Hello - I work for an organization which has stringent legal review for open source products. We have recently scanned ROS Indigo Desktop Full version using open source scanning tool called Blackduck. The scanning tool found some of the ROS components withGPL dependency. One of the component xmlrpcpp is mentioned as LGPL-2.1 in the package.xml file. However, the xmlrpc.h under "lib" folder says it is "GNU GPL" license in the comments section (copied below). Since ROS is distributing this file which is licensed under GPL v2.1, doesn't this make ROS also be GPL product? While we are thinking of proposing a minimalist approach to have ROS Base edition and add components as needed, found that even ROS Base is distributed with these xmlrpc files that carry GPL v1.2 license requirement mentioned.

How do we use ROS without conflicting GPL license terms in some of the files?

Here is the summary of license conflict: Here is the summary of conflicts – CPL 1.0  IVCONgeneric GNU LGPL  gazeborospkgsgeneric - GPL v2.1  KDLgeneric v2.1; orocoskinematicsdynamics; Stage; xmlrpcgeneric; xmlrpcpp_generic

Snippet from xmlrpc.h file: "6.// XmlRpc++ Copyright (c) 2002-2003 by Chris Morley 7.// This library is free software; you can redistribute it and/or 8.// modify it under the terms of the GNU Lesser General Public 9.// License as published by the Free Software Foundation; either 10.// version 2.1 of the License, or (at your option) any later version."