[vfs][Chainsaw]: Web start + external dependances + license=ouch

[cross posting to both lists, as I am hoping this would give me more chance
of someone knowing what to do here]

As discussed previously, I am keen to integrate log4j Chainsaw v2 and VFS,
to take advantage of VFS's features of transparency of where the files are
located. We're also using Java Web Start as a basis for deploy. To recap a
previous email, Web start requires that all jars used by the app are signed,
and all jars must be accessed during launched from a single code-base url
for security reasons (as far as I can tell from reading).  

Fine, I can do that for all the Apache ones, but what do I do for the
external ones like JSch ?(listed here
http://jakarta.apache.org/commons/sandbox/vfs/download.html).

Theoretically I could download those jars, sign 'em, and upload them to the
apache servers where the other jars are... Except... I'm/We are not allowed
to host external jars on the Apache servers from what I've heard/read
before. (licensing issues).  Is that right?

So now I am in a catch-22, I am not allowed to host the external jars, and
can't access the jars from a separate URL code-base via Web Start.  So VFS
might be impossible to integrate into Chainsaw.

Anyone got any ideas?  JSch is a LGPL license, so not sure if that makes it
easier or harder to allow an Apache server to host the jar.

Should I post this somewhere else?

Help!

cheers,

Paul Smith