another review of copyright/license stuff in openjdk-b09

Tue Apr 22 13:30:22 PDT 2008

Matthias,

Thanks for sending along the copyright analysis.  On the point of Sun 
copyrights on public domain information, IANAL, I'm just an engineer, 
but my understanding is that it is permissible, if unfriendly, to put 
your own copyright notice on public domain files.

I'll start us looking into these issues, but we are in the crush ahead 
of JavaOne.

-Joe

Matthias Klose wrote:
> Recently Thomas Viehmann did a thorough review of the openjdk-b09 source if all
> licenses are DFSG-free *and* have copyrights and licenses accurately documented,
> as a prerequisite to upload a package to the Debian distribution.
>
> Some files were skipped in the review, which are already removed from the source
> for i.e. the Fedora build. See
> http://cvs.fedoraproject.org/viewcvs/devel/java-1.6.0-openjdk/generate-fedora-zip.sh?rev=1.2&view=markup
> for a list.
>
> The rest of the email are Thomas comments (some comments added by myself).
>
>   Matthias
>
> Hi all,
>
> as discussed with Matthias, here is a preliminary report for my check of openjdk
> in NEW. The check is not yet complete, but I took a stab at evaluating all text
> files not particularly hidden (e.g. in jars) that have their copyright
> information near the top of the file.
>
> Apologies for this being a bit terse, should it be too short
> on anything, don't hesitate to ask.
>
> I'll try to skip the files removed by the fedora-make-zip script, as
> Matthias points out, we probably should remove these as well.
> There are some additional binaries missed by Fedora(?).
> This is a problem and needs to be solved, e.g.
> (pathnames assume you have unpacked the main tarball in openjdk)
>   openjdk/jdk/test/java/util/Locale/data/deflocale.exe
>   openjdk/jdk/test/tools/launcher/lib/sparc/lib32/liblibrary.so
> and more *.exe *.so.
>
> fedora-make-zip removes
> openjdk/corba/src/share/classes/com/sun/tools/corba/se/idl/first.set
>  *    THIS PRODUCT CONTAINS RESTRICTED MATERIALS OF IBM
>  *    5639-D57, (C) COPYRIGHT International Business Machines Corp., 1997, 1998
> but not
> openjdk/corba/src/share/classes/com/sun/tools/corba/se/idl/idl.prp
> openjdk/corba/src/share/classes/com/sun/tools/corba/se/idl/idl_*.prp
> openjdk/corba/src/share/classes/com/sun/tools/corba/se/idl/toJavaPortable/toJavaPortable*.prp
> # Licensed Materials - Property of IBM
> # 5639-D57 (C) COPYRIGHT International Business Machines Corp., 1997, 1999
> # RMI-IIOP v1.0
>
> Missing copyrights in debian/copyright (or short d/c) (which includes a copy of
> the third party readme), need be fixed/checked:
>
> - openjdk/jdk/src/share/classes/java/lang/instrument/package.html
>    Copyright 2003 Wily Technology, Inc. License?
>
> - %% This notice is provided with respect to PC/SC Lite for Suse Linux v. 1.1.1,
>   which may be included with this software:
>
>   Copyright (c) 1999-2004 David Corcoran
>   All rights reserved.
>   needs to be Ludovic Rousseau for e.g.
>   openjdk/jdk/src/solaris/native/sun/security/smartcardio/MUSCLE/winscard.h
>
> - the Eastman Kodak see below?
> - RSA Security Inc. see below?
>
> Some inaccuracies in debian/copyright, should be fixed:
> - Sax is said to be public domain in d/c, but Sun claims copyright
>   for some of these and licenses under GPL, e.g.
>   openjdk/jaxp/src/share/classes/org/xml/sax/HandlerBase.java
>   >> in THIRD_PARTY_README as well
>
> - Apache Software Foundation owns copyrights up to 2005
>
> - at least parts of Xerces (and Xalan, but that could be the
>   destinction between Xalan J2 and Xalan in d/c) uses
>   Apache License 2.0, not just Apache Software license 1.1
>   e.g.
> openjdk/jaxp/src/share/classes/com/sun/org/apache/xalan/internal/xsltc/compiler/util/VoidType.java
> - jaxp/src/share/classes/com/sun/org/apache/xerces/internal/util/SymbolTable.java
> -
> openjdk/jaxp/src/share/classes/com/sun/xml/internal/stream/XMLEntityReader.java
>   has Portions Copyright Sun Microsystems, Inc. in addition
>   to ASF,
> -
> jaxp/src/share/classes/com/sun/org/apache/xerces/internal/impl/dv/InvalidDatatypeValueException.java
>   has a note a la "based on software (c) ... IBM ...", don't know if
>   that should be mentioned, some more might have that nearby.
> -
> openjdk/jdk/src/share/classes/com/sun/org/apache/xml/internal/security/Init.java
>   and more like it: some xml security is Apache License 2.0,
