another review of copyright/license stuff in openjdk-b09

[Matthias Klose]

Recently Thomas Viehmann did a thorough review of the openjdk-b09 source if all
licenses are DFSG-free *and* have copyrights and licenses accurately documented,
as a prerequisite to upload a package to the Debian distribution.

Some files were skipped in the review, which are already removed from the source
for i.e. the Fedora build. See
http://cvs.fedoraproject.org/viewcvs/devel/java-1.6.0-openjdk/generate-fedora-zip.sh?rev=1.2&view=markup
for a list.

The rest of the email are Thomas comments (some comments added by myself).

  Matthias

Hi all,

as discussed with Matthias, here is a preliminary report for my check of openjdk
in NEW. The check is not yet complete, but I took a stab at evaluating all text
files not particularly hidden (e.g. in jars) that have their copyright
information near the top of the file.

Apologies for this being a bit terse, should it be too short
on anything, don't hesitate to ask.

I'll try to skip the files removed by the fedora-make-zip script, as
Matthias points out, we probably should remove these as well.
There are some additional binaries missed by Fedora(?).
This is a problem and needs to be solved, e.g.
(pathnames assume you have unpacked the main tarball in openjdk)
  openjdk/jdk/test/java/util/Locale/data/deflocale.exe
  openjdk/jdk/test/tools/launcher/lib/sparc/lib32/liblibrary.so
and more *.exe *.so.

fedora-make-zip removes
openjdk/corba/src/share/classes/com/sun/tools/corba/se/idl/first.set
 *    THIS PRODUCT CONTAINS RESTRICTED MATERIALS OF IBM
 *    5639-D57, (C) COPYRIGHT International Business Machines Corp., 1997, 1998
but not
openjdk/corba/src/share/classes/com/sun/tools/corba/se/idl/idl.prp
openjdk/corba/src/share/classes/com/sun/tools/corba/se/idl/idl_*.prp
openjdk/corba/src/share/classes/com/sun/tools/corba/se/idl/toJavaPortable/toJavaPortable*.prp
# Licensed Materials - Property of IBM
# 5639-D57 (C) COPYRIGHT International Business Machines Corp., 1997, 1999
# RMI-IIOP v1.0

Missing copyrights in debian/copyright (or short d/c) (which includes a copy of
the third party readme), need be fixed/checked:

- openjdk/jdk/src/share/classes/java/lang/instrument/package.html
   Copyright 2003 Wily Technology, Inc. License?

- %% This notice is provided with respect to PC/SC Lite for Suse Linux v. 1.1.1,
  which may be included with this software:

  Copyright (c) 1999-2004 David Corcoran
  All rights reserved.
  needs to be Ludovic Rousseau for e.g.
  openjdk/jdk/src/solaris/native/sun/security/smartcardio/MUSCLE/winscard.h

- the Eastman Kodak see below?
- RSA Security Inc. see below?

Some inaccuracies in debian/copyright, should be fixed:
- Sax is said to be public domain in d/c, but Sun claims copyright
  for some of these and licenses under GPL, e.g.
  openjdk/jaxp/src/share/classes/org/xml/sax/HandlerBase.java
  >> in THIRD_PARTY_README as well

- Apache Software Foundation owns copyrights up to 2005

- at least parts of Xerces (and Xalan, but that could be the
  destinction between Xalan J2 and Xalan in d/c) uses
  Apache License 2.0, not just Apache Software license 1.1
  e.g.
openjdk/jaxp/src/share/classes/com/sun/org/apache/xalan/internal/xsltc/compiler/util/VoidType.java
- jaxp/src/share/classes/com/sun/org/apache/xerces/internal/util/SymbolTable.java
-
openjdk/jaxp/src/share/classes/com/sun/xml/internal/stream/XMLEntityReader.java
  has Portions Copyright Sun Microsystems, Inc. in addition
  to ASF,
-
jaxp/src/share/classes/com/sun/org/apache/xerces/internal/impl/dv/InvalidDatatypeValueException.java
  has a note a la "based on software (c) ... IBM ...", don't know if
  that should be mentioned, some more might have that nearby.
-
openjdk/jdk/src/share/classes/com/sun/org/apache/xml/internal/security/Init.java
  and more like it: some xml security is Apache License 2.0,
  debian/copyright says ASL1.1
- %% This notice is provided with respect to IAIK PKCS Wrapper, which may be
included with this software:
  Copyright (c) 2002 Graz University of Technology. All rights reserved.
  should have sun with portions copyright
  e.g.
openjdk/jdk/src/share/classes/sun/security/pkcs11/wrapper/CK_SSL3_RANDOM_DATA.jav
- openjdk/jdk/src/share/classes/sun/security/krb5/PrincipalName.java
  * Portions Copyright 2000-2006 Sun Microsystems, Inc.  All Rights  Reserved.
  ...
  *  (C) Copyright IBM Corp. 1999 All Rights Reserved.
  *  Copyright 1997 The Open Group Research Institute.  All rights reserved./*
  and some nearby

