Re: [4.14] binary vs. source package legal docs

2015-01-14 Thread Erik de Bruin
My supremely incapable eyes were thoroughly impressed by the amount of legalese, and all those fancy words sounded true, so the docs must be OK! ;-) EdB On Wed, Jan 14, 2015 at 3:19 PM, Alex Harui wrote: > I took a quick look. Looked good enough for me. > > On 1/13/15, 11:44 PM, "Erik de Bru

Re: [4.14] binary vs. source package legal docs

2015-01-14 Thread Alex Harui
I took a quick look. Looked good enough for me. On 1/13/15, 11:44 PM, "Erik de Bruin" wrote: >I have some time today, I'll try to make sense of what there is to see... > >EdB > > > >On Mon, Jan 12, 2015 at 2:39 AM, Justin Mclean >wrote: >> HI, >> >>> I think we are waiting on Justin go fix up

Re: [4.14] binary vs. source package legal docs

2015-01-13 Thread Erik de Bruin
I have some time today, I'll try to make sense of what there is to see... EdB On Mon, Jan 12, 2015 at 2:39 AM, Justin Mclean wrote: > HI, > >> I think we are waiting on Justin go fix up the build scripts so we can see >> how it all the new license and notice changes look in the release >> cand

Re: [4.14] binary vs. source package legal docs

2015-01-11 Thread Justin Mclean
HI, > I think we are waiting on Justin go fix up the build scripts so we can see > how it all the new license and notice changes look in the release > candidate packages. Done and checked. Looks good to me but if other PMC members can review that would be helpful. Thanks, Justin

Re: [4.14] binary vs. source package legal docs

2015-01-06 Thread Justin Mclean
HI, > I think we are waiting on Justin go fix up the build scripts so we can see > how it all the new license and notice changes look in the release > candidate packages. I was hoping to get to this tomorrow but looks like it going to be Friday. Justin

Re: [4.14] binary vs. source package legal docs

2015-01-06 Thread Alex Harui
On 1/6/15, 12:58 AM, "Tom Chiverton" wrote: >And no body is going to die if it's (still) wrong despite what looks >like heroic efforts over the Christmas break. >We can always amend it again in future if we notice anything. Nobody will die, but we really do have a responsibility to do our best

Re: [4.14] binary vs. source package legal docs

2015-01-06 Thread Erik de Bruin
> Maybe you need to repost or bump the vote thread, because I know I've just We're not voting yet. There are a few fixes forthcoming for the installer scripts, if I understand the situation correctly. EdB -- Ix Multimedia Software Jan Luykenstraat 27 3521 VB Utrecht T. 06-51952295 I. www.ix

Re: [4.14] binary vs. source package legal docs

2015-01-06 Thread Tom Chiverton
And no body is going to die if it's (still) wrong despite what looks like heroic efforts over the Christmas break. We can always amend it again in future if we notice anything. Maybe you need to repost or bump the vote thread, because I know I've just marked everything read as of yesterday when

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Alex Harui
On 1/5/15, 1:56 PM, "Justin Mclean" wrote: >Hi, > >I've made the changes to NOTICE and LICENSE for saxon9 but there may be a >further legal issue we need to resolve. The James Clark license is >MIT/X11 (or similar) license with an anti advertising clause. I think >this is a reaction to the BSD

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Justin Mclean
Hi, I've made the changes to NOTICE and LICENSE for saxon9 but there may be a further legal issue we need to resolve. The James Clark license is MIT/X11 (or similar) license with an anti advertising clause. I think this is a reaction to the BSD license with the advertising clause and should be

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Justin Mclean
HI, When looking for stuff find is your friend - you can use to to search for none Apache licenses or other stuff: In the source this: find . -name "*.*" -exec grep -i "James" {} \; -print 2>/dev/null Shows this: ./net/sf/saxon/regex/JDK15RegexTranslator.java And in the binary: find . -name "

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Justin Mclean
Hi, > I did get a slightly different result. I agree with all of the other > findings, but I think I see James Clark in saxon9.jar. Yep agree that required, looks like he also contributed the RegExp code. Thanks, Justin

