Details

    • Type: Task Task
    • Status: Closed
    • Priority: Blocker Blocker
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 0.9
    • Component/s: Other
    • Labels:
      None

      Description

      While assessing the license situation for FOR-855 and FOR-857 ... one of the difficult cases is "Rhino".

      Does someone know why we use Rhino and which part of Forrest? Did it just come along by accident with our addition of Cocoon, or is it actually being used?

      See:
      lib/core/rhino-1.6R2.jar
      and prior to that
      lib/core/rhino-1.6R1.jar

        Activity

        Hide
        David Crossley added a comment -
        Using svnsearch.org (thanks) led me to Cocoon's old listing of what jars are used for. Unfortunately that document is busted. The source
        http://svn.apache.org/repos/asf/cocoon/branches/BRANCH_2_1_X/lib/jars.xml
        indicates that Rhino "Continuations-based JavaScript engine" is used by Cocoon "Control flow".

        So where in Forrest do we use Flow?
        Show
        David Crossley added a comment - Using svnsearch.org (thanks) led me to Cocoon's old listing of what jars are used for. Unfortunately that document is busted. The source http://svn.apache.org/repos/asf/cocoon/branches/BRANCH_2_1_X/lib/jars.xml indicates that Rhino "Continuations-based JavaScript engine" is used by Cocoon "Control flow". So where in Forrest do we use Flow?
        Hide
        Tim Williams added a comment -
        I'm not aware of the use of flowscript anywhere. But google turned up this:

        http://marc.info/?l=forrest-svn&m=118525454408427&w=2

        Of course, that makes it possible to use it, doesn't indicate that we *are* using it. Maybe grep javascript on the sitemap and plugin dirs would help turn up anything?
        Show
        Tim Williams added a comment - I'm not aware of the use of flowscript anywhere. But google turned up this: http://marc.info/?l=forrest-svn&m=118525454408427&w=2 Of course, that makes it possible to use it, doesn't indicate that we *are* using it. Maybe grep javascript on the sitemap and plugin dirs would help turn up anything?
        Hide
        David Crossley added a comment -
        That was SVN revision 417027 on 2006-06-25. Perhaps there is some discussion on the dev list leading up to that commit.
        Show
        David Crossley added a comment - That was SVN revision 417027 on 2006-06-25. Perhaps there is some discussion on the dev list leading up to that commit.
        Hide
        David Crossley added a comment -
        Here is one discussion thread:
         Subject: cocoon flow and forrest
         Date: 2006-06-24
         http://thread.gmane.org/gmane.text.xml.forrest.devel/21474/focus=21486

        Using find|grep located mentions of Flow in ...

        whiteboard/plugins/org.apache.forrest.plugin.output.solr/resources/flow/
        whiteboard/plugins/org.apache.forrest.plugin.output.solr/output.xmap
        but it is commented out, saying "OLD flow approach".

        plugins/org.apache.forrest.plugin.input.wiki/resources/chaperon/sitemap.xmap
        Show
        David Crossley added a comment - Here is one discussion thread:  Subject: cocoon flow and forrest  Date: 2006-06-24   http://thread.gmane.org/gmane.text.xml.forrest.devel/21474/focus=21486 Using find|grep located mentions of Flow in ... whiteboard/plugins/org.apache.forrest.plugin.output.solr/resources/flow/ whiteboard/plugins/org.apache.forrest.plugin.output.solr/output.xmap but it is commented out, saying "OLD flow approach". plugins/org.apache.forrest.plugin.input.wiki/resources/chaperon/sitemap.xmap
        Hide
        David Crossley added a comment -
        The trouble is that Rhino licensing is very obscure.

        A general wide search might help, as there are various ASF projects using Rhino.

        This search at "legal-discuss" helps:
        http://markmail.org/search/?q=list:org.apache.legal-discuss+rhino

        Especially this:
         Subject: Rhino now MPL/GPL
         Date: 2006-11-14
         http://markmail.org/message/aeuint32kcuhpgqo
        which links to a "mozilla.dev.tech" thread about "Relicensing of Rhino to MPL"
        which links back to some other ASF discussion threads.

