Re: [arch-projects] [archweb] Licensing issues with JS code

2018-01-15 Thread Jelle van der Waa 
On 01/14/18 at 08:34pm, Luke Shumaker wrote:
> On Sun, 16 Jul 2017 23:46:01 -0400,
> Andrew Gregory via arch-projects wrote:
> > 
> > On 07/09/17 at 11:21am, Jelle van der Waa wrote:
> > > Looking at the issue on the bugtracker, I'm not sure what you want to
> > > achieve? personally I don't see any point in upgrading to GPLv3.
> > 
> > Presumably, the main thing they want to achieve license compliance.
> > GPLv2 is not compatible with GPLv3 or Apache 2.0.  If archweb includes
> > components under those licenses, it may be in violation.
> 
> Indeed.  We believe that archweb is in violation.
> 
> In the linked bug, I commented off-the-cuff that I didn't believe that
> the 1st-party GPLv2 code interacted with the 3rd-party GPLv3 or Apache
> 2.0 code in a way that required license compatibility.
> 
> Upon further review of release_2017-01-02 (the last release that
> Parabola has merged, and thus the last that I am familiar enough with
> to speak confidently about), I no longer believe that to be true.
> 
> 
> 
> A listing of all 3rd-party JS, and its license:
> 
>  - Bootstrap 2.1.1 (+change from Dan McGee)  : Apache 2.0
>  - jQuery 1.8.3  : MIT
>  - tablesorter[1] 2.7: MIT / GPL 
> dual-license
>  - D3 3.0.6  : 3-clause BSD
>  - konami.js[2] c0f686e (+change from unknown author[3]) : GPLv3
> 
>  [1]: https://github.com/Mottie/tablesorter
>  [2]: https://github.com/snaptortoise/konami-js
>  [3]: 
> https://git.parabola.nu/server/parabolaweb.git/plain/Makefile.d/konami.js.patch?h=archweb-generic
> 
> Note that without even being concerned with license compatibility,
> archweb is currently in violation of konami.js, as it does not
> include, link to, or in any way provide instructions on how to obtain
> non-minified source code.  This is especially grievous, as it includes
> (minor) changes that are not present in any non-minified version that
> I have found.  (We already patch to fix this in Parabola's fork; after
> identifying the minifier used (UglifyJS 2.2), I backed-out to
> reproduce the source changes (which I linked above).)
> 
> Now, as Andrew Gregory agreed, the GPLv3 and Apache 2.0 licenses of
> konami.js and Bootstrap are incompatible with archweb's GPLv2 license.
> The 3rd-party files of concern are:
> 
> retro/static/2013/bootstrap-typeahead.min.1aacd3d7f4db.js
> retro/static/2013/konami.min.e165c814457d.js
> sitestatic/bootstrap-typeahead.js
> sitestatic/konami.min.js
> 
> Additionally, the following file includes both 1st-party GPLv2 code,
> and minified versions of bootstrap-typeahead.js and konami.js:
> 
> sitestatic/homepage.js

I'm happy to drop the whole konami.js code, it's a gimmick and doesn't
really serve a purpose.

The bootstrap stuff is harder, only required for typeahead and I
remember messing with an alternative which was MIT but that might
require a jQuery update.

That should fix all the issues I think.

> 
> This 3rd-party code is called by GPLv2-licensed archweb code in the
> files:
> 
> retro/templates/retro/index-2013-03-07.html
> templates/public/index.html
> sitestatic/homepage.js
> 
> 
> 
> As Eli Schwartz noted elsewhere in the thread, after it was copied in
> to archweb, konami.js has since re-licensed to the MIT license.
> However, that does not cover the changes of unknown authorship that
> were present when konami.js was first add to archweb.  There's a good
> chance that the author there is Dan McGee (who added the file to
> archweb), but I'm not certain of that.
> 
>  | Proposed path forward: Confirm with Dan that he is the author of
>  | the changes, and that he agrees to license them under the MIT
>  | license.  From there, simply backport the license change from
>  | upstream commit ece43a5.
> 
> Bootstrap has also since re-licensed so that 3.1 and later are MIT
> licensed; however, bootstrap-typeahead.js was only ever present in
> Bootstrap 2.x; and was therefore not covered in the re-license.
> 
>  | Possible path forward (proposed by Jelle van der Waa): Modify
>  | homepage.js and index-2013-03-07.html to use the MIT-licensed
>  | horsey[4] instead of bootstrap-typeahead.js.
>  |
>  | [4]: https://github.com/bevacqua/horsey
> 
>  | Possible path forward: Contact the 7 authors of
>  | bootstrap-typeahead.js and confirm that they agree to license it
>  | under the MIT license.  I believe all 7 of them agreed to this for
>  | other Bootstrap code that they were authors of; so presumably this
>  | is something they are agreeable to.
> 
> -- 
> Happy hacking,
> ~ Luke Shumaker

