Bug 814687 - jmol: Bundled libraries
jmol: Bundled libraries
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: jmol (Show other bugs)
rawhide
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Stanislav Ochotnicky
Fedora Extras Quality Assurance
:
Depends On: 820117
Blocks: FE-Legal DuplicSysLibsTracker
  Show dependency treegraph
 
Reported: 2012-04-20 08:23 EDT by Mikolaj Izdebski
Modified: 2012-05-09 04:26 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-05-09 03:56:34 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Mikolaj Izdebski 2012-04-20 08:23:15 EDT
/usr/share/java/Jmol.jar seems to be bundling several libraries.

The following Java packages are included in Jmol.jar:

com.lowagie.text
com.lowagie.tools
com.obrador
com.sparshui.client
com.sparshui.common
com.sparshui.gestures
com.sparshui.inputdevice
com.sparshui.server
javax.vecmath
org.apache.commons.cli
Comment 1 Susi Lehtola 2012-04-21 11:25:19 EDT
Patches are welcome.
Comment 2 Stanislav Ochotnicky 2012-04-23 07:38:53 EDT
(In reply to comment #1)
> Patches are welcome.

That is...kind of unexpected. I would hope that maintainer who learns that his package is going against the packaging guidelines in a *really* ugly way would go out of his way to fix the situation. I am not talking about bundling that the upstream is doing (com.obrador, com.sparshui), but bundling libraries that are already present in other Fedora packages is not exactly nice. As it is, jmol should have never passed the Package review process.

Removing "unjar" ant tasks, and putting proper jar files on classpath during build and in the shell script that is used to run the jmol application should not be *that* problematic for one of maintainers I would hope.
Comment 3 Stanislav Ochotnicky 2012-04-23 08:01:00 EDT
Moreover if nothing else this package is bundling apache-commons-cli but it is still claiming to be pure LGPLv2+.

Note that upstream is bundling jakarta-commons-cli 1.0, which used ASL 1.1. But we build against commons-cli 1.2 which is ASL 2.0. This makes COPYRIGHT.txt included with the package incorrect because it states among 3d party dependencies:
"Jakarta Commons CLI
  Used for parsing command line optinos. Distributed with The Apache Software
  License, Version 1.1. Copyright (c) 1999-2001 The Apache Software Foundation.
  See http://jakarta.apache.org/commons/cli/."

Blocking FE-LEGAL, because not sure what is the best course of action now. Unbundling at least apache-commons-cli is obviously needed, but I would like guidance for the above case where upstream is building against a differently licensed project. I would assume modifying COPYRIGHT.txt to include some kind of "Fedora note: ..." would be OK? Also, in case it stays bundled it should include NOTICE file required by ASL 2.0?

Similarly, this is bundling itext, which has a license of "(LGPLv2+ or MPLv1.1) and ASL 2.0 and BSD and LGPLv2+" so this if falling short on copyright requirements set by some of these licenses.
Comment 4 Tom "spot" Callaway 2012-04-23 09:54:11 EDT
Ugh. Stanislav, would you be willing to try to rework this package so that it doesn't bundle anymore? If you'll do that, I'll sanity check it and commit the change to resolve this legal issue. (Normally, I'd take a crack at it, but I suspect you'll be able to do it a lot faster and cleaner than I will.)
Comment 5 Stanislav Ochotnicky 2012-04-24 09:42:50 EDT
OK, I'll have a look but currently having a few high priority bugs so this might take a week or two. Reassigning to myself so I don't forget
Comment 6 Stanislav Ochotnicky 2012-05-09 03:40:59 EDT
(In reply to comment #4)
> Ugh. Stanislav, would you be willing to try to rework this package so that it
> doesn't bundle anymore? If you'll do that, I'll sanity check it and commit the
> change to resolve this legal issue. (Normally, I'd take a crack at it, but I
> suspect you'll be able to do it a lot faster and cleaner than I will.)

I've fixed major bundling of things we have in Fedora (commons-cli, itext, vecmath). There are still things in src/ that I still don't like, such as src/com/{obrador,sparshui) packages that seem like forks of other packages, but I couldn't find the original ones in 15 minutes on Google and not planning to spend more. Plus at least sparshui comments seem to suggest modifications of upstream code anyway.

I noticed just now that com/sparshui/cpp directory actually contains an exe file too. Not a big deal I assume, but should be removed in prep.
Comment 7 Susi Lehtola 2012-05-09 03:56:34 EDT
Thanks a lot!

I removed the exe file.

Note You need to log in before you can comment on or make changes to this bug.