[security-dev 00411]: Re: xml-stylesheet data files usage in tests removed by fsg.sh

[Matthias Klose]

Mark Wielaard schrieb:
> Hi.
> 
> The IcedTea fsg.sh (Free Software Guidelines) script that scrubs any
> dubious contents from the files distributed through OpenJDK has the
> following:
> 
> # has w3c copyright. license to be checked / needs checking after decoding
> rm -f \
>   openjdk/jdk/test/javax/xml/crypto/dsig/data/xml-stylesheet \
>   openjdk/jdk/test/javax/xml/crypto/dsig/data/xml-stylesheet.b64
> 
> These files are local copies of the following files:
> http://www.w3.org/TR/xml-stylesheet
> http://www.w3.org/Signature/2002/04/xml-stylesheet.b64
> (The second is a base64 encoded version of the first.)
> 
> These files are used in the following tests:
> openjdk/jdk/test/javax/xml/crypto/dsig/GenerationTests.java
> openjdk/jdk/test/javax/xml/crypto/dsig/ValidationTests.java
> (Which currently obviously fail without those files in the data dir)
> 
> These tests references the merlin-xmldsig-twenty-three Baltimore test
> vectors (also distributed by the w3c):
> http://www.w3.org/Signature/2001/04/05-xmldsig-interop.html
> 
> The xml-stylesheet file references:
> http://www.w3.org/Consortium/Legal/ipr-notice.html#Copyright and
> http://www.w3.org/Consortium/Legal/copyright-software.html
> Which seem to imply we may freely distribute them.
> 
> So I would like to remove these "cleanups" from fsg.sh.
> Opinions?

done. checked that the license is included in the third party readme as well.

  Matthias