Page History

...

• Software developed at the ASF is made available at no cost and without warranty

• Commercial products may include ASF software without entering into any form of contract with the ASF, or even notifying us

  • Vendors of said commercial products though, must inform end users as indicated in section 4a of the Apache License, Version 2.0
  • Once informed, it is the responsibility of end users to keep track of whether and where an ASF software is used and which version(s), possibly with the help of a Software Asset Management (SAM)
  • End users may purchase these products but may have little interest or ability to apply fixes

• 
  

• There is a natural nesting that happens as software dependencies propagate through applications.  Addressing vulnerabilities in base level components (e.g. log4j) has a cascading impact.  Unless and until all downstream systems have effectively automated build, test and deployment systems, this creates systemic risk which has nothing to do with OSS per se.
• ASF software is used in running systems in basically 2 ways:
  • A distributed system includes a running ASF product (e.g. Apache web server)
  • ASF software is integrated with other software to build applications.  When applications created are themselves used to create other applications, nesting happens, causing the impact of a vulnerability or incompatible change at the lowest level to have a cascading impact.   When a new release is made available by an ASF project, downstream users need to minimally make configuration changes and test their systems.  They typically have to rebuild and redeploy their applications.  In nested situations, this often has to happen sequentially.

...