[Pkg-giraffe-discuss] zarafa-webaccess, rework of the packaging for Debian

[Carsten Schoenert]

Hello Jelle,

as we have today a public holiday in germany I have happily can work
further on the zarafa-webapp package.

Yesterday I have done more rework of the debian/copyright file and now I
have nor more complains from Lintian about found issues there. But this
doesn't mean we are through the license hell. :-(
It's possible that we still have missed some corner cases or files.

You have for example some points and files already picked up by your
previous mail seen below ...

I also applied your patch from the other mail into a Debian patch-queue
as it's modified the upstream source, This patch will go away in further
releases of zarafa-webapp with your upstream changes. It solves
temporally one reference to the PHP 2.02 license that has to go away.
On thing is left, isn't plugins/spreed/php/dat/legacy/timezones.inc also
not making go away?
This file is left with a reference to PHP-2.02 license. If really
needed, isn't it possible to write up a own file that includes the
timezones informations? Or better use the timezone basic informations
from the system? (Please don't blame if I'm asking shit here. :) I don't
exactly know what the code inside the PHP here is really doing, a
greping via 'git grep' let me assume it's not used and only needed for
backward compatibility.)

Am 16.05.2015 um 21:58 schrieb Jelle van der Waa:
> I've been working on the copyright file, I guess the easiest way to
> work on it is to fork your Github repo, so far I've made a couple of
> commits in my fork. [1]

Yes thanks, I'm just answering for completeness, I picked up your
patches and worked on top of them.

> * Added client/zarafa/Object.js (code copied from
>   https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/keys)
>   Not sure what the license should be.

As you have written on the IRC this file is licensed under CC-BY-SA-2.5,
I added this info to the copyright file.

> * Added various missing licenses here, the ABOUT.js files contain
>   the license of the component (for example a plugin), so I guess they
>   shouldn't be mentioned as the following text in debian/copyright?
> 
>   Files: plugins/spreed/js/ABOUT.js
>   Copyright: The PHP Group, and covered
>              2005-2015, Zarafa B.V. and its licensors <info at zarafa.com>
>              1999,2000,2002, Edd Dumbill <edd at usefulinc.com>
>   License: BSD-3  and AGPL-3

Isn't this/theses file(s) ABOUT.js completely from Zarafa itself?
If yes, it's up to you which license you want to choose.

> * client/third-party/lovcombo mentions LGPL-3 in the file and
>   client/third-party/iconcombobox is from the same author but there is no
>   license information in the file, I am not sure how to proceed here.

It's always a mess to have files without really clear copyright
definitions. The two files are from the same author as seen within the
header of the files.  lovcombo/Ext.ux.form.LovCombo.js has a explicitly
license paragraph, it's licensed under the LGPL-3

> $ head -n14 Ext.ux.form.LovCombo.js 
> // vim: ts=4:sw=4:nu:fdc=4:nospell
> /**
>  * Ext.ux.form.LovCombo, List of Values Combo
>  *
>  * @author    Ing. Jozef Sakáloš
>  * @copyright (c) 2008, by Ing. Jozef Sakáloš
>  * @date      16. April 2008
>  * @version   $Id: Ext.ux.form.LovCombo.js 285 2008-06-06 09:22:20Z jozo $
>  *
>  * @license Ext.ux.form.LovCombo.js is licensed under the terms of the Open Source
>  * LGPL 3.0 license. Commercial use is permitted to the extent that the 
>  * code/component(s) do NOT become part of another Open Source or Commercially
>  * licensed development library or toolkit without explicit permission.
>  *

Unfortunately iconcombobox/Ext.ux.IconCombo.js hasn't such a statement ...

