"Several people have suggested that JBoss is infringing Sun's copyrights by incorporating some of Sun's code into JBoss. We have carefully reviewed the JBoss code base and are confident that, with the exception of seven jars, all code distributed with JBoss was independently written by JBoss project contributors. As for those seven jars, that code was licensed from Sun under Sun's Binary Code License Agreement, which provides that JBoss can distribute that software in binary code format only. JBoss is fully complying with the terms of that license. "
JBoss version 3.0.4 (released much later than that article) included three source files in jboss-3.0.4-src/security/src/main/javax/security/auth containing Sun copyright notices. The build instructions read:
| Unjar the jaas.jar into the build.classes dir so that we can replace
| the javax.security.auth.login.LoginConfig class with one that uses
| the thread context classloader for LoginModules -->
It looks like they were patching Sun source code for whatever reason. IANAL, but my reading of the JAAS binary code license tells me that they shouldn't be doing this.
Well, this is what my notes tell me at least. Verifying this might be difficult, since the sources for the 3.0.4 release appear to be absent from the download page. I suppose I could be wrong.