Bug 976180

Summary: dom4j: contains possibly non-free code
Product: [Fedora] Fedora Reporter: Michal Srb <msrb>
Component: dom4jAssignee: Michal Srb <msrb>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: dbhole, hdegoede, mizdebsk, msrb, tcallawa
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: 1.6.1-15 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-07-02 08:45:03 EDT Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 182235    

Description Michal Srb 2013-06-20 01:23:24 EDT
Description of problem:

dom4j contains at least one class taken most probably from Doug Lea's "util.concurrent" project [1]:


This file contains following header:
" Written by Doug Lea. Adapted and released, under explicit
 permission, from JDK1.2 HashMap.java and Hashtable.java which
 carries the following copyright:

 * Copyright 1997 by Sun Microsystems, Inc.,
 * 901 San Antonio Road, Palo Alto, California, 94303, U.S.A.
 * All rights reserved.
 * This software is the confidential and proprietary information
 * of Sun Microsystems, Inc. ("Confidential Information").  You                                           
 * shall not disclose such Confidential Information and shall use
 * it only in accordance with the terms of the license agreement
 * you entered into with Sun."

Lea's util.concurrent project is under public domain, however quoting from [1]:
"All classes are released to the public domain and may be used for any purpose whatsoever without permission or acknowledgment. Portions of the CopyOnWriteArrayList and ConcurrentReaderHashMap classes are adapted from Sun JDK source code. These are copyright of Sun Microsystems, Inc, and are used with their kind permission, as described in this license."

Text of the license is available [2]. It also contains infamous "nuclear" clause.

I am opening this bug, because I am not 100% sure whether licensing is OK or not.

[1]: http://gee.cs.oswego.edu/dl/classes/EDU/oswego/cs/dl/util/concurrent/intro.html
[2]: http://gee.cs.oswego.edu/dl/classes/EDU/oswego/cs/dl/util/sun-u.c.license.pdf
Comment 1 Tom "spot" Callaway 2013-06-20 14:37:25 EDT
Just a thought, but it is possible that the Sun JDK code this is based on has been relicensed. If so, we can ask Oracle to make the same license change on this copied code.
Comment 2 Michal Srb 2013-06-21 03:34:09 EDT
(In reply to Tom "spot" Callaway from comment #1)
> Just a thought, but it is possible that the Sun JDK code this is based on
> has been relicensed.

Indeed, ArrayList.java and HashMap.java are both in our java-1.7.0-openjdk package and they are now licensed under GPLv2.

Interesting thing is that the same class (ConcurrentReaderHashMap.java) is also present in groovy package, but it's licensed under ASL 2.0. And it looks like groovy upstream just replaced original header:

Comment 3 Tom "spot" Callaway 2013-07-01 16:37:12 EDT
I think we should simply ask upstream for this to adjust the header. We'll treat it as being GPLv2.
Comment 4 Michal Srb 2013-07-02 08:05:10 EDT
It looks like we can remove this whole file. dom4j probably doesn't use it anyway. It can be easily patched out. This class is there only as a fallback, normally JDK's java.util.concurrent.ConcurrentHashMap is used.
Comment 5 Michal Srb 2013-07-02 08:45:03 EDT
Fixed in dom4j-1.6.1-15. Thanks for your time Tom, and sorry for the false alarm.