From dev-return-100335-archive-asf-public=cust-asf.ponee.io@geronimo.apache.org Wed Sep 4 15:01:23 2019 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [207.244.88.153]) by mx-eu-01.ponee.io (Postfix) with SMTP id 40C091804BB for ; Wed, 4 Sep 2019 17:01:23 +0200 (CEST) Received: (qmail 38017 invoked by uid 500); 4 Sep 2019 20:18:16 -0000 Mailing-List: contact dev-help@geronimo.apache.org; run by ezmlm Precedence: bulk list-help: list-unsubscribe: List-Post: Reply-To: dev@geronimo.apache.org List-Id: Delivered-To: mailing list dev@geronimo.apache.org Received: (qmail 38006 invoked by uid 99); 4 Sep 2019 20:18:16 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd3-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 04 Sep 2019 20:18:16 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd3-us-west.apache.org (ASF Mail Server at spamd3-us-west.apache.org) with ESMTP id CE701182AC0 for ; Wed, 4 Sep 2019 15:01:21 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd3-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: 2.003 X-Spam-Level: ** X-Spam-Status: No, score=2.003 tagged_above=-999 required=6.31 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=2, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=disabled Authentication-Results: spamd3-us-west.apache.org (amavisd-new); dkim=pass (2048-bit key) header.d=tomitribe-com.20150623.gappssmtp.com Received: from mx1-he-de.apache.org ([10.40.0.8]) by localhost (spamd3-us-west.apache.org [10.40.0.10]) (amavisd-new, port 10024) with ESMTP id sPkFBpuJXbCO for ; Wed, 4 Sep 2019 15:01:19 +0000 (UTC) Received-SPF: None (mailfrom) identity=mailfrom; client-ip=2607:f8b0:4864:20::343; helo=mail-ot1-x343.google.com; envelope-from=jlmonteiro@tomitribe.com; receiver= Received: from mail-ot1-x343.google.com (mail-ot1-x343.google.com [IPv6:2607:f8b0:4864:20::343]) by mx1-he-de.apache.org (ASF Mail Server at mx1-he-de.apache.org) with ESMTPS id C7EC77DD5C for ; Wed, 4 Sep 2019 15:01:18 +0000 (UTC) Received: by mail-ot1-x343.google.com with SMTP id 97so18068152otr.4 for ; Wed, 04 Sep 2019 08:01:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tomitribe-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6+DElLzOTulIC2IlVsRr2wrdJHytBwwMmX7QqSgrC3g=; b=WEkNQE8acaixOA5OCVq/NizUsHh5xqjQdRWG2+5bKHanxrA5y2HcUpIq6xE8F9jubC tsqGlt5/wXEw4IsftK1pgA/LJriE8BkQAv7BtOTHreUfEcxMynu9Yeaf6cpdw6tLYSw6 kdyvjJcPgUYRMknpqxskpkK38mf2syyVtGPHJX0OM4ZvWd0icj3aT5d6AKQZEsTFT60u WxbG/o9caX0wc3RQ2XBcY/1GXFBOl5f8Iulwm2m4VrKLWQ4jHRjkXFaL883bjBMcUnGg XB3Yy2HIfSatS79U1hHNY30/mjkgBZ9UOe4uDv/YZ/a/pIFG3kNA8raOfOABuoNX61ta FEGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6+DElLzOTulIC2IlVsRr2wrdJHytBwwMmX7QqSgrC3g=; b=NsrM7GzYse4xTrKdOR1oGEPJmt6VWA0bTdRRigbs94Cxh3TsYFWNXy6n8ib2AzhnzI zdaP5zzfkFRQFylRL0J1669oLYQmtXmr5Cip7KKim6RTUUNshoSzjWc6UXxD2ORWGEOt 03XsQ6KKLqU9PPKUyzDTpnFVLaXgcu69DNhPrXbTzOZoUtFA2H/W6xdrCYorXtXgUMDg ondtc9/RNp0jXdu2qG5pYEByV5klaKy38pzfeOxt/19OX4/pr9X9oDsWEap2F98OzMX2 KZPSArQ2gUv5CFM0NknMVaRSfglW2XPDvvNW3DiPUW6+UtlRLhFC4DouC8+QTeFhX5gV C0Og== X-Gm-Message-State: APjAAAXS7LFzHFcLgdho6FsO/DjS/YI9vfQRD2SgWhP0DprfFREZxTlE PM+HAnLQOYo16YpN0d7VPMpdcDSKR9KNHCsNI0Dq+ibp X-Google-Smtp-Source: