On 07/09/17 at 11:21am, Jelle van der Waa wrote:

Hi,

I do some more work on Archweb these days, so I might be able to help.

On 07/08/17 at 06:38pm, Adonay Felipe Nogueira via arch-projects wrote:

...

For a short description of the issue, see: [[https://labs.parabola.nu/issues/1405]].

However, we must also note that Archweb is now newer than the Archweb release used by Parabola.

Nonethless, as far as I know, each of the files still exist, although some of them don't even have license indication for the site's visitor (this is true for "visualize/static/visualize.js" and "mirrors/static/mirror_status.js").

homepage.js does not have a license header either, and personally I don't see the need to add it.

Looking at the issue on the bugtracker, I'm not sure what you want to achieve? personally I don't see any point in upgrading to GPLv3.

Presumably, the main thing they want to achieve license compliance. GPLv2 is not compatible with GPLv3 or Apache 2.0. If archweb includes components under those licenses, it may be in violation. apg

On 07/17/17 at 09:00am, Adonay Felipe Nogueira via arch-projects wrote:

Indeed. things under GPL 2 (notice the lack of "+"/"or later") can't adapt/depend on things under GPL 3.

Things under both GPL 2 and its "+"/"or later" version can't adapt/depend on things under Apache 2.0. However, things under GPL 3 and its "+"/"or later" version can.

I'm not fond of moving to GPLv3, first off, we'd have to ask all contributors to agree to it right? But something I can see do-able, is moving away from bootstrap-typeahead.js to horsey which is MIT licensed. [1]

- "visualize/static/visualize.js" is licensed under GNU GPL 2 (assumed to be "only" because the license notice in the file doesn't tell if there is an upgrade possibility).

This is part of archweb, so GPLv2

- "mirrors/static/mirror_status.js" is licensed under GNU GPL 2 (assumed to be "only" because the license notice in the file doesn't tell if there is an upgrade possibility).

This is part of archweb, so GPLv2 [1] https://github.com/bevacqua/horsey -- Jelle van der Waa

On 01/14/2018 08:34 PM, Luke Shumaker wrote:

Note that without even being concerned with license compatibility, archweb is currently in violation of konami.js, as it does not include, link to, or in any way provide instructions on how to obtain non-minified source code.

This would be boringly easy for you to fix, you know...

This is especially grievous, as it includes (minor) changes that are not present in any non-minified version that I have found. (We already patch to fix this in Parabola's fork; after identifying the minifier used (UglifyJS 2.2), I backed-out to reproduce the source changes (which I linked above).)

This would be mildly less so, but apparently you cared enough to fork archweb but not enough to email a simple question to Dan.

Now, as Andrew Gregory agreed, the GPLv3 and Apache 2.0 licenses of konami.js and Bootstrap are incompatible with archweb's GPLv2 license. The 3rd-party files of concern are:

We could solve that by declaring that we accept konami.js under the MIT, assuming the changes came from Dan, and by favoring the not-unheard-of opinion that Apache 2.0 and GPL2 aren't incompatible. :p Not every OSS lawyer agrees with the FSF lawyers on this... pity it hasn't been challenged in court as I'd love to see a court ruling that says they are compatible.

Bootstrap has also since re-licensed so that 3.1 and later are MIT licensed; however, bootstrap-typeahead.js was only ever present in Bootstrap 2.x; and was therefore not covered in the re-license.

| Possible path forward (proposed by Jelle van der Waa): Modify | homepage.js and index-2013-03-07.html to use the MIT-licensed | horsey[4] instead of bootstrap-typeahead.js. | | [4]: https://github.com/bevacqua/horsey

| Possible path forward: Contact the 7 authors of | bootstrap-typeahead.js and confirm that they agree to license it | under the MIT license. I believe all 7 of them agreed to this for | other Bootstrap code that they were authors of; so presumably this | is something they are agreeable to.

I must confess that I was and am perpetually astounded that Parabola chose to fork archweb rather than file painless pull requests against it, to move to feature-compatible code under your preferred license... and/or add the non-minified js alongside the minified versions, a pretty darn common convention for declaring the licenses and sources of minified js that wouldn't affect the in-use code at all and would therefore be extremely mergeable. Apparently as long as Parabola didn't consider Arch Linux actually in violation of Apache+GPL2, it was worth it to maintain a fork rather than contribute back to archweb? Maybe, possibly you thought that our unwillingness to do the work *ourselves* to make archweb more usable for *you*, meant we would reject any and all contributions that threaten to do so without our personal work? Since you seem eager to help us with our licensing woes, and have personally contributed patches to Arch projects before, I expect you'll be more than happy to amend this oversight. I'll be watching this list and the Pull Requests page on archweb's github with anticipation. ;) -- Eli Schwartz Bug Wrangler and Trusted User

On 01/15/2018 12:07 AM, Luke Shumaker wrote:

From what I see, that's a minority position, but of course I run in FSF circles, so my perception is a bit skewed. :P

If that's the official position that the archweb team wants to take, I won't argue.

