Bug#823812: netbeans: non-free files

Mon May 9 21:31:19 UTC 2016

Hi,

Am 09.05.2016 um 12:11 schrieb Dmitry Smirnov:
> Source: netbeans
> Version: 8.1+dfsg2-3
> Severity: serious
> Usertags: dfsg
> 
> Files:
>     cnd/javahelp/org/netbeans/modules/cnd/help/legal_notice.htm
>     javacard.project/javahelp/org/netbeans/modules/javacard/project/docs/help/docinfo.html
> 
> Contain fairly restrictive license:
> 
> ~~~~
> Except as expressly permitted in your
> license agreement or allowed by law, you may not use, copy, reproduce,
> translate, broadcast, modify, license, transmit, distribute, exhibit,
> perform, publish, or display any part, in any form, or by any means.
> Reverse engineering, disassembly, or decompilation of this software, unless
> required by law for interoperability, is prohibited.

It sounds scary but the first part of the sentence is important:

"Except as expressly permitted in your license agreement..."

The license agreement is GPL-2+-with-classpath-exception or CDDL-1

> 
> Those terms seems to apply to other files in respective directories.
> 
> File:
>     java.sourceui/test/unit/src/org/netbeans/api/java/source/ui/FileChooser.html
> 
> is explicitly licensed under those terms.

FileChooser.html does not contain a specific license grant. There are
more files under ui but those contain the standard license headers,
GPL-2+-with-classpath-exception or CDDL-1

> 
> --------
> 
> File:
>     javascript2.extjs/test/unit/data/testfiles/completion/applyMethod/ClassManager.js
> 
> contains the following:
> 
> ~~~~
> Licensees holding valid commercial licenses may use this file in accordance with the Commercial
> Software License Agreement provided with the Software or, alternatively, in accordance with the
> terms contained in a written agreement between you and Sencha.
> ~~~~
> 
> However no other license is mentioned.

That's true and I wished upstream would be more careful about this.
However this file is part of the ExtJS framework from Sencha and is also
licensed under the GPL-3. I will update debian/copyright accordingly.

> 
> --------
> 
> Files:
>     j2ee.dd/src/org/netbeans/modules/j2ee/dd/impl/resources/web-app_2_3.dtd
>     j2ee.ddloaders/src/org/netbeans/modules/j2ee/ddloaders/catalog/resources/web-app_2_3.dtd
>     j2ee.sun.dd/src/org/netbeans/modules/j2ee/sun/dd/impl/resources/static-verification_1_4.dtd
>     j2ee.weblogic9/src/org/netbeans/modules/j2ee/weblogic9/resources/ejb-jar_2_1.xsd
>     j2ee.weblogic9/src/org/netbeans/modules/j2ee/weblogic9/resources/j2ee_1_4.xsd
>     j2ee.weblogic9/src/org/netbeans/modules/j2ee/weblogic9/resources/j2ee_web_services_client_1_1.xsd
>     j2ee.weblogic9/src/org/netbeans/modules/j2ee/weblogic9/resources/jsp_2_0.xsd
>     j2ee.weblogic9/src/org/netbeans/modules/j2ee/weblogic9/resources/web-app_2_4.xsd
>     schema2beans/test/unit/data/TestApplication1_4.xsd
>     schema2beans/test/unit/data/TestFinalWebApp.xsd
>     schema2beans/test/unit/data/TestWebApp.xsd
>     schema2beans/test/unit/data/TestWebAppDelegator.xsd
>     schema2beans/test/unit/data/TestWebAppDelegatorBaseBean.xsd
>     schema2beans/test/unit/data/final_j2ee_1_4.xsd
>     schema2beans/test/unit/data/final_jsp_2_0.xsd
>     schema2beans/test/unit/data/j2ee_1_4.xsd
>     schema2beans/test/unit/data/j2ee_web_services_client_1_1.xsd
>     schema2beans/test/unit/data/jsp_2_0.xsd
>     web.core/src/org/netbeans/modules/web/taglib/resources/j2ee_1_4.xsd
>     web.core/src/org/netbeans/modules/web/taglib/resources/j2ee_web_services_client_1_1.xsd
>     web.core/src/org/netbeans/modules/web/taglib/resources/web-jsptaglibrary_2_0.xsd
> 
> ~~~~
>  This document and the technology which it describes are
>  distributed under licenses restricting their use, copying,
>  distribution, and decompilation. No part of this document
>  may be reproduced in any form by any means without prior
>  written authorization of Sun and its licensors, if any.
> ~~~~

Sun Microsystems was bought by Oracle a few years ago. The schema
resources / specifications are licensed under the standard license now. See

http://www.oracle.com/webfolder/technetwork/jsc/xml/ns/javaee/index.html

and download some of the files to verify this statement.