-- 
Jelle van der Waa


signature.asc
Description: PGP signature

Re: [arch-projects] [archweb] Licensing issues with JS code

2018-01-15 Thread Jelle van der Waa 
On 01/15/18 at 12:56am, Eli Schwartz via arch-projects wrote:
> On 01/15/2018 12:07 AM, Luke Shumaker wrote:
> > From what I see, that's a minority position, but of course I run in
> > FSF circles, so my perception is a bit skewed.  :P
> > 
> > If that's the official position that the archweb team wants to take, I
> > won't argue.
> 
> I dunno what jelle/angvp/the gang would say, I do know that my personal
> opinion is markedly skewed. :p

I don't think we care largely care/cared. But this is probably something
we should resolve.



> >> I'll be watching this list and the Pull Requests page on archweb's
> >> github with anticipation. ;)
> > 
> > Wait, archweb is on GitHub? :P
> > 
> > Is a GitHub PR the preferred method, or is the usual git-send-email to
> > this ML preferred?
> > 
> > (Though I have to be honest: this is on my TODO list, but fairly low
> > priority on it)
> 
> Arch Linux has a Github organization: https://github.com/archlinux
> 
> A few things are mirrored there, and a couple new projects have their
> primary home there.
> Archweb specifically is primarily developed there via pull requests.
> Unlike other Arch projects, it is the preferred workflow of archweb
> developers/contributors.
> Though I am sure git-send-email to this ML will still get through. :)

Yeah PR's are preferred, they get tested automatically too.

I'll respond on the other mail about the violating files :)

-- 
Jelle van der Waa


signature.asc
Description: PGP signature

Re: [arch-projects] [archweb] Licensing issues with JS code

2018-01-14 Thread Eli Schwartz via arch-projects 
On 01/15/2018 12:07 AM, Luke Shumaker wrote:
> From what I see, that's a minority position, but of course I run in
> FSF circles, so my perception is a bit skewed.  :P
> 
> If that's the official position that the archweb team wants to take, I
> won't argue.

I dunno what jelle/angvp/the gang would say, I do know that my personal
opinion is markedly skewed. :p

But I have contributed precisely one commit to archweb ever:
https://github.com/archlinux/archweb/commit/6ffa5c4957812f3ee584205b6d11ce87885f9e6c

So don't take me as some primary indicator of the official position of
the archweb team.

>> *complaining about Parabola forking instead of contributing upstream*
> 
> Like I said, the primary purpose of maintaining a fork of archweb is
> to replace the Arch branding with Parabola branding so that we can use
> it as our website.  Obviously, we can't send that work upstream.
> 
> Of the other, would-be-upstreamable, changes that have gone in to the
> fork, they are mixed in the git history of the non-upstreamable
> changes, and buried in an absolute *mess* of merges and such; pulling
> and rebasing and amending an upstreamable patchset out of that is
> quite a bit of work (it was already that way when I inherited
> parabolaweb ~4 years ago)... it's been on my TODO list for longer than
> I'd care to admit.  FWIW, the `archweb-generic` branch in
> parabolaweb.git is intended to be changes that are upstreamable, but
> it needs some rebasing first.

As you can imagine, that is at least as frustrating to us as it is to
you. ;) Bear with us...

> This email thread is simply us forwarding a bug upstream:
> 
>   User: there's an issue in parabolaweb
> 
>   Me: if it's a real issue, it's also in upstream archweb, it should
>   be discussed there
> 
>   User: ok, I'll report it there. (*creates this email thread*)
> 
> This is just the beginning of us being better about contributing
> upstream.  This line of criticism here feels a bit like criticizing a
> fat guy at the gym--he knows he's fat and is trying to fix it, that's
> why he's at the gym.

Sounds great, I guess. I for one would be more than happy to see
(watching from the sidelines TBH) parabola become an involved
contributor to archweb and in general Arch projects (of which I am only
currently aware of some devtools stuff, by you).