I dunno what jelle/angvp/the gang would say, I do know that my personal opinion is markedly skewed. :p But I have contributed precisely one commit to archweb ever: https://github.com/archlinux/archweb/commit/6ffa5c4957812f3ee584205b6d11ce87... So don't take me as some primary indicator of the official position of the archweb team.

...

*complaining about Parabola forking instead of contributing upstream*

Like I said, the primary purpose of maintaining a fork of archweb is to replace the Arch branding with Parabola branding so that we can use it as our website. Obviously, we can't send that work upstream.

Of the other, would-be-upstreamable, changes that have gone in to the fork, they are mixed in the git history of the non-upstreamable changes, and buried in an absolute *mess* of merges and such; pulling and rebasing and amending an upstreamable patchset out of that is quite a bit of work (it was already that way when I inherited parabolaweb ~4 years ago)... it's been on my TODO list for longer than I'd care to admit. FWIW, the `archweb-generic` branch in parabolaweb.git is intended to be changes that are upstreamable, but it needs some rebasing first.

As you can imagine, that is at least as frustrating to us as it is to you. ;) Bear with us...

This email thread is simply us forwarding a bug upstream:

User: there's an issue in parabolaweb

Me: if it's a real issue, it's also in upstream archweb, it should be discussed there

User: ok, I'll report it there. (*creates this email thread*)

This is just the beginning of us being better about contributing upstream. This line of criticism here feels a bit like criticizing a fat guy at the gym--he knows he's fat and is trying to fix it, that's why he's at the gym.

Sounds great, I guess. I for one would be more than happy to see (watching from the sidelines TBH) parabola become an involved contributor to archweb and in general Arch projects (of which I am only currently aware of some devtools stuff, by you). It does feel somewhat awkward when a Parabola representative basically shows up to talk about archweb and the only thing they seem to have to talk about is "your licensing sucks, please fix it". Of course it is entirely possible that Parabola members have engaged in contributions I am unaware of, I haven't been watching arch-projects *that* long... but still, looking at commit counts I don't see anything which landed (except for the aforementioned devtools stuff). It wasn't immediately apparent that Parabola was trying to upstream things -- it is easy to assume instead that this is just Parabola being a distro that places a primary focus on FSF principles and idealisms raising an objection to something they feel violates those core values.

...

I'll be watching this list and the Pull Requests page on archweb's github with anticipation. ;)

Wait, archweb is on GitHub? :P

Is a GitHub PR the preferred method, or is the usual git-send-email to this ML preferred?

(Though I have to be honest: this is on my TODO list, but fairly low priority on it)

Arch Linux has a Github organization: https://github.com/archlinux A few things are mirrored there, and a couple new projects have their primary home there. Archweb specifically is primarily developed there via pull requests. Unlike other Arch projects, it is the preferred workflow of archweb developers/contributors. Though I am sure git-send-email to this ML will still get through. :) ... Whenever you have time to work on things would be great. ;) I'm just happy now that you've clarified Parabola's intention to work with us. Consider my criticism withdrawn. -- Eli Schwartz Bug Wrangler and Trusted User

On 01/14/18 at 08:34pm, Luke Shumaker wrote:

On Sun, 16 Jul 2017 23:46:01 -0400, Andrew Gregory via arch-projects wrote:

...

On 07/09/17 at 11:21am, Jelle van der Waa wrote:

...

Looking at the issue on the bugtracker, I'm not sure what you want to achieve? personally I don't see any point in upgrading to GPLv3.

Presumably, the main thing they want to achieve license compliance. GPLv2 is not compatible with GPLv3 or Apache 2.0. If archweb includes components under those licenses, it may be in violation.

Indeed. We believe that archweb is in violation.

In the linked bug, I commented off-the-cuff that I didn't believe that the 1st-party GPLv2 code interacted with the 3rd-party GPLv3 or Apache 2.0 code in a way that required license compatibility.

Upon further review of release_2017-01-02 (the last release that Parabola has merged, and thus the last that I am familiar enough with to speak confidently about), I no longer believe that to be true.

----

A listing of all 3rd-party JS, and its license:

- Bootstrap 2.1.1 (+change from Dan McGee) : Apache 2.0 - jQuery 1.8.3 : MIT - tablesorter[1] 2.7 : MIT / GPL dual-license - D3 3.0.6 : 3-clause BSD - konami.js[2] c0f686e (+change from unknown author[3]) : GPLv3

[1]: https://github.com/Mottie/tablesorter [2]: https://github.com/snaptortoise/konami-js [3]: https://git.parabola.nu/server/parabolaweb.git/plain/Makefile.d/konami.js.pa...

Note that without even being concerned with license compatibility, archweb is currently in violation of konami.js, as it does not include, link to, or in any way provide instructions on how to obtain non-minified source code. This is especially grievous, as it includes (minor) changes that are not present in any non-minified version that I have found. (We already patch to fix this in Parabola's fork; after identifying the minifier used (UglifyJS 2.2), I backed-out to reproduce the source changes (which I linked above).)

