Re: Concerned about the LGPL dependency in Webkit

[Myrle Krantz]

On Thu, Jul 18, 2019 at 5:22 AM York Shen  wrote:

> Just some further information about what @ddy199726 said.
>
> The relationship between weex and JavaScriptCore is similar to the
> relationship between any Java Project and JDK.
>
> If one want to run a Java program, he/she must have a JDK/JRE to interpret
> Java byte code.
> If one want to run a Weex program, he/she must have a JavaScript
> interpretator to interpret JavaScript. Here we choose JavaScriptCore.
>

If it is the case that this can be done with any JavaScript interpreter,
then you are working within the Apache licensing policies.  You're doing
great.  Thank you for answering my questions.

It is a real pleasure working with you York Shen and ddy!
Myrle

Re: Concerned about the LGPL dependency in Webkit

[Myrle Krantz]

Hello dyy,

Thank you for your reply.  It's entirely possible that my understanding
incomplete and that you do not need to change anything.  Please let me ask
a couple of questions:

On Wed, Jul 17, 2019 at 9:17 AM  wrote:

> Now Function chain is Weex.apiA -> JavaScriptCore.BSD.apiB ->
> JavaScriptCore.so
>

I believe this is the point at which my understanding diverges from what
you have written.  I believe that JavaScriptCore is not BSD licensed, but
rather LGPL licensed (1).  This means that Weex is directly dependent on
LGPL code and thus, indirectly, any source dependent on Weex is dependent
on LGPL.

This would still be OK if, at runtime, another implementation could be used
in place of this LGPL component.  (much like OpenJDK can be used)  My
current understanding is that it cannot be.  I may be misunderstanding.


> So there is no webkit license and Webkit *.h in weex's repo now
>

Acknowledged.


>
> you can checkout the source code from here
> https://weex.apache.org/download/download.html#_0-26-0 <
> https://weex.apache.org/download/download.html#_0-26-0>
> javaScriptCore's api directory is
> weex_core/Source/include/JavaScriptCore/API
>
> Weex's logic that use JavaScriptCore's api is here
> weex_core/Source/js_runtime
>

I didn't go through all the code, but I looked at some of it.  It's quite
lovely.  You make me miss programming C++ : o)


> FYI, JavaScriptCore itself is under dual License too, at least Weex
> include files under BSD License from JavaScriptCore
>

The source I'm referring to says otherwise[1], but you may have a better
source.

Best,
Myrle

[1] "WebKit is available under a BSD-form license[11] with the exception of
the WebCore and JavaScriptCore components, which are available under the
GNU Lesser General Public License. As of March 7, 2013, WebKit is a
trademark of Apple, registered with the U.S. Patent and Trademark
Office.[12] "  https://en.wikipedia.org/wiki/WebKit

[DISCUSS] Documentation for contributors and committers.

[York Shen]

Hi, community

Recently, I spent some time on wring documentation for Weex. From a normal 
user’s perspective, one can find what and how he/she could within the help of 
Weex despite the misspelling and missing API. But from a contributor, committer 
or PPMC’s perspective, I found the documentation is frustrating. For example, I 
can’t even find the governance model, podding report of Weex or how to be a 
committer of Weex. For an experienced ASF committer, this documentation may be 
not necessary, but for a potential contributor or committer, he/she may be 
confused about it (Someone might even thinks Weex still belongs to Alibaba, 
which is not true of course). Let’s make it clear how the community works and 
how to be a guy(PPMC) who has a binding vote on decision of Weex. IMO, 
governance model is at least as important as code.

I’d like to have following documentation created:

Confluence
The main users of Confluence [1] should be contributors, committers, PMCs of 
Weex, though everyone else could read it without limitation. Normally, only 
core-contributors, committers and PPMCs should care about these document.
Podding reports
Governance model
How to be a committer
Minute of offline meetup
Release procedure

We are missing all other documentation except for release procedure and podding 
reports.

Github
Except for the users of Confluence, the Github of Weex [2] also serves the 
users of Weex. Github is used to hold code-related documentation like the 
following:
Contributing guideline which includes PR format, issue format and commit 
message format
Short term release plan, which is based on Github milestone
Long term feature, which is based on Github Project
API design and Roadmap, which is based on Github Wiki Page.

