Hi, I aggree with the assessment. There are two .java files without CPE header (in fact without any license header):
make/langtools/netbeans/nb-javac/test/com/sun/tools/javac/parser/DocCommentParserTest.java Test only, so I would not expect it in the final jar src/jdk.compiler/share/classes/com/sun/tools/javac/resources/LauncherProperties.java As Neil already pointed out, this needs fixing (though I don't think this is critical). It is regrettable, that Oracle still does not manage to declare a clear and unambiguous license. It was claimed, that Oracle would need to invent a new license to make this clear. This is untrue. The orginal GNU Classpath license: https://www.gnu.org/software/classpath/license.html is identical to the Oracle version, BUT it does not have the "uncertainty" element. Oracle decided to add the "Certain source files distributed ..." paragraph, which make the license from my POV problematic as it puts the uncertainty onto the user and not the copyrightholder. In the future I wonder whether each nb-javac release will need to be vetted like this, because a big tech company does not manage to get its license story straigt. This also raises the question whether the build is reproducible and whether it is ok, that there is no direct connection between the binary artifact ant the source artifact. Greetings Matthias Am Sonntag, dem 16.05.2021 um 11:12 +0200 schrieb Jaroslav Tulach: > Hello guys, > let's continue the tradition of manual inspection of nb-javac sources[1][2]. > > NetBeans project downloads both nb-javac JAR files from Maven central - the > standard Java way of distributing, using and archiving Java libraries/ > artifacts. Essential part of that system is `pom.xml` file with a mandatory > `<license>` element. In case of nb-javac@16.0.0.0 it says: > https://search.maven.org/artifact/com.dukescript.nbjavac/nb-javac/16.0.0.0/jar > "Licenses: GPLv2-CPE". As that license comes directly from the Oracle's nb- > javac project: > https://github.com/oracle/nb-javac/blob/release124/make/langtools/netbeans/nb-javac/pom-nb-javac.xml#L18 > and the intention of that element is to state the license of the uploaded > Maven central artifacts, it is natural for a Java developer to conclude that > "nb-javac (as uploaded to Maven central) is fully licensed under GPLv2-CPE". > > In addition to the above evidence, let's do a manual verification: > > ```bash > $ wget https://repo1.maven.org/maven2/com/dukescript/nbjavac/nb-javac/ > 16.0.0.0/nb-javac-16.0.0.0-sources.jar > $ unzip nb-javac-16.0.0.0-sources.jar > $ rm nb-javac-16.0.0.0-sources.jar > ``` > now one can build the two nb-javac JARs successfully with: > ```bash > $ JAVA_HOME=/jdk-8/ ant -f ./make/langtools/netbeans/nb-javac/build.xml > ``` > but let's rather inspect the sources: > ```bash > $ grep -r "GNU General Public License" . -l | wc -l > 747 > $ grep -r "GNU General Public License" . -l | while read X; do grep > Classpath.*exception "$X" || echo Missing $X; done | grep Missing > Missing ./LICENSE.txt > Missing ./src/jdk.jdeps/share/man/jdeprscan.1 > Missing ./src/jdk.jdeps/share/man/jdeps.1 > Missing ./src/jdk.jdeps/share/man/javap.1 > Missing ./src/jdk.compiler/share/man/serialver.1 > Missing ./src/jdk.compiler/share/man/javac.1 > ``` > e.g. there is 747 files that contain "GPL" header and all of them but license > and manual pages (not used in the nb-javac JARs) contain the "Classpath > exception" header. > > The manual inspection confirms that Maven central licensing information at > https://search.maven.org/artifact/com.dukescript.nbjavac/nb-javac/16.0.0.0/jar > is correct and both nb-javac@16.0.0.0 binary JAR files are covered by > GPLv2-CPE > license. > > Thanks in advance for checking my conclusion. > -jt > > > [1] https://lists.apache.org/thread.html/ > r821d9e9fdc8d9fd5663e7c326d25e4626e1a27eb13e45f4d639ea199%40%3Cdev.netbeans.apache.org%3E > > [2] https://lists.apache.org/thread.html/ > rb5d091662f88dafb2fd878a0acc5e5bdb80ddfb17b47bfbff248b4d7%40%3Cdev.netbeans.apache.org%3E > > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: dev-unsubscr...@netbeans.apache.org > For additional commands, e-mail: dev-h...@netbeans.apache.org > > For further information about the NetBeans mailing lists, visit: > https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists > > > --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@netbeans.apache.org For additional commands, e-mail: dev-h...@netbeans.apache.org For further information about the NetBeans mailing lists, visit: https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
