Mailing-List: contact legal-discuss-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: legal-discuss@apache.org
Received-SPF: pass (athena.apache.org: domain of hyandell@gmail.com designates
 209.85.146.183 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references:x-google-sender-auth;
        b=M1H/gTAaJ5231RQuAOZvdYtb+ZvoC2Qi3JvSoaa6yyj28FMwqxYzkrPmB6V8U4N2yv
         v2B15MKaHkHhbN+iTt6hx2ngLoTTLrVASwSUWH2CxYn27suO7FSoPb07JoZ3r38yuK8V
         uZsrbZuOBrotvfYlWIr3AHgcQauMbZuN2krxY=
Message-ID: <2d12b2f00811231025j2917c827qf64309e212bd4254@mail.gmail.com>
Date: Sun, 23 Nov 2008 10:25:42 -0800
From: "Henri Yandell" <bayard@apache.org>
Sender: hyandell@gmail.com
To: legal-discuss@apache.org
Subject: Re: Use of proprietary binaries
Cc: Kevin <kwsutter@gmail.com>
In-Reply-To: <72c1350f0811211235t49f6d78al546ae1fe5f7ba958@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <72c1350f0811211235t49f6d78al546ae1fe5f7ba958@mail.gmail.com>

Sorry for missing the bit about not distributing it Michael. On to
guidance. I don't see any legal reason why we can't include it in svn
- we're allowed to distribute it, just no one downstream without their
own license from IBM.

My biggest worry would be that some people would tar up an svn co -
even for example our taritup scripts. I'd be tempted to make an svn
location called 'donotredistribute' and svn:external it in. The nature
of svn means it'll be pretty obvious - plus a README file can explain
that (I wouldn't use the NOTICE).

Hope that helps, and sorry for answering the wrong question,

Hen

On Fri, Nov 21, 2008 at 12:35 PM, Michael Dick <michael.d.dick@gmail.com> wrote:
> Hi all,
>
> I work on the OpenJPA project and we have an issue with a compilation
> dependency on an API owned by IBM.
>
> IBM provided the API in binary format with a license that allows us to
> distribute it with our application (ie OpenJPA). It's my understanding that
> we are not allowed to publish the binary elsewhere though (for example we
> would not be allowed to put it on my home directory on people.apache.org).
>
> I wasn't sure how we could limit the exposure of the API, and the best
> solution I  came up with was to include it in version control (SVN).
>
> As a result anyone who extracts the source code from SVN gets a copy of the
> API, and may use it to compile OpenJPA. However we do not distribute the jar
> with the pre-compiled binary distributions of OpenJPA. If the API is needed
> we expect it to be provided by IBM (WebSphere in this case).
>
> I'm looking for guidance on how where we should include and document binary
> dependencies like this one. Can we include a binary like this is SVN and
> just add the approriate disclaimer to NOTICE.txt? Would it be better to make
> the API available on openjpa.apache.org and download it from there as a part
> of our build?
>
> In case it helps the license that the jar was distributed with is available
> on my people.apache.org page at
> http://people.apache.org/~mikedd/ibm-uow-license.txt.
>
> Thanks in advance,
>
> -mike
>

---------------------------------------------------------------------
DISCLAIMER: Discussions on this list are informational and educational
only.  Statements made on this list are not privileged, do not
constitute legal advice, and do not necessarily reflect the opinions
and policies of the ASF.  See <http://www.apache.org/licenses/> for
official ASF policies and documents.
---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org