[arch-projects] [archweb] Licensing issues with JS code

[Eli Schwartz]

On 01/14/2018 08:34 PM, Luke Shumaker wrote:
> Note that without even being concerned with license compatibility,
> archweb is currently in violation of konami.js, as it does not
> include, link to, or in any way provide instructions on how to obtain
> non-minified source code. 

This would be boringly easy for you to fix, you know...

> This is especially grievous, as it includes
> (minor) changes that are not present in any non-minified version that
> I have found.  (We already patch to fix this in Parabola's fork; after
> identifying the minifier used (UglifyJS 2.2), I backed-out to
> reproduce the source changes (which I linked above).)

This would be mildly less so, but apparently you cared enough to fork
archweb but not enough to email a simple question to Dan.

> Now, as Andrew Gregory agreed, the GPLv3 and Apache 2.0 licenses of
> konami.js and Bootstrap are incompatible with archweb's GPLv2 license.
> The 3rd-party files of concern are:

We could solve that by declaring that we accept konami.js under the MIT,
assuming the changes came from Dan, and by favoring the not-unheard-of
opinion that Apache 2.0 and GPL2 aren't incompatible. :p

Not every OSS lawyer agrees with the FSF lawyers on this... pity it
hasn't been challenged in court as I'd love to see a court ruling that
says they are compatible.

> Bootstrap has also since re-licensed so that 3.1 and later are MIT
> licensed; however, bootstrap-typeahead.js was only ever present in
> Bootstrap 2.x; and was therefore not covered in the re-license.
> 
>  | Possible path forward (proposed by Jelle van der Waa): Modify
>  | homepage.js and index-2013-03-07.html to use the MIT-licensed
>  | horsey[4] instead of bootstrap-typeahead.js.
>  |
>  | [4]: https://github.com/bevacqua/horsey
> 
>  | Possible path forward: Contact the 7 authors of
>  | bootstrap-typeahead.js and confirm that they agree to license it
>  | under the MIT license.  I believe all 7 of them agreed to this for
>  | other Bootstrap code that they were authors of; so presumably this
>  | is something they are agreeable to.

I must confess that I was and am perpetually astounded that Parabola
chose to fork archweb rather than file painless pull requests against
it, to move to feature-compatible code under your preferred license...
and/or add the non-minified js alongside the minified versions, a pretty
darn common convention for declaring the licenses and sources of
minified js that wouldn't affect the in-use code at all and would
therefore be extremely mergeable.

Apparently as long as Parabola didn't consider Arch Linux actually in
violation of Apache+GPL2, it was worth it to maintain a fork rather than
contribute back to archweb? Maybe, possibly you thought that our
unwillingness to do the work *ourselves* to make archweb more usable for
*you*, meant we would reject any and all contributions that threaten to
do so without our personal work?

Since you seem eager to help us with our licensing woes, and have
personally contributed patches to Arch projects before, I expect you'll
be more than happy to amend this oversight. I'll be watching this list
and the Pull Requests page on archweb's github with anticipation. ;)

-- 
Eli Schwartz
Bug Wrangler and Trusted User

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-projects/attachments/20180114/e27dc0ce/attachment-0001.asc>