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Alex Harui
On 1/5/15, 10:48 AM, "Harbs" wrote: >My eyes kind of glazed over at the beginning of the discussion, so I’m >kind of with Erik on this… Well, at least you are trying to follow. Hopefully, reviewing is easier than figuring out what changes to make. While it would be great to have other PMC me

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Harbs
My eyes kind of glazed over at the beginning of the discussion, so I’m kind of with Erik on this… On Jan 5, 2015, at 8:33 PM, Erik de Bruin wrote: >> FWIW, in case anybody is actually still following this thread, IMO, we >> need at least one more PMC member who plans to vote on this release to

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Erik de Bruin
> FWIW, in case anybody is actually still following this thread, IMO, we > need at least one more PMC member who plans to vote on this release to > review these changes. That’s a reason behind the requirement of 3 +1 > votes, that 3 sets of eyes are better than 1 or 2. We need more PMC > members

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Alex Harui
On 1/5/15, 9:47 AM, "Erik de Bruin" wrote: >While you guys are busy (and please don't let me distract you), a >quick theoretical question: > >Why don't we just throw in each and every license we might possibly >need, and call it a day? What's wrong with one or two too many >licenses? The how-t

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Erik de Bruin
While you guys are busy (and please don't let me distract you), a quick theoretical question: Why don't we just throw in each and every license we might possibly need, and call it a day? What's wrong with one or two too many licenses? EdB On Mon, Jan 5, 2015 at 6:29 PM, Alex Harui wrote: > >

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Alex Harui
On 1/5/15, 1:05 AM, "Justin Mclean" wrote: >JAMESCLARK notice - used in saxon9-xpath.jar > >Any differing opinions? I did get a slightly different result. I agree with all of the other findings, but I think I see James Clark in saxon9.jar. You tend to be better at digging through this stuff,

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Erik de Bruin
> Still to do: > - Modify the binary notice file > - Changes to the build script to copy the new licences into lib external > - Changes to the installer script for the SDK You are working on the first two, correct? And the third, is that an Alex thing, or are you 'on that' as well? EdB -- Ix

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Justin Mclean
Hi, > Since the only other 'opinion' has just gone to bed, please commit. I still have to work out the contents that go into the NOTICE but that's reasonably straight forward. > Am I correct that after these changes all known licensing and other > legal issues have been resolved - for this rele

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Erik de Bruin
Thank you, Justin. Since the only other 'opinion' has just gone to bed, please commit. Waiting for his response will add a delay I'd like to avoid. Alex will review during his morning, and the last time he found no issues in your commit, so I'm sure these changes will be fine as well. Am I correc

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Justin Mclean
Hi, After a look at the notices and peeking inside all of the jars I think I've worked out what we need to add. The following are used in saxon.jar: UNICODE notice CERN notice Resolver notice THAI notice The following are not use or used in other jars: ANT notice - not used Xerces notice - used

Re: [4.14] binary vs. source package legal docs

2015-01-05 Thread Justin Mclean
HI, Interesting enough it ends up we only bundle one of the nine Saxon jars but have included all of the NOTICE files. Unhelpfully the saxon jar we do use doesn't include any LICENSE or NOTICE. Justin

Re: [4.14] binary vs. source package legal docs

2015-01-04 Thread Justin Mclean
Hi, > Why did you decide to call it SAX2 and not just SAX or SAX 2.0? That's the product name eg http://shop.oreilly.com/product/9780596002374.do > And should we also be putting version numbers on all of the other > dependencies? We could, and it is useful, but AFAIK not required. > Also, I

Re: [4.14] binary vs. source package legal docs

2015-01-04 Thread Alex Harui
OK, I went through the changes. I didn’t see anything that looked wrong. A question or two for this: +This produce bundles SAX2 available under a Public Domain license. +For more details see lib/external/LICENSE.sax.txt Why did you decide to call it SAX2 and not just SAX or SAX 2.0? And should

Re: [4.14] binary vs. source package legal docs

2015-01-04 Thread Justin Mclean
HI, > I think some changes need to be made to the build script to pull out the W3C > licenses to where they are supposed to be. That's correct - I've not done that yet. Justin

