On Tuesday 15 of March 2016 22:50:52 Richard Fontana wrote:

On Tue, Mar 15, 2016 at 01:20:24PM +0100, Pavel Raiskup wrote:

...

Marek Goldmann wrote:

...

Most probably we'll need to package OSGi Enterprise, but I'm not sure about licensing of this project.

The code itself (included in the.jar file, another story...) is ASL 2.0, but if you try to download it from the website, you need to agree to this:

http://www.osgi.org/Download/Release5?info=nothanks

Which is no more, no less OSGi Specification License, listed as bad license on the wiki:

http://fedoraproject.org/wiki/Licensing#Bad_Licenses

You can also download it directly, without the need to agree to the license on the website:

http://www.osgi.org/download/r4v42/osgi.enterprise.jar http://www.osgi.org/download/r5/osgi.enterprise-5.0.0.jar

How should we deal with it? Are we authorized to package it under ASL 2.0?

Thanks!

Hi, I am unable to find any response to this message in mail archives.

The Y2016 update:

• How have we dealt with this?
• Are we OK to package the osgi.enterprise now?
• Do we depend on osgi.enterprise namespace somewhere (Fedora/CentOS/RHEL)
• if that is not Fedora friendly license, is it OK to depend on it upstream?

Do you need to package anything other than the code that's under the Apache License?

We need to package the code from osgi.enterprise-5.0.0.jar, at least to the best of my knowledge. That source jar file contains Apache LICENSE file, and about.html with:

... Notices

Implementation of certain elements of the Content may be subject to third party intellectual property rights, including without limitation, patent rights (such a third party may or may not be a member of the OSGi Alliance). The OSGi Alliance and its members are not responsible and shall not be held responsible in any manner for identifying or failing to identify any or all such third party intellectual property rights. ...

The other thing is that it does not seem to be the right place to download sources from OSGi, but rather like some build-product sources (side effect of maven build?), but I'm not sure. So trying to find authoritative sources leads to [1], but that forces me to "Accept":

"OSGi Specification License, Version 2.0."

[1] Marek posted this before: http://www.osgi.org/Download/Release5?info=nothanks

Pavel

On Wednesday 16 of March 2016 09:17:49 Richard Fontana wrote:

...

The other thing is that it does not seem to be the right place to download sources from OSGi, but rather like some build-product sources (side effect of maven build?), but I'm not sure. So trying to find authoritative sources leads to [1], but that forces me to "Accept":

"OSGi Specification License, Version 2.0."

[1] Marek posted this before: http://www.osgi.org/Download/Release5?info=nothanks

So do you know if the authoritative sources are actually obtainable if you do accept, or have you not checked because you don't feel comfortable accepting?

I haven't accepted mostly because OSGi Specification License is not "Good" based on [1], without much thinking about it - but yes, it is not comfortable and sounds like unnecessary in FOSS. So I do not know whether the sources are there at all.

[1] http://fedoraproject.org/wiki/Licensing

Pavel

On Wed, Mar 16, 2016 at 08:51:41AM +0100, Mikolaj Izdebski wrote:

OSGi libraries are widely used and I made several attempts to package them. From what I remember there are two main problems:

1. In order to download anything from upstream site [1] you need to

accept proprietary license first. It was described above in more detail.

2. There is no source code provided (understood as preferable form for

editing, as defined in Open Source Definition, or in the Apache License itself). Code included in *-sources.jar files is not source code - there are no build instructions, test cases or such there - only pure Java code, which is meant primarily for debugging. They have a Github account [2], but it does *not* contain code for most common OSGi libraries. I failed to find any documentation on how source code can be obtained.

So to answer your question: we don't need to package anything except software which is (supposedly) under Apache License, but we are not sure whether (1) there are additional non-free licensing terms besides the Apache License that apply to the software, making it non-free,

Any Apache License-covered code in the source jar should be treated as licensed solely under that license. Therefore, once you actually have that code, it is free software.

and (2) whether the software actually meets definitions of free software and Open Source Definition - requirement of source code availability is questionable here.

I'm assuming the issue here is a Fedora packaging issue, right? If buildable source code is not available, that itself is a Fedora packaging problem, independent of any licensing concerns. One could always take the Apache-licensed source files and attempt to fork the libraries in question (in part because of the answer to the first question).

Richard