> 
> Same terms are also present in the following files, under
> "CDDL or GPL-2 and exception-GPL-Classpath" header:
> 
> Files:
>     web.jsf/src/org/netbeans/modules/web/jsf/resources/javaee_5.xsd
>     web.jsf/src/org/netbeans/modules/web/jsf/resources/javaee_web_services_client_1_2.xsd
>     web.jsf/src/org/netbeans/modules/web/jsf/resources/web-facesconfig_1_2.xsd
>     web.jsf/src/org/netbeans/modules/web/jsf/resources/web-facesconfig_2_0.xsd
> 
> --------

See above

> 
> File:
>     php.editor/test/unit/data/testfiles/parser/performance/performance.php
> 
> is from "SMF 1.1" which is non-free according to
> 
>     http://www.simplemachines.org/about/opensource.php
> 
> ~~~~
>  The license used for SMF 1.0 and SMF 1.1 is more restrictive than OSI
>  approved licenses. That license allows users to modify the source, but does
>  not allow them to redistribute or re-release the software without the
>  express, written consent of Simple Machines.
> ~~~~

Yeah, the latest version of SMF is licensed under BSD-3-clause, so I
believe we could easily replace the file with the current version but
since we don't build php modules anyway, I am going to remove the whole
directory.

> --------
> 
> Files:
>     cnd.makeproject/src/org/netbeans/modules/cnd/makeproject/ui/resources/samples/fractal.html
>     cnd.makeproject/src/org/netbeans/modules/cnd/makeproject/ui/resources/samples/hello.html
>     cnd.makeproject/src/org/netbeans/modules/cnd/makeproject/ui/resources/samples/lexyacc.html
>     cnd.makeproject/src/org/netbeans/modules/cnd/makeproject/ui/resources/samples/pi.html
>     editor.lib2/test/unit/src/org/netbeans/spi/editor/highlighting/performance/data/*
>     editor/test/qa-functional/data/org/netbeans/test/editor/data/OTA_TravelItinerary.xsd
>     java.lexer/test/unit/data/testfiles/JComponent.java.txt
>     web.jsf/src/org/netbeans/modules/web/jsf/resources/web-facesconfig_1_0.dtd
>     web.jsf/src/org/netbeans/modules/web/jsf/resources/web-facesconfig_1_1.dtd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/OTA_TravelItinerary.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/address.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/address1.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/address2.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/address3.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/brokenSchema.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/cycle.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/include1.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/include2.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/items.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/multifilePO.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/newpo.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/newpo1.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/po.xsd
>     xml.axi/test/unit/src/org/netbeans/modules/xml/axi/resources/types.xsd
>     xml.schema.completion/test/unit/src/org/netbeans/modules/xml/schema/completion/resources/OTA_TravelItinerary.xsd
>     xml.text/test/unit/src/org/netbeans/modules/xml/text/indent/OTA_TravelItinerary.xsd
>     xml.wsdl.model/test/unit/src/org/netbeans/modules/xml/wsdl/model/resources/OTA_TravelItinerary.xsd
> 
> contain "SUN PROPRIETARY/CONFIDENTIAL. Use is subject to license terms.".
> 
> --------

In my opinion Oracle is the copyright holder of these files now and they
have relicensed everything to their standard license.

> Less important issues include many files with "All Rights Reserved"
> but without reference to any particular license as well as files with
> (full text of) non-free licenses without scope where they apply:
> 
> "nbbuild/licenses/TEL_For_NB_dbxGUI" contains
> 
>     "SUN Technology Evaluation License" limiting use of "Sun Studio GUI
>      Modules for dbx debugger" to "One-hundred-twenty (120) days".
> 
> "nbbuild/licenses/Northwoods" contains
> 
>     "3. You may only use the Software in binary form and only in conjunction
>      with NetBeans".
> 
> Please investigate.

The phrase "All Rights Reserved" is very common for Oracle products and
nothing to worry about:
 https://en.wikipedia.org/wiki/All_rights_reserved

We have removed a lot of jar files already and some of these licenses
apply to binary packages that would be normally downloaded at build
time. I believe there is no file present in the source tarball under
these specific licenses. If you find one, please let us know.

Regards,

Markus

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 949 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-java-maintainers/attachments/20160509/2ba57a75/attachment-0001.sig>