Re: [4.14] binary vs. source package legal docs

2015-01-04 Thread Alex Harui
I should have thought of this sooner, but I went and looked at COLT and it includes a GenericSorter! I’m short on time today to verify this is the same one as Saxon uses, but assuming it is, I’d say then Saxon should be ok. Also, I haven’t reviewed Justin’s changes to L & N in detail, but from th

Re: [4.14] binary vs. source package legal docs

2015-01-04 Thread Alex Harui
From [1], I would interpret the following: For the purposes of being a dependency to an Apache product, which licenses are considered to be similar in terms to the Apache License 2.0?Works under the following licenses may be included within Apache products: * Apache License 2.0

Re: [4.14] binary vs. source package legal docs

2015-01-04 Thread Erik de Bruin
That is awesome! So, just change NOTICE and we're done with this? EdB On Sun, Jan 4, 2015 at 2:51 PM, Justin Mclean wrote: > Hi, > >> If you and Alex keep on disagreeing > > I actually don't think there's any disagreement here. > > Justin -- Ix Multimedia Software Jan Luykenstraat 27 352

Re: [4.14] binary vs. source package legal docs

2015-01-04 Thread Justin Mclean
Hi, > If you and Alex keep on disagreeing I actually don't think there's any disagreement here. Justin

Re: [4.14] binary vs. source package legal docs

2015-01-04 Thread Erik de Bruin
>> Currently, Saxon is bundled, right? And you and Alex disagree on if it >> can stay that way? > > Well we can go ether way but I would prefer it was bundled as it currently > is. If it is bundled we need to modify NOTICE and I can make the changes to > NOTICE to accommodate that That's what I

Re: [4.14] binary vs. source package legal docs

2015-01-04 Thread Justin Mclean
HI, > Currently, Saxon is bundled, right? And you and Alex disagree on if it > can stay that way? Well we can go ether way but I would prefer it was bundled as it currently is. If it is bundled we need to modify NOTICE and I can make the changes to NOTICE to accommodate that > I will call a vo

Re: [4.14] binary vs. source package legal docs

2015-01-04 Thread Erik de Bruin
> Blocking issues: > - saxon9 if bundled NOTICE will needs to be modified. I look into that > depending on if we decide to bundle it or not. > - saxon9 if not not bundled in the binary release will need to be removed > from LICENSE Currently, Saxon is bundled, right? And you and Alex disagree on

Re: [4.14] binary vs. source package legal docs

2015-01-03 Thread Justin Mclean
HI, Committed the changes to LICENSE and NOTICE files. Changed: - Fixed date and intro of NOTICE to be consistent. - Remove unneeded lines in Xerces NOTICE - Removed commons-logging from LICENSE.bin as per [1] - Remove xalan from LICENSE.bin as per [1] - Removed Xerces (2.9.1) from LICENSE as pe

Re: [4.14] binary vs. source package legal docs

2015-01-03 Thread Alex Harui
On 1/3/15, 11:03 AM, "Erik de Bruin" wrote: IMO, it would be better if I keep making changes and Justin does the review. He’s a much better reviewer and the results will have one authoring style. >>> >>>Your viewpoints are different enough that discussing this until you've >>>reac

Re: [4.14] binary vs. source package legal docs

2015-01-03 Thread Erik de Bruin
>>> IMO, it would be better if I keep making changes and Justin does the >>> review. He’s a much better reviewer and the results will have one >>> authoring style. >> >>Your viewpoints are different enough that discussing this until you've >>reached agreement - which is basically what one person e

Re: [4.14] binary vs. source package legal docs

2015-01-03 Thread Alex Harui
On 1/3/15, 10:35 AM, "Erik de Bruin" wrote: >> IMO, it would be better if I keep making changes and Justin does the >> review. He’s a much better reviewer and the results will have one >> authoring style. > >Your viewpoints are different enough that discussing this until you've >reached agreem

Re: [4.14] binary vs. source package legal docs

2015-01-03 Thread Erik de Bruin
> IMO, it would be better if I keep making changes and Justin does the > review. He’s a much better reviewer and the results will have one > authoring style. Your viewpoints are different enough that discussing this until you've reached agreement - which is basically what one person editing and o

