The JBoss sources seem to include Sun's JavaMail and JAF. These are CDDL-licensed, which could be a problem for Debian. Can they be safely replaced with the classpathx versions?