I'm looking at using PicketLink in one of my projects but have noticed there seems to be some inconsistency as to what license PicketLink is released under and this will affect whether I can use it in my project. The PicketLink home page says that it is released under the Apache 2.0 license, as does the project documentation (1.5. License), along with the license.txt file on GitHub. The problem is that several of the source code files in GitHub contain a header indicating they are licensed under the GNU Lesser General Public License. A few examples include PicketLinkExtension.java, AbstractIdentity.java, and SecurityConfigurationBuilder.java
Is the whole PicketLink library which includes the source code examples highlighted above released under the Apache 2.0 license, the GNU Lesser General Public License or a combination of the two?