Re: [4.14] binary vs. source package legal docs

2015-01-03 Thread Alex Harui
IMO, it would be better if I keep making changes and Justin does the review. He’s a much better reviewer and the results will have one authoring style. I found the LICENSE and NOTICE for xml-api*.jar (they weren’t in META-INF) so I know what changes to make there. I think we may need to package

Re: [4.14] binary vs. source package legal docs

2015-01-03 Thread Justin Mclean
Hi, And while this is still a work in progress you may want to read this [1] as it makes a few things clearer. Justin 1. https://github.com/rectang/asfrelease/blob/master/release.md

Re: [4.14] binary vs. source package legal docs

2015-01-03 Thread Justin Mclean
Hi, > Are you proposing to add the entire text of W3C to LICENSE or a pointer to > a separate file stored somewhere? A pointer is the preferred method. > Are you also claiming that Batik’s NOTICE is wrong? It most likely wrong- but either way we bundle the xml-* jars so need to modify LICENS

Re: [4.14] binary vs. source package legal docs

2015-01-03 Thread Justin Mclean
Hi, >> IMO, if it ain’t broke, don’t fix it. And it's currently broken - so we need to fix it. > Justin, with this comment of Alex in mind, please commit and we'll > review. I'll have some time tomorrow to do this. Justin

Re: [4.14] binary vs. source package legal docs

2015-01-03 Thread Erik de Bruin
> IMO, if it ain’t broke, don’t fix it. But I’ll let Erik make the call > since he’s the RM. Every change made risks another mistake. I’m signing Justin, with this comment of Alex in mind, please commit and we'll review. Less is more! EdB -- Ix Multimedia Software Jan Luykenstraat 27 3521

Re: [4.14] binary vs. source package legal docs

2015-01-03 Thread Alex Harui
IMO, if it ain’t broke, don’t fix it. But I’ll let Erik make the call since he’s the RM. Every change made risks another mistake. I’m signing off for tonight. I’ll see what you guys think when I wake up. A few more comments in-line. On 1/3/15, 12:07 AM, "Justin Mclean" wrote: >Any Apache 2.

Re: [4.14] binary vs. source package legal docs

2015-01-03 Thread Justin Mclean
Hi, > In looking around, AOO seems to have it in pieces. Other projects have > the full AL in the various versions. Remember other project may not be correct and or predate the current advice. Given it very easy to put the full license in and that is clearer to anyone looking at the code in so

Re: [4.14] binary vs. source package legal docs

2015-01-02 Thread Alex Harui
After reading your notes and reviewing the links, I’m not sure I’m that far off from being “good enough”. My goal is to make the fewest and easiest changes possible to get us into compliance, so I opted for copying entire NOTICE files instead of picking apart pieces of it, leveraging the build scr

Re: [4.14] binary vs. source package legal docs

2015-01-02 Thread Alex Harui
On 1/2/15, 4:16 PM, "Justin Mclean" wrote: >>I’m not clear most of your suggestions are required.' > >Correct not everything there is a licensing error but there several that >would be IMO release blockers. Which ones in your opinion are release blockers? IMO, the rest aren’t worth the energy.

Re: [4.14] binary vs. source package legal docs

2015-01-02 Thread Justin Mclean
Hi, > I don’t have time to reply to all of these points right now but I will later. Once you do I'll make the changes. > I’m not clear most of your suggestions are required.' Correct not everything there is a licensing error but there several that would be IMO release blockers. But as we're ch

Re: [4.14] binary vs. source package legal docs

2015-01-02 Thread Alex Harui
On 1/2/15, 1:40 PM, "Justin Mclean" wrote: >Hi, > >This is for discussion before I make any changes to the current files >after a first pass. They still need a bit of work IMO. I didn’t expect to get it fully right. I don’t have time to reply to all of these points right now but I will later.