It does feel somewhat awkward when a Parabola representative basically
shows up to talk about archweb and the only thing they seem to have to
talk about is "your licensing sucks, please fix it".
Of course it is entirely possible that Parabola members have engaged in
contributions I am unaware of, I haven't been watching arch-projects
*that* long... but still, looking at commit counts I don't see anything
which landed (except for the aforementioned devtools stuff).

It wasn't immediately apparent that Parabola was trying to upstream
things -- it is easy to assume instead that this is just Parabola being
a distro that places a primary focus on FSF principles and idealisms
raising an objection to something they feel violates those core values.

>> I'll be watching this list and the Pull Requests page on archweb's
>> github with anticipation. ;)
> 
> Wait, archweb is on GitHub? :P
> 
> Is a GitHub PR the preferred method, or is the usual git-send-email to
> this ML preferred?
> 
> (Though I have to be honest: this is on my TODO list, but fairly low
> priority on it)

Arch Linux has a Github organization: https://github.com/archlinux

A few things are mirrored there, and a couple new projects have their
primary home there.
Archweb specifically is primarily developed there via pull requests.
Unlike other Arch projects, it is the preferred workflow of archweb
developers/contributors.
Though I am sure git-send-email to this ML will still get through. :)

...

Whenever you have time to work on things would be great. ;)
I'm just happy now that you've clarified Parabola's intention to work
with us.

Consider my criticism withdrawn.

-- 
Eli Schwartz
Bug Wrangler and Trusted User



signature.asc
Description: OpenPGP digital signature

Re: [arch-projects] [archweb] Licensing issues with JS code

2018-01-14 Thread Luke Shumaker 
On Sun, 14 Jan 2018 21:51:07 -0500,
Eli Schwartz wrote:
> 
> On 01/14/2018 08:34 PM, Luke Shumaker wrote:
> > Note that without even being concerned with license compatibility,
> > archweb is currently in violation of konami.js, as it does not
> > include, link to, or in any way provide instructions on how to obtain
> > non-minified source code. 
> 
> This would be boringly easy for you to fix, you know...

I'm sorry if I wasn't clear, later in the paragraph I state: I did fix
this.  I apologize that the fix hasn't been submitted upstream, but
you point out: once one is aware of the issue, it is boringly easy to
fix.

> > This is especially grievous, as it includes
> > (minor) changes that are not present in any non-minified version that
> > I have found.  (We already patch to fix this in Parabola's fork; after
> > identifying the minifier used (UglifyJS 2.2), I backed-out to
> > reproduce the source changes (which I linked above).)
> 
> This would be mildly less so, but apparently you cared enough to fork
> archweb but not enough to email a simple question to Dan.

Given that we're maintaining a fork of archweb to use as our website
anyway, this was just a small commit I made a couple of years ago, and
then mostly forgot about.  And, IIRC, I did email Dan, but never
received a reply.

I was kinda hoping this thread would catch his attention ;)

> We could solve that by declaring that we accept konami.js under the MIT,
> assuming the changes came from Dan,

Isn't that what I said?

> and by favoring the not-unheard-of opinion that Apache 2.0 and GPL2
> aren't incompatible. :p
>
> Not every OSS lawyer agrees with the FSF lawyers on this... pity it
> hasn't been challenged in court as I'd love to see a court ruling that
> says they are compatible.

From what I see, that's a minority position, but of course I run in
FSF circles, so my perception is a bit skewed.  :P

If that's the official position that the archweb team wants to take, I
won't argue.

> *complaining about Parabola forking instead of contributing upstream*

Like I said, the primary purpose of maintaining a fork of archweb is
to replace the Arch branding with Parabola branding so that we can use
it as our website.  Obviously, we can't send that work upstream.

Of the other, would-be-upstreamable, changes that have gone in to the
fork, they are mixed in the git history of the non-upstreamable
changes, and buried in an absolute *mess* of merges and such; pulling
and rebasing and amending an upstreamable patchset out of that is
quite a bit of work (it was already that way when I inherited
parabolaweb ~4 years ago)... it's been on my TODO list for longer than
I'd care to admit.  FWIW, the `archweb-generic` branch in
parabolaweb.git is intended to be changes that are upstreamable, but
it needs some rebasing first.

This email thread is simply us forwarding a bug upstream:

  User: there's an issue in parabolaweb

  Me: if it's a real issue, it's also in upstream archweb, it should
  be discussed there

  User: ok, I'll report it there. (*creates this email thread*)

This is just the beginning of us being better about contributing
upstream.  This line of criticism here feels a bit like criticizing a
fat guy at the gym--he knows he's fat and is trying to fix it, that's
why he's at the gym.

