[ros-users] [Discourse.ros.org] ROS GNU GPL v1.2 issue

[S Riluvan]

Hello - I work for an organization which has stringent legal review for open source products. We have recently scanned ROS Indigo Desktop Full version using open source scanning tool called Blackduck. The scanning tool found some of the ROS components withGPL dependency. One of the component xmlrpcpp is mentioned as  <license>LGPL-2.1</license> in the package.xml file. However, the xmlrpc.h under "lib" folder says it is "GNU GPL" license in the comments section (copied below). Since ROS is distributing this file which is licensed under GPL v2.1, doesn't this make ROS also be GPL product?  While we are thinking of proposing a minimalist approach to have ROS Base edition and add components as needed, found that even ROS Base is distributed with these xmlrpc files that carry GPL v1.2 license requirement mentioned.

Here is the summary of license conflict:
Here is the summary of conflicts  
CPL 1.0  IVCON_generic 
GNU LGPL  gazebo_ros_pkgs_generic - 
GPL v2.1  KDL_generic v2.1; orocos_kinematics_dynamics; Stage; xmlrpc_generic; xmlrpcpp_generic


Snippet from xmlrpc.h file:
"6.// XmlRpc++ Copyright (c) 2002-2003 by Chris Morley
7.// This library is free software; you can redistribute it and/or
8.// modify it under the terms of the **GNU Lesser General Public**
**9.// License** as published by the Free Software Foundation; either
10.// version 2.1 of the License, or (at your option) any later version."






---
[Visit Topic](https://discourse.ros.org/t/ros-gnu-gpl-v1-2-issue/1642/1) or reply to this email to respond.