www-legal-discuss mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Carte Project (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (LEGAL-333) Maven Central Repository terms are incompatible with the Apache License
Date Mon, 25 Sep 2017 15:39:00 GMT

    [ https://issues.apache.org/jira/browse/LEGAL-333?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16179185#comment-16179185

Carte Project commented on LEGAL-333:

bq. consumers of the Apache licensed work. You yourself have admitted that they are not affected
by Sonatype's terms.

No, I said that it is less of an issue for them. But anything touching the license is also
affecting end users. I keep thinking that since the moment that the ASF artifacts are distributed
by the Central repository, they are bound to Sonatype's terms of use, which are an obvious
infringement of the Apache License. +Whether the ASF agrees or not that it is an infringement+
is the issue that is being discussed here, and IMHO that should be cleared out before proceeding
on possible changes to Maven, etc.

Of course if the Apache artifacts go under an agreement that is different than the one at
Sonatype's website, that would change things a lot, but that hasn't been claimed in a clear
way so far (that's what you called "Sean's third bullet" I believe).

bq. what is left is a question as to whether the ASF is OK with Sonatype's terms

Yes as explained above, but not limited to that: because in practice most of the Java open
source projects are under pressure to distribute under Maven Central. That is, they are unknowingly
infringing their own licenses because of using the Maven Central Repository. So yes, whether
the ASF agrees or not to the terms is the central question, but not the only issue here.

That is, if the ASF admits that those terms of use are infringing the Apache License, so are
infringing other licenses. The issue is huge.

bq. you should bring it up on the Maven dev list

The technical details about the proposal should be discussed there, but the reasoning about
the legal arguments behind such a large change belong here.

> Maven Central Repository terms are incompatible with the Apache License
> -----------------------------------------------------------------------
>                 Key: LEGAL-333
>                 URL: https://issues.apache.org/jira/browse/LEGAL-333
>             Project: Legal Discuss
>          Issue Type: Question
>            Reporter: Carte Project
>            Assignee: Chris A. Mattmann
> All or nearly all of the ASF's Java software projects are distributed through the Maven
Central Repository operated by Sonatype, Inc. Their "full terms of service" (as they are described
in [this page|http://central.sonatype.org/pages/ossrh-guide.html]) can be found here:
> [http://central.sonatype.org/pages/central-repository-producer-terms.html]
> The "Indemnity for Submissions" clause states:
> bq. You agree to indemnify and hold harmless Sonatype and its affiliates, suppliers,
partners, officers, agents, and employees from and against any claim, demand, losses, damages
or expenses (including reasonable attorney's fees) arising from your Submissions.
> To me, the obligation to indemnify against any claim "arising from your Submissions"
sounds somewhat incompatible with the 8 and 9 clauses of the [Apache License 2.0|http://www.apache.org/licenses/LICENSE-2.0].
And my understanding is that all of the ASF's Maven artifacts are nearly-automatically deployed
on that repository.
> Am I missing something?  Any comments?

This message was sent by Atlassian JIRA

To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org

View raw message