> I'll be watching this list and the Pull Requests page on archweb's
> github with anticipation. ;)

Wait, archweb is on GitHub? :P

Is a GitHub PR the preferred method, or is the usual git-send-email to
this ML preferred?

(Though I have to be honest: this is on my TODO list, but fairly low
priority on it)

-- 
Happy hacking,
~ Luke Shumaker

Re: [arch-projects] [archweb] Licensing issues with JS code

2018-01-14 Thread Eli Schwartz via arch-projects 
On 01/14/2018 08:34 PM, Luke Shumaker wrote:
> Note that without even being concerned with license compatibility,
> archweb is currently in violation of konami.js, as it does not
> include, link to, or in any way provide instructions on how to obtain
> non-minified source code. 

This would be boringly easy for you to fix, you know...

> This is especially grievous, as it includes
> (minor) changes that are not present in any non-minified version that
> I have found.  (We already patch to fix this in Parabola's fork; after
> identifying the minifier used (UglifyJS 2.2), I backed-out to
> reproduce the source changes (which I linked above).)

This would be mildly less so, but apparently you cared enough to fork
archweb but not enough to email a simple question to Dan.

> Now, as Andrew Gregory agreed, the GPLv3 and Apache 2.0 licenses of
> konami.js and Bootstrap are incompatible with archweb's GPLv2 license.
> The 3rd-party files of concern are:

We could solve that by declaring that we accept konami.js under the MIT,
assuming the changes came from Dan, and by favoring the not-unheard-of
opinion that Apache 2.0 and GPL2 aren't incompatible. :p

Not every OSS lawyer agrees with the FSF lawyers on this... pity it
hasn't been challenged in court as I'd love to see a court ruling that
says they are compatible.

> Bootstrap has also since re-licensed so that 3.1 and later are MIT
> licensed; however, bootstrap-typeahead.js was only ever present in
> Bootstrap 2.x; and was therefore not covered in the re-license.
> 
>  | Possible path forward (proposed by Jelle van der Waa): Modify
>  | homepage.js and index-2013-03-07.html to use the MIT-licensed
>  | horsey[4] instead of bootstrap-typeahead.js.
>  |
>  | [4]: https://github.com/bevacqua/horsey
> 
>  | Possible path forward: Contact the 7 authors of
>  | bootstrap-typeahead.js and confirm that they agree to license it
>  | under the MIT license.  I believe all 7 of them agreed to this for
>  | other Bootstrap code that they were authors of; so presumably this
>  | is something they are agreeable to.

I must confess that I was and am perpetually astounded that Parabola
chose to fork archweb rather than file painless pull requests against
it, to move to feature-compatible code under your preferred license...
and/or add the non-minified js alongside the minified versions, a pretty
darn common convention for declaring the licenses and sources of
minified js that wouldn't affect the in-use code at all and would
therefore be extremely mergeable.

Apparently as long as Parabola didn't consider Arch Linux actually in
violation of Apache+GPL2, it was worth it to maintain a fork rather than
contribute back to archweb? Maybe, possibly you thought that our
unwillingness to do the work *ourselves* to make archweb more usable for
*you*, meant we would reject any and all contributions that threaten to
do so without our personal work?

Since you seem eager to help us with our licensing woes, and have
personally contributed patches to Arch projects before, I expect you'll
be more than happy to amend this oversight. I'll be watching this list
and the Pull Requests page on archweb's github with anticipation. ;)

-- 
Eli Schwartz
Bug Wrangler and Trusted User



signature.asc
Description: OpenPGP digital signature

Re: [arch-projects] [archweb] Licensing issues with JS code

2018-01-14 Thread Luke Shumaker 
On Sun, 14 Jan 2018 18:04:01 -0500,
Luke Shumaker wrote:
>  - take konami.js from commit
>ec0f686e647765860ff4d2fcb7b48122785432b75

I'm sorry, I made a typo when pasting that.  It should be:
c0f686e647765860ff4d2fcb7b48122785432b75

-- 
Happy hacking,
~ Luke Shumaker

Re: [arch-projects] [archweb] Licensing issues with JS code

2018-01-14 Thread Luke Shumaker 
On Sun, 16 Jul 2017 23:46:01 -0400,
Andrew Gregory via arch-projects wrote:
> 
> On 07/09/17 at 11:21am, Jelle van der Waa wrote:
> > Looking at the issue on the bugtracker, I'm not sure what you want to
> > achieve? personally I don't see any point in upgrading to GPLv3.
> 
> Presumably, the main thing they want to achieve license compliance.
> GPLv2 is not compatible with GPLv3 or Apache 2.0.  If archweb includes
> components under those licenses, it may be in violation.

