Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 814687 - jmol: Bundled libraries
Summary: jmol: Bundled libraries
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: jmol
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Stanislav Ochotnicky
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 820117
Blocks: FE-Legal DuplicSysLibsTracker
TreeView+ depends on / blocked
 
Reported: 2012-04-20 12:23 UTC by Mikolaj Izdebski
Modified: 2012-05-09 08:26 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-05-09 07:56:34 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Mikolaj Izdebski 2012-04-20 12:23:15 UTC
/usr/share/java/Jmol.jar seems to be bundling several libraries.

The following Java packages are included in Jmol.jar:

com.lowagie.text
com.lowagie.tools
com.obrador
com.sparshui.client
com.sparshui.common
com.sparshui.gestures
com.sparshui.inputdevice
com.sparshui.server
javax.vecmath
org.apache.commons.cli

Comment 1 Susi Lehtola 2012-04-21 15:25:19 UTC
Patches are welcome.

Comment 2 Stanislav Ochotnicky 2012-04-23 11:38:53 UTC
(In reply to comment #1)
> Patches are welcome.

That is...kind of unexpected. I would hope that maintainer who learns that his package is going against the packaging guidelines in a *really* ugly way would go out of his way to fix the situation. I am not talking about bundling that the upstream is doing (com.obrador, com.sparshui), but bundling libraries that are already present in other Fedora packages is not exactly nice. As it is, jmol should have never passed the Package review process.

Removing "unjar" ant tasks, and putting proper jar files on classpath during build and in the shell script that is used to run the jmol application should not be *that* problematic for one of maintainers I would hope.

Comment 3 Stanislav Ochotnicky 2012-04-23 12:01:00 UTC
Moreover if nothing else this package is bundling apache-commons-cli but it is still claiming to be pure LGPLv2+.

Note that upstream is bundling jakarta-commons-cli 1.0, which used ASL 1.1. But we build against commons-cli 1.2 which is ASL 2.0. This makes COPYRIGHT.txt included with the package incorrect because it states among 3d party dependencies:
"Jakarta Commons CLI
  Used for parsing command line optinos. Distributed with The Apache Software
  License, Version 1.1. Copyright (c) 1999-2001 The Apache Software Foundation.
  See http://jakarta.apache.org/commons/cli/."

Blocking FE-LEGAL, because not sure what is the best course of action now. Unbundling at least apache-commons-cli is obviously needed, but I would like guidance for the above case where upstream is building against a differently licensed project. I would assume modifying COPYRIGHT.txt to include some kind of "Fedora note: ..." would be OK? Also, in case it stays bundled it should include NOTICE file required by ASL 2.0?

Similarly, this is bundling itext, which has a license of "(LGPLv2+ or MPLv1.1) and ASL 2.0 and BSD and LGPLv2+" so this if falling short on copyright requirements set by some of these licenses.

Comment 4 Tom "spot" Callaway 2012-04-23 13:54:11 UTC
Ugh. Stanislav, would you be willing to try to rework this package so that it doesn't bundle anymore? If you'll do that, I'll sanity check it and commit the change to resolve this legal issue. (Normally, I'd take a crack at it, but I suspect you'll be able to do it a lot faster and cleaner than I will.)

Comment 5 Stanislav Ochotnicky 2012-04-24 13:42:50 UTC
OK, I'll have a look but currently having a few high priority bugs so this might take a week or two. Reassigning to myself so I don't forget

Comment 6 Stanislav Ochotnicky 2012-05-09 07:40:59 UTC
(In reply to comment #4)
> Ugh. Stanislav, would you be willing to try to rework this package so that it
> doesn't bundle anymore? If you'll do that, I'll sanity check it and commit the
> change to resolve this legal issue. (Normally, I'd take a crack at it, but I
> suspect you'll be able to do it a lot faster and cleaner than I will.)

I've fixed major bundling of things we have in Fedora (commons-cli, itext, vecmath). There are still things in src/ that I still don't like, such as src/com/{obrador,sparshui) packages that seem like forks of other packages, but I couldn't find the original ones in 15 minutes on Google and not planning to spend more. Plus at least sparshui comments seem to suggest modifications of upstream code anyway.

I noticed just now that com/sparshui/cpp directory actually contains an exe file too. Not a big deal I assume, but should be removed in prep.

Comment 7 Susi Lehtola 2012-05-09 07:56:34 UTC
Thanks a lot!

I removed the exe file.


Note You need to log in before you can comment on or make changes to this bug.