APXvYqzoPmpOFlvZ2XzeGy4NacOGVGXTEt71yddfLWq9aLP+2gyAKvwA8HCDvMhSHcxx2i4dECdvLQ/3Kz66V7g3eoA= X-Received: by 2002:a05:6830:20d2:: with SMTP id z18mr14379108otq.181.1567609277124; Wed, 04 Sep 2019 08:01:17 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Jean-Louis Monteiro Date: Wed, 4 Sep 2019 17:01:09 +0200 Message-ID: Subject: Re: DISCUSS geronimo-security_1.0_spec content unclear To: dev@tomee.apache.org Cc: geronimo-dev Content-Type: multipart/alternative; boundary="0000000000001c26fd0591bb7abd" --0000000000001c26fd0591bb7abd Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I'd like to certify some of them if possible of course. Le mer. 4 sept. 2019 =C3=A0 15:33, Romain Manni-Bucau a =C3=A9crit : > Not sure I'm following Mark, EPL is fine for us ( > https://www.apache.org/legal/resolved.html) and G spec jars are not > officially certified so don't change of license anytime. > > Romain Manni-Bucau > @rmannibucau | Blog > | Old Blog > | Github < > https://github.com/rmannibucau> | > LinkedIn | Book > < > https://www.packtpub.com/application-development/java-ee-8-high-performan= ce > > > > > Le mer. 4 sept. 2019 =C3=A0 15:07, Mark Struberg a = =C3=A9crit : > > > No, before that it was CDDL+GPL. It just moved to EPL, which is also Ca= tB > > > > LieGrue, > > strub > > > > > Am 04.09.2019 um 15:06 schrieb Romain Manni-Bucau < > rmannibucau@gmail.com > > >: > > > > > > @Mark: didn't change with jakarta donation? can you open a ticket on > > > jakartee tracker please? > > > > > > Romain Manni-Bucau > > > @rmannibucau | Blog > > > | Old Blog > > > | Github < > > https://github.com/rmannibucau> | > > > LinkedIn | Book > > > < > > > https://www.packtpub.com/application-development/java-ee-8-high-performan= ce > > > > > > > > > > > > Le mer. 4 sept. 2019 =C3=A0 15:04, Mark Struberg = a > =C3=A9crit > > : > > > > > >> No, this is an intended situation. > > >> When one fully passes the TCK then you get the EFSL. This 'removes' > the > > >> copyleft nature of the EPL. > > >> The details are quite nested in the legal papers, but that's it > > basically. > > >> > > >> If we just upgrade our existing API to be binary compat then we have > no > > IP > > >> issues. > > >> > > >> LieGrue, > > >> strub > > >> > > >> > > >>> Am 03.09.2019 um 16:37 schrieb Romain Manni-Bucau < > > rmannibucau@gmail.com > > >>> : > > >>> > > >>> MP license is ok (Apache2) but Jakarta is EPLs so keeps the ambigui= ty > > >> for us. > > >>> That said it is good to reuse the same GAV for end users so we migh= t > > ask > > >> jakarta to double license its api jars? > > >>> > > >>> Romain Manni-Bucau > > >>> @rmannibucau | Blog | Old Blog | Github | LinkedIn | Book > > >>> > > >>> > > >>> Le mar. 3 sept. 2019 =C3=A0 16:33, Jean-Louis Monteiro < > > >> jlmonteiro@tomitribe.com> a =C3=A9crit : > > >>> Yep that was the point. > > >>> So I was asking if we should do the same yes or not. > > >>> > > >>> That seems to be your opinion Romain. > > >>> Mark on the other end is having some doubts about the license. > > >>> -- > > >>> Jean-Louis Monteiro > > >>> http://twitter.com/jlouismonteiro > > >>> http://www.tomitribe.com > > >>> > > >>> > > >>> On Tue, Sep 3, 2019 at 4:31 PM Romain Manni-Bucau < > > rmannibucau@gmail.com> > > >> wrote: > > >>> Le