>   debian/copyright says ASL1.1
> - %% This notice is provided with respect to IAIK PKCS Wrapper, which may be
> included with this software:
>   Copyright (c) 2002 Graz University of Technology. All rights reserved.
>   should have sun with portions copyright
>   e.g.
> openjdk/jdk/src/share/classes/sun/security/pkcs11/wrapper/CK_SSL3_RANDOM_DATA.jav
> - openjdk/jdk/src/share/classes/sun/security/krb5/PrincipalName.java
>   * Portions Copyright 2000-2006 Sun Microsystems, Inc.  All Rights  Reserved.
>   ...
>   *  (C) Copyright IBM Corp. 1999 All Rights Reserved.
>   *  Copyright 1997 The Open Group Research Institute.  All rights reserved./*
>   and some nearby
>
> - This notice is provided with respect to Kerberos, which may be included with
> this software:
>   * Copyright (C) 1998 by the FundsXpress, INC.
>   could be more specific and / or list other copyright holders to the
>   krb5 stuff, fundsxpress seems to own only one (?) file.
>
> Question for the following files: can these be edited/modfied using free tools?
>
> - openjdk/jaxws/src/share/classes/com/sun/xml/internal/bind/v2/doc-files/
>   the .gif and .png files built from .vsd and .sxd files are corrupt,
>   cannot be opened. The .sxd file is probably an OOo Impress file, but
>   cannot be opened with OOo 2.4. The .vsd file is a Viso file? If yes,
>   can the packages.png generated by free software?
>
> - openjdk/jdk/test/sun/net/idn/nfscis.spp
>
>
> - openjdk/jdk/test/javax/xml/crypto/dsig/data/xml-stylesheet
>   has w3c copyright. license to be checked.
>   openjdk/jdk/test/javax/xml/crypto/dsig/data/xml-stylesheet.b64
>   needs checking after decoding
>
> Some minor things regarding copyright:
> - openjdk/jdk/make/sun/javazic/tzdata
>   has sun copyright notices that I'm not too sure about (AFAICT some of
>   it is just verbatim public domain tzdata).
> - openjdk/jdk/make/tools/dtdbuilder/dtds/html32.dtd:
>   sun copyright?
> - openjdk/jdk/src/share/classes/java/awt/image/renderable/RenderContext.java
>   Portions Copyright 1998-2000 Sun Microsystems, Inc.  All Rights Reserved.
>   DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
>   ...
>   COPYRIGHT (c) Eastman Kodak Company, 1997
>   As  an unpublished  work pursuant to Title 17 of the United
>   States Code.  All rights reserved.
>   also some more nearby, presumably Sun has licensed that to allow this?
>
> - some files around
>   openjdk/jdk/src/share/classes/java/awt/dnd/DragSourceContext.java:
>   have import statements in the license note ?!
>
> - openjdk/jdk/src/share/native/sun/awt/libpng/pngtrans.c
>   looks strange because of the non-exception GPL notice, probably Sun
>   cosmetic mistake.
>
> openjdk/jdk/src/share/native/sun/security/pkcs11/wrapper/pkcs11.h
>  /* FILENAME include file for PKCS #11. */
> /* $Revision: 1.4 $ */
>
> /* License to copy and use this software is granted provided that it is
>  * identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
>  * (Cryptoki)" in all material mentioning or referencing this software.
>
>  * License is also granted to make and use derivative works provided that
>  * such works are identified as "derived from the RSA Security Inc. PKCS #11
>  * Cryptographic Token Interface (Cryptoki)" in all material mentioning or
>  * referencing the derived work.
>
>  * RSA Security Inc. makes no representations concerning either the
>  * merchantability of this software or the suitability of this software for
>  * any particular purpose. It is provided "as is" without express or implied
>  * warranty of any kind.
>  */
> some simmilar nearby, probably needs entry in the third party readme
>
> openjdk/jdk/src/share/classes/sun/text/resources/CollationData_sr.java
>  * (C) Copyright Taligent, Inc. 1996, 1997 - All Rights Reserved
>  * (C) Copyright IBM Corp. 1996 - 1998 - All Rights Reserved
>
> openjdk/jdk/src/share/classes/sun/text/resources/BreakIteratorRules_th.java
>  * IBM Confidential
>  * OCO Source Materials
>  * IBM Java(tm)2 SDK, Standard Edition, v 1.2
>  * (C) Copyright IBM Corp. 1999
>
> openjdk/jdk/src/share/classes/sun/util/resources/CurrencyNames_*.properties
>   has sun+unicode copyright (possibly already covered)
>
> - Probable non issue:
>   openjdk/jdk/make/sun/rmi/rmic/FILES.gmk
>   ...
>   # Generated by IBM JTC-SV tools.genmake
>   --> probably just templating(?)
>
> Kind regards
>
> T.
>
>   