Indeed.  We believe that archweb is in violation.

In the linked bug, I commented off-the-cuff that I didn't believe that
the 1st-party GPLv2 code interacted with the 3rd-party GPLv3 or Apache
2.0 code in a way that required license compatibility.

Upon further review of release_2017-01-02 (the last release that
Parabola has merged, and thus the last that I am familiar enough with
to speak confidently about), I no longer believe that to be true.



A listing of all 3rd-party JS, and its license:

 - Bootstrap 2.1.1 (+change from Dan McGee)  : Apache 2.0
 - jQuery 1.8.3  : MIT
 - tablesorter[1] 2.7: MIT / GPL 
dual-license
 - D3 3.0.6  : 3-clause BSD
 - konami.js[2] c0f686e (+change from unknown author[3]) : GPLv3

 [1]: https://github.com/Mottie/tablesorter
 [2]: https://github.com/snaptortoise/konami-js
 [3]: 
https://git.parabola.nu/server/parabolaweb.git/plain/Makefile.d/konami.js.patch?h=archweb-generic

Note that without even being concerned with license compatibility,
archweb is currently in violation of konami.js, as it does not
include, link to, or in any way provide instructions on how to obtain
non-minified source code.  This is especially grievous, as it includes
(minor) changes that are not present in any non-minified version that
I have found.  (We already patch to fix this in Parabola's fork; after
identifying the minifier used (UglifyJS 2.2), I backed-out to
reproduce the source changes (which I linked above).)

Now, as Andrew Gregory agreed, the GPLv3 and Apache 2.0 licenses of
konami.js and Bootstrap are incompatible with archweb's GPLv2 license.
The 3rd-party files of concern are:

retro/static/2013/bootstrap-typeahead.min.1aacd3d7f4db.js
retro/static/2013/konami.min.e165c814457d.js
sitestatic/bootstrap-typeahead.js
sitestatic/konami.min.js

Additionally, the following file includes both 1st-party GPLv2 code,
and minified versions of bootstrap-typeahead.js and konami.js:

sitestatic/homepage.js

This 3rd-party code is called by GPLv2-licensed archweb code in the
files:

retro/templates/retro/index-2013-03-07.html
templates/public/index.html
sitestatic/homepage.js



As Eli Schwartz noted elsewhere in the thread, after it was copied in
to archweb, konami.js has since re-licensed to the MIT license.
However, that does not cover the changes of unknown authorship that
were present when konami.js was first add to archweb.  There's a good
chance that the author there is Dan McGee (who added the file to
archweb), but I'm not certain of that.

 | Proposed path forward: Confirm with Dan that he is the author of
 | the changes, and that he agrees to license them under the MIT
 | license.  From there, simply backport the license change from
 | upstream commit ece43a5.

Bootstrap has also since re-licensed so that 3.1 and later are MIT
licensed; however, bootstrap-typeahead.js was only ever present in
Bootstrap 2.x; and was therefore not covered in the re-license.

 | Possible path forward (proposed by Jelle van der Waa): Modify
 | homepage.js and index-2013-03-07.html to use the MIT-licensed
 | horsey[4] instead of bootstrap-typeahead.js.
 |
 | [4]: https://github.com/bevacqua/horsey

 | Possible path forward: Contact the 7 authors of
 | bootstrap-typeahead.js and confirm that they agree to license it
 | under the MIT license.  I believe all 7 of them agreed to this for
 | other Bootstrap code that they were authors of; so presumably this
 | is something they are agreeable to.

-- 
Happy hacking,
~ Luke Shumaker

Re: [arch-projects] [archweb] Licensing issues with JS code

2018-01-14 Thread Luke Shumaker 
On Sun, 07 Jan 2018 11:34:59 -0500,
Eli Schwartz wrote:
> 
> On 01/07/2018 10:55 AM, Eli Schwartz wrote:
> > Not really sure what the issue is, are we actually in violation of
> > anything, and if so what? For example, quickly googling for konami.js
> > shows me several github repos that *all* claim to be MIT licensed.
> 
> Morten Linderud pointed out on IRC that it originally comes from
> https://code.google.com/archive/p/konami-js/
> 
> I did investigative work, and the author moved from googlecode to
> github, and relicensed it as MIT:
> https://github.com/snaptortoise/konami-js/issues/13
> 
> This may not have covered prior PR authors on github, but it did cover
> the googlecode version which we use, yes?

