Working without wsdl4j because of CPL

[querdenker2k]

My company has a problem with the CPL Licence. Do you see a chance to exclude somehow wsdl4j at runtime?

[ppalaga]

Which specific artifact has the CPL license?

[querdenker2k]

wsdl4j
see here: https://central.sonatype.com/artifact/wsdl4j/wsdl4j -> CPL1.0

[ppalaga]

wsdl4j:wsdl4j is a runtime dependency of org.apache.cxf:cxf-rt-wsdl. You may try to add an <exclusion> in your project and see what happens.

[querdenker2k]

I tried this already. The error is thrown here at runtime

Caused by: java.lang.ClassNotFoundException: javax.wsdl.extensions.ExtensibilityElement
        at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
        at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526)
        at io.quarkus.bootstrap.runner.RunnerClassLoader.loadClass(RunnerClassLoader.java:114)
        at io.quarkus.bootstrap.runner.RunnerClassLoader.loadClass(RunnerClassLoader.java:72)
        at java.base/java.lang.Class.forName0(Native Method)
        at java.base/java.lang.Class.forName(Class.java:534)
        at java.base/java.lang.Class.forName(Class.java:513)
        at io.quarkiverse.cxf.extensibility.AddressTypeExtensibility_Bean.<init>(Unknown Source)
        at io.quarkus.arc.setup.Default_ComponentsProvider.addBeans4(Unknown Source)
        at io.quarkus.arc.setup.Default_ComponentsProvider.getComponents(Unknown Source)
        at io.quarkus.arc.impl.ArcContainerImpl.<init>(ArcContainerImpl.java:129)
        at io.quarkus.arc.Arc.initialize(Arc.java:38)
        at io.quarkus.arc.runtime.ArcRecorder.initContainer(ArcRecorder.java:52)
        at io.quarkus.runner.recorded.ArcProcessor$initializeContainer1770303700.deploy_0(Unknown Source)
        at io.quarkus.runner.recorded.ArcProcessor$initializeContainer1770303700.deploy(Unknown Source)
        ... 9 more

Maybe i give a try for testing and remove all classes from this package io.quarkiverse.cxf.extensibility?

[ppalaga]

Maybe i give a try for testing and remove all classes from this package io.quarkiverse.cxf.extensibility

It is worth trying, but it might not be all you need to do. There are some classes in CXF referring to classes from wsdl4j.

Another less intrusive strategy could be to remove only the @ApplicationScoped annotation from those classes, so that they are not loaded at application start - that's what the stack trace is showing.

[querdenker2k]

I tried to remove this classes and excluded wsdl4j. This results in ClassNotFoundException's inside CXF.
Finally i would say there is no way to exclude wsdl4j here.

[ppalaga]

This results in ClassNotFoundException's inside CXF.

Could you please paste the stack trace?

[querdenker2k]

After removing class Target_org_apache_cxf_wsdl_ExtensionClassGenerator and package io.quarkiverse.cxf.extensibility this is the stacktrace while starting my application.

2025-06-12 09:57:11,941 ERROR [io.qua.run.Application] (main) Failed to start application: java.lang.RuntimeException: Failed to start quarkus
        at io.quarkus.runner.ApplicationImpl.doStart(Unknown Source)
        at io.quarkus.runtime.Application.start(Application.java:101)
        at io.quarkus.runtime.ApplicationLifecycleManager.run(ApplicationLifecycleManager.java:119)
        at io.quarkus.runtime.Quarkus.run(Quarkus.java:80)
        at io.quarkus.runtime.Quarkus.run(Quarkus.java:51)
        at io.quarkus.runtime.Quarkus.run(Quarkus.java:144)
        at io.quarkus.runner.GeneratedMain.main(Unknown Source)
        at io.quarkus.bootstrap.runner.QuarkusEntryPoint.doRun(QuarkusEntryPoint.java:68)
        at io.quarkus.bootstrap.runner.QuarkusEntryPoint.main(QuarkusEntryPoint.java:36)
Caused by: java.lang.NoClassDefFoundError: javax/wsdl/WSDLException
        at io.quarkiverse.cxf.transport.VertxDestinationFactory.<init>(VertxDestinationFactory.java:43)
        at io.quarkiverse.cxf.transport.CxfHandler.<init>(CxfHandler.java:87)
        at io.quarkiverse.cxf.CXFRecorder.initServer(CXFRecorder.java:268)
        at io.quarkus.runner.recorded.CxfEndpointImplementationProcessor$startRoute1005344633.deploy_0(Unknown Source)
        at io.quarkus.runner.recorded.CxfEndpointImplementationProcessor$startRoute1005344633.deploy(Unknown Source)
        ... 9 more
Caused by: java.lang.ClassNotFoundException: javax.wsdl.WSDLException
        at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
        at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526)
        at io.quarkus.bootstrap.runner.RunnerClassLoader.loadClass(RunnerClassLoader.java:114)
        at io.quarkus.bootstrap.runner.RunnerClassLoader.loadClass(RunnerClassLoader.java:72)
        ... 14 more

loading SoapTransportFactory fails because of the import of WSDLException

[ppalaga]

I do not think, it can work.

[ppalaga]

What's wrong with the CPL Licence?

[querdenker2k]

in general this (generated from ChatGPT)

1. Jurisdiction and choice of law clause
The CPL includes a clause that specifies:

Governing law and venue are in the State of New York, USA.

This means:

If there is a legal dispute over the use of CPL-licensed software, the case would have to be resolved in a U.S. court, under New York law.

For organizations based in the EU, UK, or elsewhere, this is unacceptable or highly risky from a legal and cost perspective.

As a result, many legal departments take a strict stance and prohibit the use of CPL-licensed software entirely.

2. Patent clause
The CPL includes a patent grant, but only under specific conditions. This creates issues:

The scope of the patent license is unclear in edge cases, especially when software is modified or redistributed.

For companies operating in industries with patent risks or litigation concerns, this is seen as legally ambiguous and potentially dangerous.

Rather than trying to interpret or accept this legal risk, companies often choose the safer route:

They blacklist CPL-licensed code by default.

[ppalaga]

Thanks for the input. Could you perhaps check the history of the original CVS repo on https://sourceforge.net/p/wsdl4j/code/ and find out if all contributions were from IBM? If so, I could try to ask around if the license could be changed to EPL.

[maxandersen]

@querdenker2k the wsdl4j library is really old but stable software. The likelihood of getting a reimplementation or even being able to relicense is quite slim to none to be honest. The library is used in countless opensource projects, foundations and enterprises using webservices today and has been there for decades by now.

I see you have two options:

1. go to whoever is requiring this license to not be used and ask for an exception given that this library is widely used and no known alternative.

2. contact Red Hat Support or similar orgs you have a support contract with to work with you and your company on how to resolve this.

Though I'm pretty sure #2 first reply would be to try do #1.

[joergsesterhenn]

Out of curiosity: If quarkus relies on wsdl4j code at runtime, would the copyleft requirement in cpl not force quarkus to provide their code under cpl?