search

dotnet / wcf

This repo contains the client-oriented WCF libraries that enable applications built on .NET Core to communicate with WCF services.
MIT License
1.71k stars 558 forks source link

Impossible to distribute CoreWCF to customers under MIT license when ASP Core is distributed under Microsoft ASP .NET Framework license? #5522

Closed mgexo closed 6 months ago

mgexo commented 6 months ago

It seems to be impossible to distribute CoreWCF to customers under MIT license when ASP Core is distributed under Microsoft ASP .NET Framework license

  1. CoreWCF has dependencies on ASP.NET Core
  2. The ASP.NET Core installer however is not distributable without accepting a special Microsoft ASP .NET License and it seems to be impossible for some customers to distribute that . It also came up as warning in open source license analysis tools . The assumption was, that ASP.NET Core license was not correctly updated and we raised this issue. https://github.com/dotnet/aspnetcore/issues/54434 However, the answer by @wtgodbe was, that it is intentional:

" It's expected that the hosting bundle uses the Microsoft license, as it redistributes some assets from dotnet/runtime & IIS that are not covered by the MIT license."

So, what is the correct way to distribute a software that uses CoreWCF to the clients?

For example, CoreWCF.Primitives depends on AspNetCore https://www.nuget.org/packages/CoreWCF.Primitives#dependencies-body-tab There are some nuget packages from AspNetCore but they seem all outdated/deprecated e.g. https://www.nuget.org/packages/Microsoft.AspNetCore.Hosting.Abstractions due to https://github.com/dotnet/announcements/issues/217

mconnew commented 6 months ago

This is the WCF client repo, CoreWCF is at https://github.com/CoreWCF/CoreWCF. I can still answer some of your question though. There's some nuance here that's important to understand. It's not super obvious what CoreWCF depends on.

CoreWCF has listed a dependency on various Microsoft.AspNetCore.* nuget packages which are at the 2.1.x version. This is because CoreWCF runs on .NET Framework too, and the only supported version of ASP.NET Core that works on .NET Framework is 2.1. If you are targeting a version of .NET, then you either are specifying the Web Sdk in your project file like this:

<Project Sdk="Microsoft.NET.Sdk.Web">

Or you have a framework reference like this:

<ItemGroup>
    <FrameworkReference Include="Microsoft.AspNetCore.App" />
</ItemGroup>

The Web sdk effectively adds the framework reference. What the framework reference does is look for any of the ASP.NET Core packages that are referenced and removes them, instead replacing them with the newer components that ship with .NET. So while it will look like you are referencing the asp.net core nuget packages in your project, it's not using them due to the framework reference/sdk. If you create a CoreWCF project and multi-target .NET Framework (eg net472) and net80, look in the build output folder. For .NET Framework you will see (among others) Microsoft.AspNetCore.dll which is the older 2.1 version. If you look in the .NET 8 folder, you won't see it as it's using the one from the shared runtime.

The original ASP.NET Core releases (including 2.1) were licensed under an Apache open source license. You can see that here. According to various sources online (including here) the MIT license and Apache license are compatible. Note, I'm not giving legal advice, just pointing to what others are saying. I don't think this is a concern for you though as you're asking about asp.net core 8.0.

If you use CoreWCF with .NET 8 in a console based application, everything should be licensed under the MIT license so no license conflicts there (other than confusion caused by installers).

As regards the installers, I started looking into the licenses on each of them and I agree there's some confusing/contradicting info there. I've tracked down the person responsible for the licensing in the installers and pointed him to your original asp.net core issue. I was pointed to this document which might help alleviate concerns about what the intention for how you can use .NET/ASP.NET Core in a commercial application.

I'm going to close this issue as I have addressed the CoreWCF part of things. Follow-up should happen on the original asp.net core issue.