> $ head -n14 ../iconcombobox/Ext.ux.IconCombo.js 
> Ext.ns('Ext.ux');
> // vim: ts=4:sw=4:nu:fdc=2:nospell
> /**
>   * Ext.ux.IconCombo Extension Class for Ext 2.x Library
>   *
>   * @author  Ing. Jozef Sakalos
>   * @version $Id: Ext.ux.IconCombo.js 617 2007-12-20 11:29:56Z jozo $
>   *
>   * @class Ext.ux.IconCombo
>   * @extends Ext.form.ComboBox
>   */
> Ext.ux.IconCombo = Ext.extend(Ext.form.ComboBox, {
>     initComponent:function() {

The only info there can be found shows that this file is a extension for
the ExtJS v2.0.
ExtJS is now living in the Sencha project (current version is 5.x),
Unfortunately Sencha isn't providing a public repository so the only
resources I find are various Github forks from unclear sources. In the
deep of the Sencha forum [1] I found a link to a "official" resource on
the Google Codes site [2].
ExtJS v2.0 was licensed under the terms of the LGPL-3 with some
exceptions, later versions are released with GPL-3 terms. Booth licenses
are as know obligate the user to fully release there changes they made
and any further derivate must licensed under the same license, so also
the file Ext.ux.IconCombo.js.

[1]
https://www.sencha.com/forum/showthread.php?200033-Public-ExtJS-github-repository
[2] https://code.google.com/p/extjs-public/

The ExtJS library in Debian (>= Jessie) is version 3.4 so I tend to use
the GPL-3 for client/third-party/iconcombobox/Ext.ux.IconCombo.js as
it's also a little bit more strict than LGPL-3.

> * client/third-party/md5, couldn't find any information about this
>   library (source or license), it's now removed from this location in the
>   next release. Since it is only required for the gmaps plugin (so it has
>   been moved to plugins/gmaps)

O.k. so no further action is needed here curently.

> * client/third-party/Ext.ux.Icondragselector.js, can't see this code
>   being used, will check further later (Looks like it has been copied from
>   the official ExtJS website, so I would assume the ExtJS license applies,
>   but I am not 100% certain).

If copied from ExtJS, yes, than GPL-3.
As mentioned on the IRC, I personally add a information in the header in
such cases of the file there it was taken, make many things a lot easier
later in case of questions.

> * plugins/files/php/Files/sabredav LICENSE can be found in the
>   following url. [2] The library is also available in Jessie, I am not
>   sure how we can make it work with the Debian shipped version.

The usability of a possible Debian package depends on the availability
of functions you need, if you are need bleeding edge functions than you
probably need to ship you own copy, otherwise we simply can symlink to
the other package in Debian. OTOH it's maybe a good idea to have a most
actual version of needed dependencies in Debian. As I can see there is a
new major release of php-sabre-dav living in experimental, which will
some day available in unstable/testing.

I don't know the exact differences between the versions 1.8 and 2.2 but
I wouldn't be surprised if zarafa-webapp needs functions from
php-sabre-php > 1.8, version 1.8 is now EOL since last month!

I'm not a expert in PHP, JS or similar so here Zarafa on their own which
version to use. It should be now problem to contact the maintainer of
php-sabre-dav to ask him for future plans about this package.
It's of course always nice to deduplicate files, but for now it's also
o.k. to live with potentially duplicated files. Debian has a useful tool
to find automatically duplicated files but that's a 2nd QS.

Back to the license question, plugins/files/php/Files/sabredav/lib/* and
plugins/files/php/Files/sabredav/vendor/composer/* are licensed under
BSD-3, so non big problem here.

> The good news is that we are now more aware of our external
> dependencies and will ship with less dependencies in the new release!

Great, is there a possibility you can provide a RC of the next release
as I have to start more or less from start to filter out the files
without sources (like ext-base.js, prettify.js) and symlink the needed
files to the respective Debian packages (libjs-extjs, libjs-jac,
libjs-prettify)

And one more thing,
are you willing to improve the various extended zarafa-webapp-* package
descriptions as asked on the IRC? So I could focus my work on other
things like linking to other Debian packages that are needed.

PS: I have rebased my work on Github so will need to reset your local
clone of this repo.

---
Regards
Carsten Schoenert