I know this one!

The file checked in to archweb.git is `konami.min.js`.  That file can
be re-created by

 - take konami.js from commit
   ec0f686e647765860ff4d2fcb7b48122785432b75
   https://github.com/snaptortoise/konami-js

 - apply this patch:
   
https://git.parabola.nu/server/parabolaweb.git/plain/Makefile.d/konami.js.patch?h=archweb-generic

 - run it through UglifyJS 2.2 (any of 2.2.x will produce the same
   output for this input)

 - insert "\n\t" or "\n" as appropriate; presumably to make it match
   whoever's (Dan's?) text editor's auto-wrap behavior when they
   copy/pasted it.

 - remove ";" when it appears right before a newline (again, probably
   someone's auto-wrap behavior).

Beside that patch, George Mandis is the only author of the
pre-minified file.

I don't know who is the author of the modifications in the patch.  It
doesn't correspond to any commit in the linked GitHub or the Google
Code SVN, nor any git fork of it that I found.

-- 
Happy hacking,
~ Luke Shumaker

Re: [arch-projects] [archweb] Licensing issues with JS code

2018-01-07 Thread Eli Schwartz via arch-projects 
On 01/07/2018 10:55 AM, Eli Schwartz wrote:
> Not really sure what the issue is, are we actually in violation of
> anything, and if so what? For example, quickly googling for konami.js
> shows me several github repos that *all* claim to be MIT licensed.

Morten Linderud pointed out on IRC that it originally comes from
https://code.google.com/archive/p/konami-js/

I did investigative work, and the author moved from googlecode to
github, and relicensed it as MIT:
https://github.com/snaptortoise/konami-js/issues/13

This may not have covered prior PR authors on github, but it did cover
the googlecode version which we use, yes?

-- 
Eli Schwartz



signature.asc
Description: OpenPGP digital signature

Re: [arch-projects] [archweb] Licensing issues with JS code

2018-01-07 Thread Eli Schwartz via arch-projects 
On 01/07/2018 10:12 AM, Adonay Felipe Nogueira wrote:
> What's the status of this after our last message here?
> 
> I have some questions that you can ask the ArchLinux meetings in order
> help solve this:
> 
> 1. For things provided by the ArchLinux project and which have the
>problematic licenses, has ArchLinux agreed license change?
> 
>Rephrasing the above: has the copyright holders agreed to do so?
> 
> 2. If no license change will be done, can we remove the GPL-2.0-only
>([1]) incompatible dependencies?

Not really sure what the issue is, are we actually in violation of
anything, and if so what? For example, quickly googling for konami.js
shows me several github repos that *all* claim to be MIT licensed.

I would blindly assume that the original developers of our javascript
knew something about licenses, and at most failed to clarify the
original sourcing of thirdparty components, which would mean that it is
a simple matter of adding clarification notes. I'm sure no one would
reject patches that added clarification of copyrights.

But FWIW git claims all javascript files in archweb were
authored/committed by Dan McGee, with the exception of a syntax error
fix (partial commit reversion only, so I don't know that that counts) in
ddb7f4825f8bf70142735a5ba2f7729ffe5d27c1 by Evangelos Foutras. You
should probably contact them directly, and ask them to relicense under
GPL2+ or something if it is really important for your derivative use, as
this doesn't seem to be a priority for anyone on our end.

-- 
Eli Schwartz



signature.asc
Description: OpenPGP digital signature

Re: [arch-projects] [archweb] Licensing issues with JS code

2018-01-07 Thread Adonay Felipe Nogueira 
What's the status of this after our last message here?

I have some questions that you can ask the ArchLinux meetings in order
help solve this:

1. For things provided by the ArchLinux project and which have the
   problematic licenses, has ArchLinux agreed license change?

   Rephrasing the above: has the copyright holders agreed to do so?

2. If no license change will be done, can we remove the GPL-2.0-only
   ([1]) incompatible dependencies?

[1] SPDX recently reverted their decision to use "GPL-2.0" as indicator
of the GPL 2 without "or later" option. See
,

and .

