Bug 876845 - msv: non-free license
msv: non-free license
Status: CLOSED NEXTRELEASE
Product: Fedora
Classification: Fedora
Component: msv (Show other bugs)
18
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Mikolaj Izdebski
Fedora Extras Quality Assurance
: Upstream
Depends On:
Blocks: FE-Legal 876881
  Show dependency treegraph
 
Reported: 2012-11-15 01:39 EST by Mikolaj Izdebski
Modified: 2013-04-12 06:38 EDT (History)
4 users (show)

See Also:
Fixed In Version: 2013.2.3-1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 876881 (view as bug list)
Environment:
Last Closed: 2013-04-12 06:38:39 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Mikolaj Izdebski 2012-11-15 01:39:19 EST
msv appears to be non-free for various reasons (no modification allowed and nuclear clause are just examples of such reasons).

Quoting from xsdlib/doc/copyright.txt

> This product is distributed under licenses
> restricting its use, copying, distribution, and decompilation. No part
> of this product may be reproduced in any form by any means without
> prior written authorization of Sun and its licensors, if any.

Quoting from generator/doc/license.txt:

> 2.  RESTRICTIONS.  Software is confidential and copyrighted.
> Title to Software and all associated intellectual property
> rights is retained by Sun and/or its licensors.  Except as
> specifically authorized in any Supplemental License Terms,
> you may not make copies of Software, other than a single
> copy of Software for archival purposes.  Unless enforcement
> is prohibited by applicable law, you may not modify,
> decompile, or reverse engineer Software.  You acknowledge
> that Software is not designed, licensed or intended for use
> in the design, construction, operation or maintenance of any
> nuclear facility.
Comment 1 Tom "spot" Callaway 2012-11-15 11:14:12 EST
The xsdlib copyright.txt isn't a problem because license.txt is also provided, which is "prior written authorization of Sun and its licensors", making it clear that the xsdlib code is BSD.

I'm 99% sure that generator/doc/license.txt, even as amended with SUPPLEMENTAL LICENSE TERMS is non-free. I'll double-check that with RH Legal.

Nothing seems to depend on msv, so it might be easier to simply drop it. If we really want to try to keep it, we'll need to reach out to Oracle to see if they are willing to relicense the generator/ code.
Comment 3 Tom "spot" Callaway 2012-11-28 14:42:36 EST
The Generator license is confirmed to be non-free. Mat, can you reach out to the upstream for this project to see if we can get Oracle to grant permission for us to use the generator/ code under a Free License? They typically prefer BSD, which would match the license of xsdlib/.
Comment 4 Mikolaj Izdebski 2012-12-13 10:05:28 EST
What is the progres on this bug?

This is a serious issue, as this package contains non-free software and it cannot simply be removed because there are numerous dependant packages (at least dom4j, relaxngcc, woodstox-core, possibly more).
Comment 5 Tom "spot" Callaway 2012-12-17 17:09:29 EST
Emailed Oracle to try to resolve licensing issue.
Comment 6 Mikolaj Izdebski 2013-01-28 04:53:24 EST
MSV consists of several subpackages, only two of which are required by other Fedora packages (msv-msv and msv-xsdlib).

The msv-msv package seems to be free. It is licensed under mixture of different licenses: ASL 1.1 and ASL 2.0 and BSD (different variants). The text ASL 2.0 is not provided, which violates point 4(a) of the license, so in Fedora we would have to include a separate copy of ASL 2.0 to fulfill this requirement.

The msv-xsdlib package appears to be licensed under BSD and ASL 1.1. File xsdlib/doc/copyright.txt lists some use restrictions (as quoted in comment #0), but Sun explictly granted permission to redistribute and use the software under BSD license (file xsdlib/doc/license.txt). I think this qualifies as "written authorization of Sun", so that restrictions from copyright.txt can be ignored, making msv-xsdlib free.