- This notice is provided with respect to Kerberos, which may be included with
this software:
  * Copyright (C) 1998 by the FundsXpress, INC.
  could be more specific and / or list other copyright holders to the
  krb5 stuff, fundsxpress seems to own only one (?) file.

Question for the following files: can these be edited/modfied using free tools?

- openjdk/jaxws/src/share/classes/com/sun/xml/internal/bind/v2/doc-files/
  the .gif and .png files built from .vsd and .sxd files are corrupt,
  cannot be opened. The .sxd file is probably an OOo Impress file, but
  cannot be opened with OOo 2.4. The .vsd file is a Viso file? If yes,
  can the packages.png generated by free software?

- openjdk/jdk/test/sun/net/idn/nfscis.spp


- openjdk/jdk/test/javax/xml/crypto/dsig/data/xml-stylesheet
  has w3c copyright. license to be checked.
  openjdk/jdk/test/javax/xml/crypto/dsig/data/xml-stylesheet.b64
  needs checking after decoding

Some minor things regarding copyright:
- openjdk/jdk/make/sun/javazic/tzdata
  has sun copyright notices that I'm not too sure about (AFAICT some of
  it is just verbatim public domain tzdata).
- openjdk/jdk/make/tools/dtdbuilder/dtds/html32.dtd:
  sun copyright?
- openjdk/jdk/src/share/classes/java/awt/image/renderable/RenderContext.java
  Portions Copyright 1998-2000 Sun Microsystems, Inc.  All Rights Reserved.
  DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  ...
  COPYRIGHT (c) Eastman Kodak Company, 1997
  As  an unpublished  work pursuant to Title 17 of the United
  States Code.  All rights reserved.
  also some more nearby, presumably Sun has licensed that to allow this?

- some files around
  openjdk/jdk/src/share/classes/java/awt/dnd/DragSourceContext.java:
  have import statements in the license note ?!

- openjdk/jdk/src/share/native/sun/awt/libpng/pngtrans.c
  looks strange because of the non-exception GPL notice, probably Sun
  cosmetic mistake.

openjdk/jdk/src/share/native/sun/security/pkcs11/wrapper/pkcs11.h
 /* FILENAME include file for PKCS #11. */
/* $Revision: 1.4 $ */

/* License to copy and use this software is granted provided that it is
 * identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
 * (Cryptoki)" in all material mentioning or referencing this software.

 * License is also granted to make and use derivative works provided that
 * such works are identified as "derived from the RSA Security Inc. PKCS #11
 * Cryptographic Token Interface (Cryptoki)" in all material mentioning or
 * referencing the derived work.

 * RSA Security Inc. makes no representations concerning either the
 * merchantability of this software or the suitability of this software for
 * any particular purpose. It is provided "as is" without express or implied
 * warranty of any kind.
 */
some simmilar nearby, probably needs entry in the third party readme

openjdk/jdk/src/share/classes/sun/text/resources/CollationData_sr.java
 * (C) Copyright Taligent, Inc. 1996, 1997 - All Rights Reserved
 * (C) Copyright IBM Corp. 1996 - 1998 - All Rights Reserved

openjdk/jdk/src/share/classes/sun/text/resources/BreakIteratorRules_th.java
 * IBM Confidential
 * OCO Source Materials
 * IBM Java(tm)2 SDK, Standard Edition, v 1.2
 * (C) Copyright IBM Corp. 1999

openjdk/jdk/src/share/classes/sun/util/resources/CurrencyNames_*.properties
  has sun+unicode copyright (possibly already covered)

- Probable non issue:
  openjdk/jdk/make/sun/rmi/rmic/FILES.gmk
  ...
  # Generated by IBM JTC-SV tools.genmake
  --> probably just templating(?)

Kind regards

T.