and based on the nature of changes I have had to make, I do not see any reason for it to work differently from the Red Hat built package.

I have glanced at both the sources, and the repo, and only found the LGPL lincence, and some disclaimers in the EULA, but no reference to needing a subscription for the sources. However there IS a disclaimer at the repo to the effect that it is provided as a convinience, and it may go away anytime. My uneducated guess is that it should be legal to use it internally (due to the LGPL), but not to distribute (due to the trademarks).

The neccessary patches are about 5Kbyte zipped, and I am willing to share them, but this forum is probably not the right place to post them.

Just to clarify what you get if you apply patches to get build it from provided sources. You will have DIFFERENT BINARIES, even it seems very similar. They are not tested by Redhat QE and as they have different dependency versions, they can have security vulnerable issues, bug issues etc..

I am not a lawyer to discover in deep  the implications, but as EAP is based on open source licenses you can use it in your production IMHO.

[hwellmann.de]

Marek Novotny schrieb:

Just to clarify what you get if you apply patches to get build it from provided sources. You will have DIFFERENT BINARIES, even it seems very similar. They are not tested by Redhat QE and as they have different dependency versions, they can have security vulnerable issues, bug issues etc..

Absolutely true, but this still sounds like FUD to me. Many people and organizations are happy to use JBoss AS Community builds in production. With the current policy of moving certain branches to a private source repository and binary artifacts to separate Maven repositories, Red Hat is just making everyone's lives harder, acting maybe not against the legal terms of LGPL but definitely against the spirit of OSS by introducing artificial obstacles.

Anyone intelligent enough to work with JBoss AS will surely be able to build it from source...

In my understanding, there will be no more AS 7.x releases, and the next community release will be WildFly 8.0.0.Final, so if Red Hat do not publish binaries with no strings attached, AS 7.x users will be stuck with 7.1.1. This is really an invitation for people to fork the source repository, backport EAP patches, build the whole lot and publish their own binaries.

I don't think such a fork would benefit the JBoss community, but I can see it coming.

[r.reimann]

Thanks for the replies so far. Since many of them are either explicitly or implicitly tagged with IANAL i'm still missing the definitive answer to my question. Therefore i would be glad to see some Red Hat participation in this thread to get an official answer/clarification.

[michelmemeteau]

Hi All,

Not clear answer yet ? Like for AS 7.1 / EAP 6.0 , the answers to this question become more and more complicated.

Can we just say that EAP is a bit like the Redhat OS ? and thus that removing the redhat trademark from the sources produces a Binary that anybody can use for its own purpose including production ?

[henk53]

Nicklas Karlsson wrote:

I'm also interested (out of curiosity) as to if I can't take the binary and use it for production but if I can build the sources and use that one in production, what must be changed?

Because if the build produces exactly the same binaries then for all approximation, it's the same as using the pre-built thing, right?

I've asked pretty much the same question here: https://community.jboss.org/message/826851#826851

There are quite a lot of threads about this topic, but there's never really a definite answer. There are some answers, but they rarely address everything and then the discussion stops. Typically shortly after a new thread is opened asking pretty much the exact same question and things just repeat.

[stoty2]

6.1.1 is out, and I had a go at compiling it.

It is actually significantly easier to self compile than 6.1.0.

Here is the instructions and the patch:

https://app.box.com/s/b7gwf9zy7wmwsc92f6a2

[stoty2]

Same for 6.2:

https://app.box.com/s/vcxioudpwdg078b9krty

[michelmemeteau]

Finally do we have some clear answer ?

I want to use the same EAP on Critical installs and non critical ones and thus Pay only for the Cores where I need a subscription.