Re: [4.14] binary vs. source package legal docs

2015-01-02 Thread Justin Mclean
Hi, This is for discussion before I make any changes to the current files after a first pass. They still need a bit of work IMO. I assume LICENSE.bin is appended to LICENSE as part of the build process, this does mean that if you look at the LICENSE.bin in svn it's not correct. Would it be be

Re: [4.14] binary vs. source package legal docs

2015-01-02 Thread Alex Harui
On 1/2/15, 11:30 AM, "Erik de Bruin" wrote: >> We cannot bundle Saxon in the binary package because there are classes >>in >> the Saxon jar that haven’t been approved as Apache-compatible. While >> other Apache projects “use” Saxon, the first four I looked at don’t >>appear >> to bundle it in

Re: [4.14] binary vs. source package legal docs

2015-01-02 Thread Erik de Bruin
> We cannot bundle Saxon in the binary package because there are classes in > the Saxon jar that haven’t been approved as Apache-compatible. While > other Apache projects “use” Saxon, the first four I looked at don’t appear > to bundle it in their binary packages. At least, I don’t see saxon*.jar

Re: [4.14] binary vs. source package legal docs

2015-01-02 Thread Alex Harui
On 1/2/15, 3:44 AM, "Erik de Bruin" wrote: > >So, if I understand correctly, the current 'consensus' is that there >need to be fixes to LICENSE and NOTICE. Alex has these all but done. >Then there is the issue about the various installer prompts: we either >include a Saxon prompt, or we decide n

Re: [4.14] binary vs. source package legal docs

2015-01-02 Thread Erik de Bruin
>> Then we need to decide whether we want the install scripts to prompt folks >> to accept Saxon or not, and whether we should continue to have folks >> approve OSMF and SWFObject like we currently do. > > We should probably be consistent. If we ask for OSMF we should for Saxon. It > seems clear t

Re: [4.14] binary vs. source package legal docs

2014-12-30 Thread Alex Harui
On 12/30/14, 1:03 AM, "Justin Mclean" wrote: >Hi, > >> Digging into Saxon, I’m stuck on the CERN NOTICE. We are going to have >>to >> ask on legal-discuss to get approval to use Saxon. I will open a LEGAL >> JIRA shortly. > >Do we know if the CERN license actually applies to anything in the j

Re: [4.14] binary vs. source package legal docs

2014-12-30 Thread Justin Mclean
Hi, > Digging into Saxon, I’m stuck on the CERN NOTICE. We are going to have to > ask on legal-discuss to get approval to use Saxon. I will open a LEGAL > JIRA shortly. Do we know if the CERN license actually applies to anything in the jar? The GPL "notice" for instance refers to the .net vers

Re: [4.14] binary vs. source package legal docs

2014-12-30 Thread Alex Harui
Digging into Saxon, I’m stuck on the CERN NOTICE. We are going to have to ask on legal-discuss to get approval to use Saxon. I will open a LEGAL JIRA shortly. A CERN license for something called COLT got approved, but instructions seem to be to ask for any other CERN code. I think we have the o

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Justin Mclean
Hi, > Then we need to decide whether we want the install scripts to prompt folks > to accept Saxon or not, and whether we should continue to have folks > approve OSMF and SWFObject like we currently do. We should probably be consistent. If we ask for OSMF we should for Saxon. It seems clear to

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Alex Harui
Other than Saxon, I think I’m mostly done fixing up LICENSE and NOTICE so that it matches the way we packaged prior releases. I hope to finish Saxon and check it all in tonight or tomorrow. Then it needs review and we might find a few more things we need to change. Then we need to decide whether

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Justin Mclean
Hi, > Do you have the cycles to create a suggested fix for both? As I said I will have later this week, but Alex is currently looking into it and would need to check in what he's done first I think. One of my earlier posts in this thread had details on what the likely changes would be. Thanks

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Erik de Bruin
> Currently the LICENSE and NOTICE files are incorrect, the simple solution is > to fix them. Do you have the cycles to create a suggested fix for both? EdB -- Ix Multimedia Software Jan Luykenstraat 27 3521 VB Utrecht T. 06-51952295 I. www.ixsoftware.nl

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Justin Mclean
Hi, > OK. A little bit dramatic, and half those options exist anyway, as > previous releases have the same issues. Yep as discussed we need to fix those as well. Can be summed up in one line: Currently the LICENSE and NOTICE files are incorrect, the simple solution is to fix them. Justin

