Are non-EPL-licensed optional components included in the CBC source repo or dependencies?

[jhmgoossens]

In short: Is it correct that none of non-EPL-licensed optional components (GLPK, etc.) are included in the source repo of CBC and related dependencies?

I build CBC and its dependencies (Cbc, Clp, Cgl, Osi, CoinUtils, BuildTools) from the master branch of their repos.
These all mention EPL v2 as license in their root folder’s LICENSE file.

However, optional components exist such as GLPK, GNU Readline, GNU History, AMPL Solver Library (ASL), BLAS and LAPAC (etc.) that use different licenses, and that I therefore want to avoid.
Maybe a silly question, but such components are not in the normal repos (like https://github.com/coin-or/cbc), or are they?
Because if they are not, then as a consequence these optional components are not in my self-built CBC.
Thank you for your help.
Jan-Willem

[tkralphs]

We are pretty careful with licensing in general. No source from any of the third-party dependencies are included in any repo within the "coin-or" Github organization. All projects in the Optimization Suite are entirely licensed under the EPL. We use the term "Third Party" specifically to mean software that may be under a different license and/or copyright and that we therefore do not redistribute ourselves. We do link to available third-party libraries when they are already present on the user's machine. For the most part, it is up to the user to be aware of this.

There are separate projects within the "coin-or-tools" Github organization that provide convenience scripts for downloading and building the source for some of these third-party dependencies. If you use the convenience scripts, it is up to you to be aware of the licenses of the downloaded code. If you use the coinbrew script to fetch a project and its dependencies, some of these convenience scripts may be run automatically. Currently, coinbrew does download third-party sources by default. I'm slowly rolling out a more nuanced dependency specification system that will categorize third-party packages as "optional" or "recommended" and will not download optional packages by default. If coinbrew downloads and builds any third-party codes automatically, you may end up with some of these dependencies as part of your self-built binary.

You can prevent download of any third party source code by coinbrew by adding the argument "--no-third-party", but this will not prevent the configure script from finding certain libraries that are already installed on your system and linking to them. That should not be an issue unless you build and redistribute a static executable, which could then possibly include parts of the dependent libraries. To prevent this, you would need to use the appropriate arguments to the configure scripts to suppress use of particular libraries. If you are building with shared libraries, then it is easy to verify with "ldd" what libraries are being linked to, including both those that are present on the system, e.g., were installed using a package manager, and those that were built using our wrappers.

As for the distributed binaries, the answer may vary, depending on the specific version and platform. We've been evolving our recipe over time according to feedback. For non-static binaries, it's easy to check what exactly is distributed by checking the contents of the archive after downloading (though again, there is a chance the code might use a shared library already installed on your system under Linux, for example). For static binaries, you would need to check the recipe used to generate the binary, which would be in either the travis.yml or appveyor.yml configuration files for Linux/OS X and Windows, respectively.

Hope this helps and feel free to follow up with any further questions.

[jhmgoossens]

Thank you for the elaborate answer.
For my builds from source code repos (without coin brew) this is very clear indeed: no third party code.
Whenever I will build from a stable release’s tarball, I’ll verify what’s in the tarball.

Thanks again for your help.