Mailing-List: contact legal-discuss-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: legal-discuss@apache.org
MIME-Version: 1.0
In-Reply-To: <CAOqetn_SQQV8z3tD+XtGiBNBXGEmogUbju-2aFAsOQBSROWK2A@mail.gmail.com>
References: <CAOqetn_SQQV8z3tD+XtGiBNBXGEmogUbju-2aFAsOQBSROWK2A@mail.gmail.com>
From: Romain Manni-Bucau <rmannibucau@gmail.com>
Date: Tue, 3 Jan 2017 12:51:28 +0100
Message-ID: <CACLE=7P1E2hh9SmBygXGUx309U6M=Pv74oefWPJ+zya4RG87Aw@mail.gmail.com>
Subject: Re: Inclusion of .class files within a Apache Source Release
To: legal-discuss@apache.org
Content-Type: multipart/alternative; boundary=047d7bae45321a017505452f4b80
archived-at: Tue, 03 Jan 2017 11:51:58 -0000

--047d7bae45321a017505452f4b80
Content-Type: text/plain; charset=UTF-8

Hi John,

I think you see it the wrong way, this .class files are binary dependencies
of the tests and that's it. The license - as any other part of ASF software
- should be guaranteed by PMC (not by headers which by themself doesn't
prove the code is legal).

Concretely there is no violation of all the mentionned links and this is
perfectly valid.


Romain Manni-Bucau
@rmannibucau <https://twitter.com/rmannibucau> |  Blog
<https://blog-rmannibucau.rhcloud.com> | Old Blog
<http://rmannibucau.wordpress.com> | Github <https://github.com/rmannibucau> |
LinkedIn <https://www.linkedin.com/in/rmannibucau> | JavaEE Factory
<https://javaeefactory-rmannibucau.rhcloud.com>

2017-01-03 12:45 GMT+01:00 John D. Ament <johndament@apache.org>:

> Hi,
>
> While looking at [1] and looking at a proposed Apache OpenWebBeans [2] it
> was discovered that .class files were contained in the source release.  It
> seems in the past that image files were generally considered OK in source
> releases, since they typically had to do with building websites, the
> traceability of the image was easy to discover.
>
> .class files are the compiled output from .java source files (as well as
> .groovy and other JVM languages, depending on how you compile).  Since they
> are compiled output, it seems they shouldn't be in a source release.
> However, the only true policy I could find that it violated was that we
> require appropriate licensing [3] and there is no way to verify the
> licensing of these files.
>
> So I'm wondering 1. is that accurate? and 2. is there an acceptable way to
> verify that the license is correct?
>
> [1]: http://www.apache.org/dev/release.html#what-must-
> every-release-contain
> [2]: https://lists.apache.org/thread.html/869c739764d5d55d81199576d730d4
> 85d66df8be17ae16398dd7ca1f@%3Cdev.openwebbeans.apache.org%3E
> [3]: http://www.apache.org/dev/release-publishing.html#valid
>
>

--047d7bae45321a017505452f4b80
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi John,<div><br></div><div>I think you see it the wrong w=
ay, this .class files are binary dependencies of the tests and that&#39;s i=
t. The license - as any other part of ASF software - should be guaranteed b=
y PMC (not by headers which by themself doesn&#39;t prove the code is legal=
).</div><div><br></div><div>Concretely there is no violation of all the men=
tionned links and this is perfectly valid.</div></div><div class=3D"gmail_e=
xtra"><br clear=3D"all"><div><div class=3D"gmail_signature" data-smartmail=
=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=
=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr">=
<div><div dir=3D"ltr"><div><br><span style=3D"font-size:small">Romain Manni=
-Bucau</span><br><a href=3D"https://twitter.com/rmannibucau" target=3D"_bla=
nk">@rmannibucau</a> | =C2=A0<a href=3D"https://blog-rmannibucau.rhcloud.co=
m" target=3D"_blank">Blog</a>=C2=A0| <a href=3D"http://rmannibucau.wordpres=
s.com" target=3D"_blank">Old Blog</a> |=C2=A0<a href=3D"https://github.com/=
rmannibucau" target=3D"_blank">Github</a>=C2=A0| <a href=3D"https://www.lin=
kedin.com/in/rmannibucau" target=3D"_blank">LinkedIn</a>=C2=A0| <a href=3D"=
https://javaeefactory-rmannibucau.rhcloud.com" target=3D"_blank">JavaEE Fac=
tory</a></div></div></div></div></div></div></div></div></div></div></div><=
/div></div></div></div></div>
<br><div class=3D"gmail_quote">2017-01-03 12:45 GMT+01:00 John D. Ament <sp=
an dir=3D"ltr">&lt;<a href=3D"mailto:johndament@apache.org" target=3D"_blan=
k">johndament@apache.org</a>&gt;</span>:<br><blockquote class=3D"gmail_quot=
e" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">=
<div dir=3D"ltr">Hi,<div><br></div><div>While looking at [1] and looking at=
 a proposed Apache OpenWebBeans [2] it was discovered that .class files wer=
e contained in the source release.=C2=A0 It seems in the past that image fi=
les were generally considered OK in source releases, since they typically h=
ad to do with building websites, the traceability of the image was easy to =
discover.</div><div><br></div><div>.class files are the compiled output fro=
m .java source files (as well as .groovy and other JVM languages, depending=
 on how you compile).=C2=A0 Since they are compiled output, it seems they s=
houldn&#39;t be in a source release.=C2=A0 However, the only true policy I =
could find that it violated was that we require appropriate licensing [3] a=
nd there is no way to verify the licensing of these files.</div><div><br></=
div><div>So I&#39;m wondering 1. is that accurate? and 2. is there an accep=
table way to verify that the license is correct?</div><div><br></div><div>[=
1]:=C2=A0<a href=3D"http://www.apache.org/dev/release.html#what-must-every-=
release-contain" target=3D"_blank">http://www.apache.org/<wbr>dev/release.h=
tml#what-must-<wbr>every-release-contain</a></div><div>[2]:=C2=A0<a href=3D=
"https://lists.apache.org/thread.html/869c739764d5d55d81199576d730d485d66df=
8be17ae16398dd7ca1f@%3Cdev.openwebbeans.apache.org%3E" target=3D"_blank">ht=
tps://lists.apache.org/<wbr>thread.html/<wbr>869c739764d5d55d81199576d730d4=
<wbr>85d66df8be17ae16398dd7ca1f@%<wbr>3Cdev.openwebbeans.apache.org%<wbr>3E=
</a></div><div>[3]:=C2=A0<a href=3D"http://www.apache.org/dev/release-publi=
shing.html#valid" target=3D"_blank">http://www.apache.org/<wbr>dev/release-=
publishing.html#<wbr>valid</a></div><div><br></div></div>
</blockquote></div><br></div>

--047d7bae45321a017505452f4b80--