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Erik de Bruin
>> No, I meant what would happen if we went ahead a binary release >> without fixing this... > > We can't as we now know it would be against Apache policy. Worse cases > include the board taking action and ask us to remove the releases or > disbanding the PMC, a 3rd party could take us to court,

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Justin Mclean
Hi, > That was my point. Unless we find out that Saxon has some unfriendly > dependencies, the question of whether a binary dependency in the package > was compiled from sources or not or whether the Installer should ask about > MPL and MIT dependencies probably doesn't put the foundation at risk

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Justin Mclean
Hi, > No, I meant what would happen if we went ahead a binary release > without fixing this... We can't as we now know it would be against Apache policy. Worse cases include the board taking action and ask us to remove the releases or disbanding the PMC, a 3rd party could take us to court, busi

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Erik de Bruin
Oops... a little - minor? - 'major/minor' error there ;-) EdB On Mon, Dec 29, 2014 at 5:14 PM, Erik de Bruin wrote: > Can you give me a (realistic) worst case scenario if we were to > release without making any changes? IMO Worse case we can't make a release until this is res

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Erik de Bruin
Can you give me a (realistic) worst case scenario if we were to release without making any changes? >>> >>> IMO Worse case we can't make a release until this is resolved. >> >>No, I meant what would happen if we went ahead a binary release >>without fixing this... Tempting, because we did

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Alex Harui
On 12/29/14, 1:40 AM, "Erik de Bruin" wrote: >>> Can you give me a (realistic) worst case scenario if we were to >>> release without making any changes? >> >> IMO Worse case we can't make a release until this is resolved. > >No, I meant what would happen if we went ahead a binary release >witho

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Alex Harui
On 12/29/14, 1:16 AM, "Justin Mclean" wrote: >Hi, > >> -Can a binary package bundle a binary without its source? > >The answer is yes to that, and in fact we a little unusual as we do >include the SDK source in a binary release. According to what documents? I see that my question was ambiguo

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Erik de Bruin
>> Can you give me a (realistic) worst case scenario if we were to >> release without making any changes? > > IMO Worse case we can't make a release until this is resolved. No, I meant what would happen if we went ahead a binary release without fixing this... Tempting, because we did that nearly a

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Justin Mclean
HI, > Can you give me a (realistic) worst case scenario if we were to > release without making any changes? IMO Worse case we can't make a release until this is resolved. We could make a source release without any changes but given the installer uses the binary that's hardly ideal. Justin

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Justin Mclean
Hi, > -Can a binary package bundle a binary without its source? The answer is yes to that, and in fact we a little unusual as we do include the SDK source in a binary release. > -Was there any past discussion that caused the Installer to ask about > accepting SWFObject’s MIT License? At worse

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Erik de Bruin
Can you give me a (realistic) worst case scenario if we were to release without making any changes? In other words: is this issue a blocker for the 4.14 release or just an issue that we need to take care of for a future release? EdB On Mon, Dec 29, 2014 at 9:42 AM, Alex Harui wrote: > > > On 1

Re: [4.14] binary vs. source package legal docs

2014-12-29 Thread Alex Harui
On 12/28/14, 12:29 PM, "Justin Mclean" wrote: >Hi, > >> Since binary packages are not an act of the foundation, other than the >>explicit >> statement that LICENSE and NOTICE must match the contents of the binary >> package, I can’t imagine that it puts the foundation at risk if we guess >> wr

Re: [4.14] binary vs. source package legal docs

2014-12-28 Thread Justin Mclean
Hi, > Since binary packages are not an act of the foundation, other than the > explicit > statement that LICENSE and NOTICE must match the contents of the binary > package, I can’t imagine that it puts the foundation at risk if we guess > wrong about packaging external jars that are otherwise op

Re: [4.14] binary vs. source package legal docs

2014-12-28 Thread Alex Harui
No response to my query on general@ so far [1] but I think everyone is not as active because of the holidays. Maybe Bertrand can give us his thoughts. I’m working on fixing up the LICENSE and NOTICE for the source package and jar files, and will try to provide easy to comment options for the bina

