multibit-legacy / multibit-commons Goto Github PK

It would make it easier to redistribute multibit-commons if each source file contains a license header.

These files are without license headers:
./src/main/java/org/multibit/commons/concurrent/SafeExecutors.java
./src/main/java/org/multibit/commons/concurrent/SafeScheduledThreadPoolExecutor.java
./src/main/java/org/multibit/commons/concurrent/SafeThreadPoolExecutor.java
./src/main/java/org/multibit/commons/crypto/AESUtils.java
./src/main/java/org/multibit/commons/crypto/ECUtils.java
./src/main/java/org/multibit/commons/crypto/PGPUtils.java
./src/main/java/org/multibit/commons/files/SecureFiles.java
./src/main/java/org/multibit/commons/utils/Dates.java
./src/main/java/org/multibit/commons/utils/HttpsUtils.java
./src/test/java/org/multibit/commons/utils/DatesTest.java

Check https://bugzilla.redhat.com/show_bug.cgi?id=1331589#c8 for details

When I include this library in my project (indirectly through 'org.multibit.hd.hardware:trezor:0.7.0'), slf4j gets confused when finding logback-classic on the classpath. It reports:

SLF4J: Class path contains multiple SLF4J bindings.
SLF4J: Found binding in [jar:file:/path/slf4j-jdk14-1.7.21.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/path/logback-classic-1.1.2.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
SLF4J: Actual binding is of type [org.slf4j.impl.JDK14LoggerFactory]

A library JAR that uses slf4j shouldn't require (transitively include) a particular binding. My workaround is to use the Gradle exclude module: option:

compile ('org.multibit.hd.hardware:trezor:0.7.0') {
    exclude module: "logback-classic"
}

The license for ./src/main/java/org/multibit/commons/sntp/NtpMessage.java is GPLv2+

There is no information in the LICENSE file or in pom.xml that multibit-commons ships code with GPL license.

For more security, can you change old spongycastle (based on old bouncycastle) to bouncycastle?

• https://www.bouncycastle.org/
• https://www.bouncycastle.org/releasenotes.html
• http://www.bouncycastle.org/latest_releases.html
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncy%20castle
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncycastle
• https://www.cvedetails.com/vulnerability-list/vendor_id-7637/Bouncycastle.html