I didn't analyze the other subpackages of msv, but they are not needed, their licensing is complex and at least one of them (msv-xmlgen) is non-free. As a solution to this bug I will remove all unneeded subpackages of msv leaving only msv-msv and msv-xsdlib, which in my opinion are free.
Comment 7 Tom "spot" Callaway 2013-01-28 11:16:53 EST
The generator/ code is non-free as is. I don't recall which part of msv is using it, but I am hopeful that Oracle will eventually manage to relicense it. I'll send another email to them to check on the status.
Comment 8 mejiko 2013-02-18 05:08:00 EST
I checked all msv source.

checks and results:


msv-2009.1/generator/*

Not OK, This source non-free. (See doc/license.txt) This license not allowd modify, field of use restriction.


msv-2009.1/msv/* 

OK, This is free (3 cause BSD License and Apache License 1.1, See license.txt and README.txt ). 

And msv-2009.1/msv/contrib/sunmsv.el is under GPLv2+, but license file is not find. Is this is OK ?


msv-2009.1/parent/* 

OK, This is free (3 cause BSD License, See msv-2009.1/parent/pom.xml)


msv-2009.1/relames/* 

Not OK. This source is non-free. (license statement is not find, See doc/copyright.txt)


msv-2009.1/repo/* 

included *.jar files, Is this is OK ?


msv-2009.1/rngconverter/* 

OK, This is free (3 cause BSD License, See doc/license.txt)


msv-2009.1/schmit/*

Not OK, This is non-free. (license infomation is not find.)


msv-2009.1/shared/*

bundled external library. Is this is OK ?


msv-2009.1/tahiti/* 

Not OK. This source is non-free. (license statement is not find, See doc/copyright.txt)


msv-2009.1/testRepository/*

Empty. No problem.


msv-2009.1/testharness/* 

OK, This is free (3 cause BSD License, See "doc/BSD license.txt")


msv-2009.1/trexconverter/* 

Not OK. This source is non-free. (license statement is not find, See doc/copyright.txt)


msv-2009.1/www

Not OK, This is non-free. (license infomation is not find.)


msv-2009.1/xsdlib

OK, This is free (3 cause BSD License and Apache License 1.1, See license.txt and README.txt).



I view msv web page. msv is licensed under BSD License.

See: 

msv-2009.1/www/index.html
http://msv.java.net
http://msv.java.net/License.txt


Thanks.


Reference:

http://packages.debian.org/changelogs/pool/main/m/msv/msv_2009.1+dfsg1-3/libmsv-java.copyright

http://anonscm.debian.org/gitweb/?p=pkg-java/msv.git;a=blob;f=debian/README.source;h=8995f58cd799db07de3c626573ca3159493f4dd0;hb=HEAD

https://fedoraproject.org/wiki/Licensing/Sun_Binary_Code_License_Agreement

https://fedoraproject.org/wiki/Packaging:Guidelines#No_inclusion_of_pre-built_binaries_or_libraries
Comment 9 mejiko 2013-02-18 05:16:19 EST
I found typo. (Comment 8)

incorrent: msv-2009.1/www
incorrent: msv-2009.1/xsdlib

corrent: msv-2009.1/www/*
corrent: msv-2009.1/xsdlib/*


Sorry.
Comment 10 Mikolaj Izdebski 2013-02-24 05:11:58 EST
This bug was marked as resolved by upstream:
  http://java.net/jira/browse/MSV-3

Recently this was fixed in SVN too:
  http://java.net/projects/msv/sources/svn/show/trunk

Looks like updating to latest upstream version (currently 2013.2.2) will resolve this issue.

See also:
  http://lists.debian.org/debian-java/2013/01/msg00041.html
Comment 11 Fedora Update System 2013-04-12 06:33:29 EDT
msv-2013.2.3-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/msv-2013.2.3-1.fc19
Comment 12 Michal Srb 2013-04-12 06:38:39 EDT
latest upstream version (2013.2.3) is now in Rawhide and F19, so this issue should be solved now.

Note You need to log in before you can comment on or make changes to this bug.