mar. 3 sept. 2019 =C3=A0 16:29, Jean-Louis Monteiro < > > >> jlmonteiro@tomitribe.com> > > >>> a =C3=A9crit : > > >>> > > >>>> Thanks Romain. I'm fine with using Eclipse jars if from a legal > point > > >> of > > >>>> view, it works. > > >>>> Otherwise, I'd like to split our spec jars. > > >>>> > > >>>> What about MicroProfile? > > >>>> > > >>> > > >>> We already agreed to not redo the API and use microprofile jars. > > >>> > > >>> > > >>>> It's the same license and we are using them in our MicroProfile > > >>>> implementations. > > >>>> -- > > >>>> Jean-Louis Monteiro > > >>>> http://twitter.com/jlouismonteiro > > >>>> http://www.tomitribe.com > > >>>> > > >>>> > > >>>> On Tue, Sep 3, 2019 at 4:26 PM Mark Struberg > > > >>> > > >>>> wrote: > > >>>> > > >>>>> depends what their license is. EPL is (weak) copyleft. Thus I wou= ld > > >> like > > >>>>> to avoid exposing it downstream as api. > > >>>>> > > >>>>> LieGrue, > > >>>>> strub > > >>>>> > > >>>>> > > >>>>>> Am 03.09.2019 um 16:20 schrieb Romain Manni-Bucau < > > >>>>> rmannibucau@gmail.com>: > > >>>>>> > > >>>>>> If we still can't reuse jakata artifacts (their license is ok an= d > > >> there > > >>>>> is > > >>>>>> no impl reference inside so we should just use them, right?) it > > >> sounds > > >>>>>> natural > > >>>>>> > > >>>>>> Romain Manni-Bucau > > >>>>>> @rmannibucau | Blog > > >>>>>> | Old Blog > > >>>>>> | Github < > > >>>>> https://github.com/rmannibucau> | > > >>>>>> LinkedIn | Book > > >>>>>> < > > >>>>> > > >> > > > https://www.packtpub.com/application-development/java-ee-8-high-performan= ce > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> Le mar. 3 sept. 2019 =C3=A0 16:18, Jean-Louis Monteiro < > > >>>>> jlmonteiro@tomitribe.com> > > >>>>>> a =C3=A9crit : > > >>>>>> > > >>>>>>> Hi all, > > >>>>>>> > > >>>>>>> I was digging into some other specifications and see what would > > >> pass > > >>>>>>> Jakarta TCK and realized that geronimo-security_1.0_spec conten= t > > >>>>> actually > > >>>>>>> mixes 2 specifications. > > >>>>>>> > > >>>>>>> https://github.com/eclipse-ee4j/security-api > > >>>>>>> > > >>>>>>> and > > >>>>>>> > > >>>>>>> https://github.com/eclipse-ee4j/jaspic > > >>>>>>> > > >>>>>>> I thought the initial intent was to create a specific artifact > per > > >>>>>>> specification. > > >>>>>>> Mixing them is a bit annoying from a certification perspective. > > >>>>>>> It's also not clean because in Tomcat for instance, there is > > >> already > > >>>>>>> jaspic API so it becomes a duplicate. > > >>>>>>> > > >>>>>>> Would it be possible to split them up in 2 artifacts? > > >>>>>>> > > >>>>>>> -- > > >>>>>>> Jean-Louis Monteiro > > >>>>>>> http://twitter.com/jlouismonteiro > > >>>>>>> http://www.tomitribe.com > > >>>>>>> > > >>>>> > > >>>>> > > >> > > >> > > > > > --0000000000001c26fd0591bb7abd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I'd like to certify some of them if possible of cours= e.=C2=A0

Le mer. 4 sept. 2019 =C3=A0 15:33, Romain Manni-Bucau <rmannibucau@gmail.com> a =C3=A9cri= t=C2=A0:
Not sure I'm following= Mark, EPL is fine for us (
https://www.apache.org/legal/resolved.html)= and G spec jars are not
officially certified so don't change of license anytime.