2017-07-08T17:38:50-0300 Adonay Felipe Nogueira wrote:
> Hi all,
>
> I have an issue to report. However, please note that I'm not subscribed
> to this mailing list, so I'd recommend you to Cc me when replying.
>
> For a short description of the issue, see:
> [[https://labs.parabola.nu/issues/1405]].
>
> However, we must also note that Archweb is now newer than the Archweb
> release used by Parabola.
>
> Nonethless, as far as I know, each of the files still exist, although
> some of them don't even have license indication for the site's visitor
> (this is true for "visualize/static/visualize.js" and
> "mirrors/static/mirror_status.js").
>
> In case of doubt, I might be able to help with some of the points
> described in the referenced issue.
>
>
> Respectfully, Adonay.

-- 
- https://libreplanet.org/wiki/User:Adfeno
- Palestrante e consultor sobre /software/ livre (não confundir com
  gratis).
- "WhatsApp"? Ele não é livre. Por favor, veja formas de se comunicar
  instantaneamente comigo no endereço abaixo.
- Contato: https://libreplanet.org/wiki/User:Adfeno#vCard
- Arquivos comuns aceitos (apenas sem DRM): Corel Draw, Microsoft
  Office, MP3, MP4, WMA, WMV.
- Arquivos comuns aceitos e enviados: CSV, GNU Dia, GNU Emacs Org, GNU
  GIMP, Inkscape SVG, JPG, LibreOffice (padrão ODF), OGG, OPUS, PDF
  (apenas sem DRM), PNG, TXT, WEBM.

Re: [arch-projects] [archweb] Licensing issues with JS code

2017-08-10 Thread Jelle van der Waa 
On 07/17/17 at 09:00am, Adonay Felipe Nogueira via arch-projects wrote:
> Indeed. things under GPL 2 (notice the lack of "+"/"or later") can't
> adapt/depend on things under GPL 3.
> 
> Things under both GPL 2 and its "+"/"or later" version can't
> adapt/depend on things under Apache 2.0. However, things under GPL 3 and
> its "+"/"or later" version can.

I'm not fond of moving to GPLv3, first off, we'd have to ask all
contributors to agree to it right?

But something I can see do-able, is moving away from
bootstrap-typeahead.js to horsey which is MIT licensed. [1]

> - "visualize/static/visualize.js" is licensed under GNU GPL 2 (assumed to be 
> "only" because the license notice in the file doesn't tell if there is an 
> upgrade possibility).

This is part of archweb, so GPLv2

> - "mirrors/static/mirror_status.js" is licensed under GNU GPL 2 (assumed to 
> be "only" because the license notice in the file doesn't tell if there is an 
> upgrade possibility).

This is part of archweb, so GPLv2

[1] https://github.com/bevacqua/horsey

-- 
Jelle van der Waa


signature.asc
Description: PGP signature

Re: [arch-projects] [archweb] Licensing issues with JS code

2017-07-17 Thread Adonay Felipe Nogueira via arch-projects 
Indeed. things under GPL 2 (notice the lack of "+"/"or later") can't
adapt/depend on things under GPL 3.

Things under both GPL 2 and its "+"/"or later" version can't
adapt/depend on things under Apache 2.0. However, things under GPL 3 and
its "+"/"or later" version can.

Re: [arch-projects] [archweb] Licensing issues with JS code

2017-07-16 Thread Andrew Gregory via arch-projects 
On 07/09/17 at 11:21am, Jelle van der Waa wrote:
> Hi,
> 
> I do some more work on Archweb these days, so I might be able to help.
> 
> On 07/08/17 at 06:38pm, Adonay Felipe Nogueira via arch-projects wrote:
> > For a short description of the issue, see:
> > [[https://labs.parabola.nu/issues/1405]].
> > 
> > However, we must also note that Archweb is now newer than the Archweb
> > release used by Parabola.
> > 
> > Nonethless, as far as I know, each of the files still exist, although
> > some of them don't even have license indication for the site's visitor
> > (this is true for "visualize/static/visualize.js" and
> > "mirrors/static/mirror_status.js").
> 
> homepage.js does not have a license header either, and personally I
> don't see the need to add it.
> 
> Looking at the issue on the bugtracker, I'm not sure what you want to
> achieve? personally I don't see any point in upgrading to GPLv3.

