Hi Jody,
+geoserver-devel
On Tue, 26 May 2020 09:51:24 -0700
Jody Garnett <jody.garnett@anonymised.com> wrote:
As noted in recent meeting, the org.json license has a conflict with
the LGPL license, as per:- https://directory.fsf.org/wiki/License:JSON
There is an action item to discuss what to replace it with
This puzzled me and I did some research on it.
gs-main, gs-wfs and several other modules of GeoServer are using:
net.sf.json-lib:json-lib:jar:2.4.2-geoserver:compile
This is ASL-2.0 licensed (BTW, where is the source code of the
geo-solutions' 2.4.2-geoserver release?). It is based on json.org-work,
so I first thought it might be illegally "whitewashed" with just
exchanging the license header from "not-evil-MIT" to ASL-2.0. But as is
explained in a bug report [0], Douglas Crockford was weak at some point
in time and published once an ASL-2.0 version. That's no longer on his
homepage, but Fedora archived it. json-lib is based on this
ASL-variant, so now all evils in the world can profit from his work,
not just IBM and the minions[1]. I think this is a very interesting
part of Free (or not so free) Software history 
GeoTools is dragging in another one:
[INFO] +- org.geotools:gt-geojson:jar:24-SNAPSHOT:compile
[INFO] | +- com.googlecode.json-simple:json-simple:jar:1.1.1:compile
json-simple looks like being independently written, so there should be
no license-issue too.
Björn
[0] https://github.com/kordamp/json-lib/issues/25
[1]
https://www.youtube.com/watch?v=-C-JoyNuQJs&feature=player_detailpage#t=2480s