Romain Manni-Bucau
@rmannibucau <https://twitter.com/rmannibucau> |= =C2=A0 Blog
<https://rmannibucau.metawerx.net/> | Old Blog=
<http://rmannibucau.wordpress.com> | Github <= ;https://github.com/rmannibucau> |
LinkedIn <https://www.linkedin.com/in/rmannibuc= au> | Book
<https://ww= w.packtpub.com/application-development/java-ee-8-high-performance>

Le mer. 4 sept. 2019 =C3=A0 15:07, Mark Struberg <struberg@yahoo.de&g= t; a =C3=A9crit :

> No, before that it was CDDL+GPL. It just moved to EPL, which is also C= atB
>
> LieGrue,
> strub
>
> > Am 04.09.2019 um 15:06 schrieb Romain Manni-Bucau <rmannibu= cau@gmail.com
> >:
> >
> > @Mark: didn't change with jakarta donation? can you open a ti= cket on
> > jakartee tracker please?
> >
> > Romain Manni-Bucau
> > @rmannibucau <https://twitter.com/rmannibuca= u> |=C2=A0 Blog
> > <https://rmannibucau.metawerx.net/> = | Old Blog
> > <http://rmannibucau.wordpress.com> | = Github <
> https://github.com/rmannibucau> |
> > LinkedIn <https://www.linkedin.com/in= /rmannibucau> | Book
> > <
> https://w= ww.packtpub.com/application-development/java-ee-8-high-performance
> >
> >
> >
> > Le mer. 4 sept. 2019 =C3=A0 15:04, Mark Struberg <struberg@yaho= o.de> a =C3=A9crit
> :
> >
> >> No, this is an intended situation.
> >> When one fully passes the TCK then you get the EFSL. This = 9;removes' the
> >> copyleft nature of the EPL.
> >> The details are quite nested in the legal papers, but that= 9;s it
> basically.
> >>
> >> If we just upgrade our existing API to be binary compat then = we have no
> IP
> >> issues.
> >>
> >> LieGrue,
> >> strub
> >>
> >>
> >>> Am 03.09.2019 um 16:37 schrieb Romain Manni-Bucau < > rmannibucau@gmail.com
> >>> :
> >>>
> >>> MP license is ok (Apache2) but Jakarta is EPLs so keeps t= he ambiguity
> >> for us.
> >>> That said it is good to reuse the same GAV for end users = so we might
> ask
> >> jakarta to double license its api jars?
> >>>
> >>> Romain Manni-Bucau
> >>> @rmannibucau |=C2=A0 Blog | Old Blog | Github | LinkedIn = | Book
> >>>
> >>>
> >>> Le mar. 3 sept. 2019 =C3=A0 16:33, Jean-Louis Monteiro &l= t;
> >> jlmonteiro@tomitribe.com> a =C3=A9crit :
> >>> Yep that was the point.
> >>> So I was asking if we should do the same yes or not.
> >>>
> >>> That seems to be your opinion Romain.
> >>> Mark on the other end is having some doubts about the lic= ense.