Presumably, the main thing they want to achieve license compliance.
GPLv2 is not compatible with GPLv3 or Apache 2.0.  If archweb includes
components under those licenses, it may be in violation.

apg

Re: [arch-projects] [archweb] Licensing issues with JS code

2017-07-09 Thread Adonay Felipe Nogueira via arch-projects 
About the upgrade to GNU GPL 3 (or even better: GNU GPL 3+, *if* the
dependencies would allow to), would be that Archweb would be compatible
with the Apache License 2.0 and also with konami.js (which I assume to
be under GNU GPL 3 (only), so we could only upgrade Archweb to GNU GPL
3, not GNU GPL 3+).

As for the license notices on top of the JS code or on the first script
element of HTML pages if these pages have scripting elements (/e.g./:
script tags, HTML/JS/DOM events): these license notices are needed in
order for the JavaScript software to receive the essential freedoms and
for this to be clarified to the website guest/visitor. This is specially
true for JS code written by the Archweb project (there are some
requirements like the "@lic"* comment elements, and the "@source"
comment element in case of JS code written by Archweb which is generated
from a series of files, but I won't discuss the implementation of these
now).

For JS code written by third-parties and which originally don't have the
license notices (or which those notices were removed by Archweb for some
reason), Archweb can provide a simple HTML page that has a table (with
an specific id attribute, per the GNU LibreJS documentation) which has a
column linking to the object/delivered/minified/obfuscated code, a
column linking to the (maybe various) licenses in which that script is
under, and a column linking to a file that can be downloaded directly
and that is (or has) the complete corresponding source files.

For more information on the recommendations for licensing (and visible
license notice and source markup), see the GNU LibreJS documentation:
[[https://www.gnu.org/software/librejs/manual/html_node/Setting-Your-JavaScript-Free.html#Setting-Your-JavaScript-Free]].

It must be noted however, that all what was said about JS code license
notice markup, "@lic"*, "@source" and GNU LibreJS compatibility is
ideally done only *after* these license incompatibilities are solved. We
can do the markup now of course, and in such case I can provide patches
for it, but I think it would be similar to putting the wagon in front of
the horses. ;)

Re: [arch-projects] [archweb] Licensing issues with JS code

2017-07-09 Thread Jelle van der Waa 
Hi,

I do some more work on Archweb these days, so I might be able to help.

On 07/08/17 at 06:38pm, Adonay Felipe Nogueira via arch-projects wrote:
> For a short description of the issue, see:
> [[https://labs.parabola.nu/issues/1405]].
> 
> However, we must also note that Archweb is now newer than the Archweb
> release used by Parabola.
> 
> Nonethless, as far as I know, each of the files still exist, although
> some of them don't even have license indication for the site's visitor
> (this is true for "visualize/static/visualize.js" and
> "mirrors/static/mirror_status.js").

homepage.js does not have a license header either, and personally I
don't see the need to add it.

Looking at the issue on the bugtracker, I'm not sure what you want to
achieve? personally I don't see any point in upgrading to GPLv3.

-- 
Jelle van der Waa


signature.asc
Description: PGP signature

Re: [arch-projects] [archweb] Licensing issues with JS code

2017-07-08 Thread Adonay Felipe Nogueira via arch-projects 
Sorry, I *am* subscribed, I forgot to edit the message in order to
remove that note. :)

[arch-projects] [archweb] Licensing issues with JS code

2017-07-08 Thread Adonay Felipe Nogueira via arch-projects 
Hi all,

I have an issue to report. However, please note that I'm not subscribed
to this mailing list, so I'd recommend you to Cc me when replying.

For a short description of the issue, see:
[[https://labs.parabola.nu/issues/1405]].

However, we must also note that Archweb is now newer than the Archweb
release used by Parabola.

Nonethless, as far as I know, each of the files still exist, although
some of them don't even have license indication for the site's visitor
(this is true for "visualize/static/visualize.js" and
"mirrors/static/mirror_status.js").

In case of doubt, I might be able to help with some of the points
described in the referenced issue.


Respectfully, Adonay.

-- 
- [[https://libreplanet.org/wiki/User:Adfeno]]
- Palestrante e consultor sobre /software/ livre (não confundir com
  gratis).
- "WhatsApp"? Ele não é livre, por isso não uso. Iguais a ele prefiro
  GNU Ring, ou Tox. Quer outras formas de contato? Adicione o vCard
  que está no endereço acima aos teus contatos.
- Pretende me enviar arquivos .doc, .ppt, .cdr, ou .mp3? OK, eu
  aceito, mas não repasso. Entrego apenas em formatos favoráveis ao
  /software/ livre. Favor entrar em contato em caso de dúvida.