Re: [4.14] binary vs. source package legal docs

2014-12-28 Thread Erik de Bruin
Even after rereading the thread, I won't pretend to understand what's being discussed, but... Are we any closer to a resolution? if so, is this something that absolutely has to be addressed with this release? EdB On Mon, Dec 22, 2014 at 9:59 AM, Alex Harui wrote: > > > On 12/21/14, 1:13 PM, "

Re: [4.14] binary vs. source package legal docs

2014-12-22 Thread Alex Harui
On 12/21/14, 1:13 PM, "Justin Mclean" wrote: >Hi, > >> Changing the 4.14 LICENSE and NOTICE won’t help older releases. > >I assume we'll have to make point releases of them. It might be worth asking on legal-discuss as to whether that is required. > >> 1) I’m wondering if one of the reasons f

Re: [4.14] binary vs. source package legal docs

2014-12-21 Thread Justin Mclean
Hi, > Changing the 4.14 LICENSE and NOTICE won’t help older releases. I assume we'll have to make point releases of them. > 1) I’m wondering if one of the reasons for the Installer having a checkbox > for SWFObject is because the Installer doesn’t let the customer review > LICENSE and NOTICE of

Re: [4.14] binary vs. source package legal docs

2014-12-21 Thread Alex Harui
@Justin, thanks for the link to “prominent label”. IMO, what to do about older releases is a different topic. Changing the 4.14 LICENSE and NOTICE won’t help older releases. I had two other thoughts on this topic: 1) I’m wondering if one of the reasons for the Installer having a checkbox for SW

Re: [4.14] binary vs. source package legal docs

2014-12-21 Thread Erik de Bruin
Funny thing: I'm with Justin on this ;-) Let's make this simpler for the end-user, not more complicated. If we can reasonable assume that we can either pre-tick something, or leave out the option altogether, we want to do that. We don't want to do something that affects the user "just to make extr

Re: [4.14] binary vs. source package legal docs

2014-12-21 Thread Justin Mclean
Hi, > I’m ok with pulling out SWFObject when we go tweak the install script > unless someone has a good reason it should stay in there. A possible option would be to pre tick and/or remove the checkbox in the installer? > My temptation is to fix this by making Saxon a download behind a prompt

Re: [4.14] binary vs. source package legal docs

2014-12-21 Thread Alex Harui
OK, let me see if I can pull all three responses into one. On 12/20/14, 5:58 PM, "Justin Mclean" wrote: >Hi, > >Also on this subject I've no idea why we are prompting for SWFObject when >it is MIT licensed, as MIT is an compatible licence. The same should >apply to any Category A licenses (ie Ap

Re: [4.14] binary vs. source package legal docs

2014-12-20 Thread Justin Mclean
Hi, Also on this subject I've no idea why we are prompting for SWFObject when it is MIT licensed, as MIT is an compatible licence. The same should apply to any Category A licenses (ie Apache 1.1, BSD and W3C). The installer probably needs some changes from this as it is installing from the bin

Re: [4.14] binary vs. source package legal docs

2014-12-20 Thread Justin Mclean
HI, > It looks like we have not handled Saxon correctly since forever. The install > scripts need to prompt for it. Not sure we actually do need to prompt as per [1] you only need to prompt to download the source not the binary. The week copy left aspects of the licence only apply if you in

Re: [4.14] binary vs. source package legal docs

2014-12-20 Thread Justin Mclean
Hi, > This is a great find. I only found Saxon to not have Category A license. > Did you find the others? Here what I just checked: commons-collections.jar Apache 1.1 commons-discovery.jar Apache 1.1 commons-logging.jar Apache 2.0 has NOTICE no with no downstream effects javacc.jar version 5 B

Re: [4.14] binary vs. source package legal docs

2014-12-20 Thread Alex Harui
This is a great find. I only found Saxon to not have Category A license. Did you find the others? It looks like we have not handled Saxon correctly since forever. The install scripts need to prompt for it. Any volunteers to make the changes or should I do it? The LICENSE.bin is definitely out

[4.14] binary vs. source package legal docs

2014-12-20 Thread Erik de Bruin
Hi, just continuing this discussion here... This is the state we left it in the other thread: >> Maybe because there is no difference in the LICENSE for source and binary >> packages? > >The binary package bundles extra 3rd party jars such as Saxon which is MPL >licensed [1], >that requires cha