users@jersey.java.net

[Jersey] Re: SVN, GIT or MERCURIAL for Jersey 2.0?

From: Marek Potociar <marek.potociar_at_oracle.com>
Date: Wed, 13 Apr 2011 12:12:05 +0200

Markus,

1. License file is an off-line container for all the project licenses.

2. Jersey project site on the very top in 5th sentence clearly states (btw. we don't use maven pom.xml to generate the
site):
"We also use the same two licenses - CDDL 1.1 and GPL 2 with CPE - so, you can pick which one suites your needs better."

3. Every source file (other than the license file) should have a copyright header (if it's not the case, let us know,
we'll fix that). This copyright header is what really matters and again, it clearly states that you can pick one of the
licenses. It also tells you how to handle your modifications and/or contributions. To me such articulation of the right
to choose is as explicit as it gets.

Marek

P.S. This was really my last comment on licenses on this thread. If you feel there is still an issue, please start
another thread with a summary of the problematic use case(s) that you see, so that I can try to point someone from
Oracle legal to it.

On 04/12/2011 09:06 PM, Markus Karg wrote:
> Marek,
>
> the confusion about the licence comes from three places where an explicit statement is missing. I understand that you think rather relaxed about this issues, but Oracle's lawyers maybe won't do in future. So it must be clear *everywhere*.
>
> (1) http://java.net/projects/jersey/sources/svn/content/trunk/jersey/license.html?rev=4839
>
> This file contains no hint that the user may pick one of those licences, so from a legal point of view both build an atomic union. You lawyers must add a note in that document to explicitly allow people to choose one of these licences and remove the other when forking.
>
> (2) Many files (if not all), e. g. http://java.net/projects/jersey/sources/svn/content/trunk/jersey/pom.xml?rev=4839 contain a header that says that the header must be kept. But that header names *both* licences types. So it is impossible to fork by only GPL, as the header (including the CDDL hint) must be kept. The header must tell people that it is allowed to remove the CDDL from the header. The problem is the sentence "When distributing the software, include *this* License Header Notice in each...". It does not say "...similar..." but "...this..." what means "unchanged".
>
> (3) The POM http://java.net/projects/jersey/sources/svn/content/trunk/jersey/pom.xml?rev=4839 is the central place to look at licences when using Maven. It contains licences notes for GPL and CDDL. But it doesn't say that the user may choose. So from a legal aspect, it enforces a Union. The problem is that this cannot be solved unless Maven is changed. Maybe a comment could make it clear -- but this doesn't solve the problem that a site created from that POM still wouldn't explain that the user can choose...
>
> It is not enough to link somewhere on the web site, as the source can be obtained without every opening a browser. So the explicit right to choose must be told in the source, as long as above places do exist.
>
> Unfortunately Oracle is well-known for paying very active lawyers, so people must feel safe by reading clear words in *all* places dealing with licences.
>
> Regards
> Markus
>
>> -----Original Message-----
>> From: Marek Potociar [mailto:marek.potociar_at_oracle.com]
>> Sent: Dienstag, 12. April 2011 18:53
>> To: users_at_jersey.java.net
>> Cc: Markus Karg
>> Subject: [Jersey] Re: SVN, GIT or MERCURIAL for Jersey 2.0?
>>
>> Markus,
>> I wonder how did we get here. I was initially asking about SVN, Git or
>> Mercurial... :) Btw., I have marked down your
>> vote for SVN.
>>
>> As for the licensing issues, what I wrote earlier is my understanding.
>> We include the link to the license in each and
>> every Jersey source file copyright header[1]. The same license is in
>> the project source root, too. Note that in the
>> copyright header we clearly state that:
>>
>> "The contents of this file are subject to the terms of either the GNU
>> General Public License Version 2 only ("GPL") or
>> the Common Development and Distribution License("CDDL")"
>>
>> To me, it is made explicit enough that you can really use the code in
>> compliance with *either CDDL or GPL*. I don't
>> really understand how removing the license headers relates to that
>> fact. Further, the copyright header provides hints
>> what to do in case of content modification or contributions. You can
>> add your own copyright header to cover your
>> modifications or you can opt for a single license mode for your
>> contributed content - particularly useful when
>> contributing code that contains pieces already licensed strictly under