Now, as Andrew Gregory agreed, the GPLv3 and Apache 2.0 licenses of konami.js and Bootstrap are incompatible with archweb's GPLv2 license. The 3rd-party files of concern are:

retro/static/2013/bootstrap-typeahead.min.1aacd3d7f4db.js retro/static/2013/konami.min.e165c814457d.js sitestatic/bootstrap-typeahead.js sitestatic/konami.min.js

Additionally, the following file includes both 1st-party GPLv2 code, and minified versions of bootstrap-typeahead.js and konami.js:

sitestatic/homepage.js

I'm happy to drop the whole konami.js code, it's a gimmick and doesn't really serve a purpose. The bootstrap stuff is harder, only required for typeahead and I remember messing with an alternative which was MIT but that might require a jQuery update. That should fix all the issues I think.

This 3rd-party code is called by GPLv2-licensed archweb code in the files:

retro/templates/retro/index-2013-03-07.html templates/public/index.html sitestatic/homepage.js

----

As Eli Schwartz noted elsewhere in the thread, after it was copied in to archweb, konami.js has since re-licensed to the MIT license. However, that does not cover the changes of unknown authorship that were present when konami.js was first add to archweb. There's a good chance that the author there is Dan McGee (who added the file to archweb), but I'm not certain of that.

| Proposed path forward: Confirm with Dan that he is the author of | the changes, and that he agrees to license them under the MIT | license. From there, simply backport the license change from | upstream commit ece43a5.

Bootstrap has also since re-licensed so that 3.1 and later are MIT licensed; however, bootstrap-typeahead.js was only ever present in Bootstrap 2.x; and was therefore not covered in the re-license.

| Possible path forward (proposed by Jelle van der Waa): Modify | homepage.js and index-2013-03-07.html to use the MIT-licensed | horsey[4] instead of bootstrap-typeahead.js. | | [4]: https://github.com/bevacqua/horsey

| Possible path forward: Contact the 7 authors of | bootstrap-typeahead.js and confirm that they agree to license it | under the MIT license. I believe all 7 of them agreed to this for | other Bootstrap code that they were authors of; so presumably this | is something they are agreeable to.

-- Happy hacking, ~ Luke Shumaker

-- Jelle van der Waa

On 01/07/2018 10:12 AM, Adonay Felipe Nogueira wrote:

What's the status of this after our last message here?

I have some questions that you can ask the ArchLinux meetings in order help solve this:

1. For things provided by the ArchLinux project and which have the problematic licenses, has ArchLinux agreed license change?

Rephrasing the above: has the copyright holders agreed to do so?

2. If no license change will be done, can we remove the GPL-2.0-only ([1]) incompatible dependencies?

Not really sure what the issue is, are we actually in violation of anything, and if so what? For example, quickly googling for konami.js shows me several github repos that *all* claim to be MIT licensed. I would blindly assume that the original developers of our javascript knew something about licenses, and at most failed to clarify the original sourcing of thirdparty components, which would mean that it is a simple matter of adding clarification notes. I'm sure no one would reject patches that added clarification of copyrights. But FWIW git claims all javascript files in archweb were authored/committed by Dan McGee, with the exception of a syntax error fix (partial commit reversion only, so I don't know that that counts) in ddb7f4825f8bf70142735a5ba2f7729ffe5d27c1 by Evangelos Foutras. You should probably contact them directly, and ask them to relicense under GPL2+ or something if it is really important for your derivative use, as this doesn't seem to be a priority for anyone on our end. -- Eli Schwartz

On Sun, 07 Jan 2018 11:34:59 -0500, Eli Schwartz wrote:

On 01/07/2018 10:55 AM, Eli Schwartz wrote:

...

Not really sure what the issue is, are we actually in violation of anything, and if so what? For example, quickly googling for konami.js shows me several github repos that *all* claim to be MIT licensed.

Morten Linderud pointed out on IRC that it originally comes from https://code.google.com/archive/p/konami-js/

I did investigative work, and the author moved from googlecode to github, and relicensed it as MIT: https://github.com/snaptortoise/konami-js/issues/13

This may not have covered prior PR authors on github, but it did cover the googlecode version which we use, yes?

I know this one! The file checked in to archweb.git is `konami.min.js`. That file can be re-created by - take konami.js from commit ec0f686e647765860ff4d2fcb7b48122785432b75 https://github.com/snaptortoise/konami-js - apply this patch: https://git.parabola.nu/server/parabolaweb.git/plain/Makefile.d/konami.js.pa... - run it through UglifyJS 2.2 (any of 2.2.x will produce the same output for this input) - insert "\n\t" or "\n" as appropriate; presumably to make it match whoever's (Dan's?) text editor's auto-wrap behavior when they copy/pasted it. - remove ";" when it appears right before a newline (again, probably someone's auto-wrap behavior). Beside that patch, George Mandis is the only author of the pre-minified file. I don't know who is the author of the modifications in the patch. It doesn't correspond to any commit in the linked GitHub or the Google Code SVN, nor any git fork of it that I found. -- Happy hacking, ~ Luke Shumaker