[bug#32947] Add java-xalan.

[Frank Pursel]

Well, I certainly have never intended to be an accomplice to intellectual property theft.  Having formally asked the question that cannot be the case.  I also thought you handled the 'framing' of the issue nicely. 

Your perspective caused me to further investigate IntStack.java.  It may be helpful to know that the class IntStack is an extension of IntVector.java which contains none of the suspicious references to JDK1.0.  For IntStack.java to have originated in the JDK so too must have IntVector.java and there doesn't appear to be any similar evidence that this is the case.

I can also offer that xdocs/sources/xalan/history.xml documents that IntStack.java has been modified multiple times to address bug reports and for optimizations.  I really don't know how those attributable modifications would affect the licensing but apache has clearly tailored this code to suite the needs of xalan.  It also provides the email addresses of past modifiers that might still be around to more clearly identify the origin of the code.  Though it was some time ago.  This code appears to have been settled since 2006.   15 year old open source code is unusual by today's standards. 

Regards,

Frank

On Thu, Apr 14, 2022 at 8:30 AM Maxime Devos <maximedevos@telenet.be> wrote:

Frank Pursel schreef op wo 13-04-2022 om 23:43 [+0000]:
> I think that IntStack.java has almost no economic value and so the
> comparison to a commercial package is not really appropriate.

It is not about the commercial aspect, it is about the potential
proprietariness.

> We are not asking for a bug fix, or for clarification of a
> behaviour.

Violating the (copyright, maybe contract) law seems like a bug to me
(TBC it is not known yet if this is the case, it just seems plausible
to me at this moment).

> We are questioning if they are meeting their own stated
> licensing criteria!

The problem is not if Apacha meets their own license (it seems that
they do, since they explicitly release the source code with their
license headers etc.  The potential problem is Sun's licensing of
JDK1.0, which we (as distribution) might indirectly be in violation of
by including java-xalan.

Also, it's all about how the question is framed -- asking ‘did you
violate the licensing terms’ doesn't seem advisable, but ‘Does IntStack
indeed come from JDK1.0, and if so, can I use it under the ASL license
like the rest?’ would just be asking for confirmation (and somewhat
positive, because it seems to imply we want to use xalan).

> I would feel bad asking this of them because I imagine they
> are no better equipped to answer questions about JDK1.0 than we are.

They are probably not well-equipped to answer questions about JDK1.0.
However, they _are_ well-equiped to answer questions about theirselves,
presumably they remember what they mean by @since and where their
source code came from.

> Worse, if we believe such impropriety is possible why would be
> believe what they tell us anyway?

FWIW, IMO it would only be impropriety because of the current law (and
somewhat unclear attribution).  Also, by assuming good faith.

> I think to ask for this to be investigated,
> at minimum, you would need to find the actual file from JDK1.0 that
> you feel was appropriated.

JDK1.0 is propietary, why would I look into its sources?  Also,
probably the sources aren't available anyway, given that it is
proprietary.

> I don't think we should be asking upstream
> to work on investigation of a suspicious licensing that cannot
> improve their software in any functional way.

Moving from being in violation in the law to not seems like a
functional improvement to me (assuming it was actually in violation,
which has not been determined).  Illegal software is, for many
practical purposes, not functional.

More generally, ignorance is not an excuse, and I imagine willfull
ignorance to be even less so.

Anyway, I've sent a mail upstream, presumably it will eventually appear
in the archive at
<https://marc.info/?l=xalan-j-users&r=1&b=202204&w=2>.

Greetings,
Maxime.