> >>> --
> >>> Jean-Louis Monteiro
> >>> http://twitter.com/jlouismonteiro<= br> > >>> http://www.tomitribe.com
> >>>
> >>>
> >>> On Tue, Sep 3, 2019 at 4:31 PM Romain Manni-Bucau < > rmannibucau@gmail.com>
> >> wrote:
> >>> Le mar. 3 sept. 2019 =C3=A0 16:29, Jean-Louis Monteiro &l= t;
> >> jlmonteiro@tomitribe.com>
> >>> a =C3=A9crit :
> >>>
> >>>> Thanks Romain. I'm fine with using Eclipse jars i= f from a legal point
> >> of
> >>>> view, it works.
> >>>> Otherwise, I'd like to split our spec jars.
> >>>>
> >>>> What about MicroProfile?
> >>>>
> >>>
> >>> We already agreed to not redo the API and use microprofil= e jars.
> >>>
> >>>
> >>>> It's the same license and we are using them in ou= r MicroProfile
> >>>> implementations.
> >>>> --
> >>>> Jean-Louis Monteiro
> >>>> http://twitter.com/jlouismonteiro<= /a>
> >>>> http://www.tomitribe.com
> >>>>
> >>>>
> >>>> On Tue, Sep 3, 2019 at 4:26 PM Mark Struberg
> <struberg@yahoo.de.invalid
> >>>
> >>>> wrote:
> >>>>
> >>>>> depends what their license is. EPL is (weak) copy= left. Thus I would
> >> like
> >>>>> to avoid exposing it downstream as api.
> >>>>>
> >>>>> LieGrue,
> >>>>> strub
> >>>>>
> >>>>>
> >>>>>> Am 03.09.2019 um 16:20 schrieb Romain Manni-B= ucau <
> >>>>> rmannibucau@gmail.com>:
> >>>>>>
> >>>>>> If we still can't reuse jakata artifacts = (their license is ok and
> >> there
> >>>>> is
> >>>>>> no impl reference inside so we should just us= e them, right?) it
> >> sounds
> >>>>>> natural
> >>>>>>
> >>>>>> Romain Manni-Bucau
> >>>>>> @rmannibucau <https://twi= tter.com/rmannibucau> |=C2=A0 Blog
> >>>>>> <https://rmannibucau.me= tawerx.net/> | Old Blog
> >>>>>> <http://rmannibucau.word= press.com> | Github <
> >>>>> https://github.com/rmannibucau> |
> >>>>>> LinkedIn <https:/= /www.linkedin.com/in/rmannibucau> | Book
> >>>>>> <
> >>>>>
> >>
> https://w= ww.packtpub.com/application-development/java-ee-8-high-performance
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>> Le mar. 3 sept. 2019 =C3=A0 16:18, Jean-Louis= Monteiro <
> >>>>> jlmonteiro@tomitribe.com>
> >>>>>> a =C3=A9crit :
> >>>>>>
> >>>>>>> Hi all,
> >>>>>>>
> >>>>>>> I was digging into some other specificati= ons and see what would
> >> pass
> >>>>>>> Jakarta TCK and realized that geronimo-se= curity_1.0_spec content
> >>>>> actually
> >>>>>>> mixes 2 specifications.
> >>>>>>>
> >>>>>>> https://git= hub.com/eclipse-ee4j/security-api
> >>>>>>>
> >>>>>>> and
> >>>>>>>
> >>>>>>> https://github.co= m/eclipse-ee4j/jaspic
> >>>>>>>
> >>>>>>> I thought the initial intent was to creat= e a specific artifact per
> >>>>>>> specification.
> >>>>>>> Mixing them is a bit annoying from a cert= ification perspective.
> >>>>>>> It's also not clean because in Tomcat= for instance, there is
> >> already
> >>>>>>> jaspic API so it becomes a duplicate.
> >>>>>>>
> >>>>>>> Would it be possible to split them up in = 2 artifacts?
> >>>>>>>
> >>>>>>> --
> >>>>>>> Jean-Louis Monteiro
> >>>>>>> http://twitter.com/jlo= uismonteiro
> >>>>>>> http://www.tomitribe.com > >>>>>>>
> >>>>>
> >>>>>
> >>
> >>
>
>
--0000000000001c26fd0591bb7abd--