>> GPL.
>>
>> Yet, I am a developer not a lawyer. So, if you still feel that you have
>> any legal issues with using Jersey because of
>> it's license or if you are facing a problematic use case, I would
>> suggest we take it off-line or you start another
>> thread at least. Once we have a separate discussion I can point Oracle
>> legal to it. They should be able to provide you a
>> better explanation or assurance or suggest a solution which would work
>> for your problematic use case.
>>
>> Thank you,
>> Marek
>>
>> [1] Source file copyright header:
>> /*
>> * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
>> *
>> * Copyright (c) 2011 Oracle and/or its affiliates. All rights
>> reserved.
>> *
>> * The contents of this file are subject to the terms of either the GNU
>> * General Public License Version 2 only ("GPL") or the Common
>> Development
>> * and Distribution License("CDDL") (collectively, the "License"). You
>> * may not use this file except in compliance with the License. You
>> can
>> * obtain a copy of the License at
>> * http://glassfish.java.net/public/CDDL+GPL_1_1.html
>> * or packager/legal/LICENSE.txt. See the License for the specific
>> * language governing permissions and limitations under the License.
>> *
>> * When distributing the software, include this License Header Notice
>> in each
>> * file and include the License file at packager/legal/LICENSE.txt.
>> *
>> * GPL Classpath Exception:
>> * Oracle designates this particular file as subject to the "Classpath"
>> * exception as provided by Oracle in the GPL Version 2 section of the
>> License
>> * file that accompanied this code.
>> *
>> * Modifications:
>> * If applicable, add the following below the License Header, with the
>> fields
>> * enclosed by brackets [] replaced by your own identifying
>> information:
>> * "Portions Copyright [year] [name of copyright owner]"
>> *
>> * Contributor(s):
>> * If you wish your version of this file to be governed by only the
>> CDDL or
>> * only the GPL Version 2, indicate your decision by adding
>> "[Contributor]
>> * elects to include this software in this distribution under the [CDDL
>> or GPL
>> * Version 2] license." If you don't indicate a single choice of
>> license, a
>> * recipient has the option to distribute your version of this file
>> under
>> * either the CDDL, the GPL Version 2 or to extend the choice of
>> license to
>> * its licensees as provided above. However, if you add GPL Version 2
>> code
>> * and therefore, elected the GPL Version 2 license, then the option
>> applies
>> * only if the new code is made subject to such option by the copyright
>> * holder.
>> */
>>
>>
>> On 04/12/2011 05:00 PM, Markus Karg wrote:
>>> Can you please ask Oracle lawyers to post that agreement to fork and
>> remove CDDL and the additional special exception on your own project's
>> web site? Unless it is clearly written there, Oracle lawyer's will tell
>> you that it is not valid to just link to a glassfish page. Thanks.
>>>
>>>
>>> -----Original Message-----
>>> From: Marek Potociar [mailto:marek.potociar_at_oracle.com]
>>> Sent: Dienstag, 12. April 2011 16:57
>>> To: users_at_jersey.java.net
>>> Cc: Cameron Heavon-Jones
>>> Subject: [Jersey] Re: SVN, GIT or MERCURIAL for Jersey 2.0?
>>>
>>>
>>>
>>> On 04/12/2011 04:06 PM, Cameron Heavon-Jones wrote:
>>>> The CDDL is for common development on the Jersey project, not
>> forking. There is nothing stoping GPL from being forked and the fork
>> can even be kept private as long as it's not distributed.
>>>>
>>>> I understand the CDDL + GPL as an either\or choice, not a union.
>>>
>>> Yes, that's correct. You can choose which one suits best your needs.
>> Also with GPLv2 there is the class-path exception
>>> which makes it actually less restrictive and makes it easier to use
>> the code in commercial offerings:
>>>
>>> As a special exception, the copyright holders of this library give
>> you permission to link this library with independent
>>> modules to produce an executable, regardless of the license terms of
>> these independent modules, and to copy and
>>> distribute the resulting executable under terms of your choice,
>> provided that you also meet, for each linked independent
>>> module, the terms and conditions of the license of that module. An
>> independent module is a module which is not derived
>>> from or based on this library. If you modify this library, you may
>> extend this exception to your version of the
>>> library, but you are not obligated to do so. If you do not wish to
>> do so, delete this exception statement from your
>>> version.
>>>
>>> See also the bottom of the license page here:
>> http://glassfish.java.net/public/CDDL+GPL_1_1.html
>>>
>>> Marek
>>>
>>>>
>>>> cam
>