[1] https://cwiki.apache.org/confluence/display/WEEX/ 

[2] https://github.com/apache/incubator-weex 


Best Regards,
York Shen

申远

Re: Concerned about the LGPL dependency in Webkit

[dyy199726]

OK, I’ll separate JavaScriptCore.so from the binary of weex_sdk before August 1



> 在 2019年7月19日，下午2:49，申远  写道：
> 
> If there is no other comments here, we will work out to separate
> JavaScriptCore.so from the binary of weex_sdk as planned, which is also
> weeks of workload. Maybe @ddy199726 shall give us a hand.
> 
> Best Regards,
> York Shen
> 
> 申远
> 
> 在 2019年7月18日，11:22，York Shen  写道：
> 
> Just some further information about what @ddy199726 said.
> 
> The relationship between weex and JavaScriptCore is similar to the
> relationship between any Java Project and JDK.
> 
> 
>   - If one want to run a Java program, he/she must have a JDK/JRE to
>   interpret Java byte code.
>   - If one want to run a Weex program, he/she must have a JavaScript
>   interpretator to interpret JavaScript. Here we choose JavaScriptCore.
>   - Like any Java program must import some Java Class in the standard
>   JDK/JRE, weex has to import the some API (.h file) in JavaScriptCore. All
>   those API itself is under BSD License. @ddy199726 and I have doubled
>   checked it.
>   - The only problem I see here is that JavaScriptCore is inside the
>   binary of Weex, which should not happen anymore. We plan to decouple it
>   from Weex then users must include weex_sdk and JavaScriptCore together in
>   their product.
> 
> 
> Best Regards,
> York Shen
> 
> 申远
> 
> 在 2019年7月17日，15:16，dyy199...@gmail.com 写道：
> 
> Hey I'm a developer of incubator-weex
> 
> Weex used to use JavaScriptCore's source code directly to execute
> JavaScript like this way .
> 
> 
> JSValue returnValue = evaluate(globalObject->globalExec(),
> makeSource(source, sourceOrigin, url), JSValue(),
> evaluationException);
> 
> in this case, globalObject is inner object of JavaScriptCore,
> And makeSource is inline api of JavaScriptCore.
> 
> So Weex has to add all JavaScriptCore's source code to weex'
> s repo to make it work normally. There is an function call chain like
> Weex.apiA->Webkit.BSD.apiB->Webkit.BSD.apiC->Webkit.LGPL.apiD is true at
> that time.
> 
> But now, Weex has refactoring the way we use JavaScriptCore.
> Weex just use JavaScriptCore public api. And All JavaScriptCore source code
> has been removed from weex's repo.
> 
> We just include JavaScriptCore's publish api only.
> 
> So this function chain
> Weex.apiA->Webkit.BSD.apiB->Webkit.BSD.apiC->Webkit.LGPL.apiD is not
> existed now.
> 
> Now Function chain is Weex.apiA -> JavaScriptCore.BSD.apiB ->
> JavaScriptCore.so
> 
> So there is no webkit license and Webkit *.h in weex's repo now
> 
> you can checkout the source code from here
> https://weex.apache.org/download/download.html#_0-26-0 <
> https://weex.apache.org/download/download.html#_0-26-0>
> javaScriptCore's api directory is
> weex_core/Source/include/JavaScriptCore/API
> 
> Weex's logic that use JavaScriptCore's api is here
> weex_core/Source/js_runtime
> 
> FYI, JavaScriptCore itself is under dual License too, at least Weex include
> files under BSD License from JavaScriptCore
> 
> 
> 
> 
> 在 2019年7月16日，下午6:48，Myrle Krantz  写道：
> 
> Hey all,
> 
> First of all: congratulations on your recent release!
> 
> I wanted to circle back to this to make sure it gets resolved before the
> next release.
> 
> First a summary of what has happened as I see it.  If my summary is
> incorrect, please let me know:
> * At some point in the past Weex introduced a run-time and a compile-time
> dependency to Webkit.  When adding the Webkit *.h to the repo, the correct
> license of those files was accidentally overwritten.
> * More recently, this mistake was discovered and a license review of Webkit
> as a dependency was made in which it was realized that Webkit:
> "As Webkit is under dual license, and it's almost impossible for us to
> figure out whether there is an function call chain like
> Weex.apiA->Webkit.BSD.apiB->Webkit.BSD.apiC->Webkit.LGPL.apiD. I'd like to
> know our proposed change is enough to fix the Category X dependency."
> (
> https://lists.apache.org/thread.html/babe010a7814d4cf3d3d92588bee9dd22277b610daf83733d2622c91@%3Cgeneral.incubator.apache.org%3E
> )
> * The question of whether Webkit could release like this was raised to the
> incubator and then to legal.
> * Despite the lack of resolution to this question, Weex was still allowed
> to make it's most recent release, because Weex is still in incubation.
> 
> While reviewing the release, it became clear to me that Weex is including
> WebKit for it's JavaScriptCore.  Within WebKit, JavaScriptCore is
> LGPL-licensed.  So it is likely that your functional call chains will
> include LGPL-licensed code (after all that's the code you're including
> WebKit for).
> 
> Is there an alternative implementation of JavaScriptCore that a user could
> use in place of the LGPL-licensed portions of WebKit?
> 
> Best Regards,
> Myrle