        So we might need to update our version of Rhino.
        Show
        David Crossley added a comment - The trouble is that Rhino licensing is very obscure. A general wide search might help, as there are various ASF projects using Rhino. This search at "legal-discuss" helps: http://markmail.org/search/?q=list:org.apache.legal-discuss+rhino Especially this:  Subject: Rhino now MPL/GPL  Date: 2006-11-14   http://markmail.org/message/aeuint32kcuhpgqo which links to a "mozilla.dev.tech" thread about "Relicensing of Rhino to MPL" which links back to some other ASF discussion threads. So we might need to update our version of Rhino.
        Hide
        David Crossley added a comment -
        Also ASF Legal docs about using MPL
        http://apache.org/legal/resolved.html#category-b
        Show
        David Crossley added a comment - Also ASF Legal docs about using MPL http://apache.org/legal/resolved.html#category-b
        Hide
        David Crossley added a comment -
        To try to clarify ... Please see comments above at 12/Nov/09 ... i have a feeling that we still have the old NPL-licensed Rhino. Our svn log shows that lib/core/rhino-1.6R2.jar was added on 2005-12-09 while the referenced "Rhino now MPL/GPL" thread indicates that that happened around 2006-11-10.
        Show
        David Crossley added a comment - To try to clarify ... Please see comments above at 12/Nov/09 ... i have a feeling that we still have the old NPL-licensed Rhino. Our svn log shows that lib/core/rhino-1.6R2.jar was added on 2005-12-09 while the referenced "Rhino now MPL/GPL" thread indicates that that happened around 2006-11-10.
        Hide
        Tim Williams added a comment -
        Indeed, it looks[1] like 1.6R5 was the first release under the new license. I think there are a couple things working in our favor here. We have version 1.6R2 and it is, apparently, working. 1.6R3 was a maintenance release claiming to be binary compatible with the previous release. 1.6R4 fixed a specific issue. And 1.6R5 was simply the license changing release. Given this, to reduce risk of breaking people by totally upgrading to 1.7Rx, I'd recommend we upgrade to 1.6R5 for now to clear up the license discrepancy and move on. Thoughts?

        --tim

        [1] - https://developer.mozilla.org/en/Rhino_downloads_archive

        Show
        Tim Williams added a comment - Indeed, it looks[1] like 1.6R5 was the first release under the new license. I think there are a couple things working in our favor here. We have version 1.6R2 and it is, apparently, working. 1.6R3 was a maintenance release claiming to be binary compatible with the previous release. 1.6R4 fixed a specific issue. And 1.6R5 was simply the license changing release. Given this, to reduce risk of breaking people by totally upgrading to 1.7Rx, I'd recommend we upgrade to 1.6R5 for now to clear up the license discrepancy and move on. Thoughts? --tim [1] - https://developer.mozilla.org/en/Rhino_downloads_archive
        Hide
        Tim Williams added a comment -
        For now, I ran with my latest proposal to update to 1.6R5 which brings us up to an MPL license version which, I gather, is acceptable. I think even if someone were to be using continuations it shouldn't break them as there are only a single issue and license change between the old version and this.
        Show
        Tim Williams added a comment - For now, I ran with my latest proposal to update to 1.6R5 which brings us up to an MPL license version which, I gather, is acceptable. I think even if someone were to be using continuations it shouldn't break them as there are only a single issue and license change between the old version and this.
        Hide
        David Crossley added a comment -
        Thanks for doing that part of the task.

        We also need to follow the license requirements:
        e.g.
        http://apache.org/legal/resolved.html#category-b
        http://www.mozilla.org/MPL/MPL-1.1.html#section-3.6
        ... which i gather means adding to our NOTICE.txt
        Show
        David Crossley added a comment - Thanks for doing that part of the task. We also need to follow the license requirements: e.g. http://apache.org/legal/resolved.html#category-b http://www.mozilla.org/MPL/MPL-1.1.html#section-3.6 ... which i gather means adding to our NOTICE.txt
        Hide
        Tim Williams added a comment -
        Shucks, thanks David, I'll add to the NOTICE.txt file this weekend if someone doesn't beat me to it.
        Show
        Tim Williams added a comment - Shucks, thanks David, I'll add to the NOTICE.txt file this weekend if someone doesn't beat me to it.
        Hide
        Tim Williams added a comment -
        Ok, I've parsed those license sections the best I can and tried to adhere to their intent. I'd appreciate a review from someone else though before we close this [again].
        Show
        Tim Williams added a comment - Ok, I've parsed those license sections the best I can and tried to adhere to their intent. I'd appreciate a review from someone else though before we close this [again].
        Hide
        Tim Williams added a comment -
        I feel pretty good that this latest update to the Notices file complies with the MPL license.
        Show
        Tim Williams added a comment - I feel pretty good that this latest update to the Notices file complies with the MPL license.
        Hide
        David Crossley added a comment -
        Thanks. I had a look too. The way the jar is packaged is fine. I agree with the NOTICE section.

        One thing: Do we really need to mention the version number in there? A maintenance issue. The jar file has the version number. Still, i am happy to leave it there if it needs emphasis.
        Show
        David Crossley added a comment - Thanks. I had a look too. The way the jar is packaged is fine. I agree with the NOTICE section. One thing: Do we really need to mention the version number in there? A maintenance issue. The jar file has the version number. Still, i am happy to leave it there if it needs emphasis.
        Hide
        Tim Williams added a comment -
        Thanks David, I just changed it to "this version" instead. It doesn't change the intent of that sentence at all - good catch.
        Show
        Tim Williams added a comment - Thanks David, I just changed it to "this version" instead. It doesn't change the intent of that sentence at all - good catch.

          People

          • Assignee:
            Tim Williams
            Reporter:
            David Crossley
          • Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development