Details

    • Type: Task
    • Status: Closed
    • Priority: Blocker
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 0.8.0-incubator
    • Component/s: None
    • Labels:
      None

      Description

      Before doing the first Apache release, we need to review the licensing of all dependencies and components included in PDFBox for compliance with Apache policies. Also, any required copyright attributions should be included in the NOTICE file.

      See:

      http://www.apache.org/legal/resolved.html
      http://www.apache.org/legal/3party.html
      http://www.apache.org/legal/src-headers.html

        Issue Links

        There are no Sub-Tasks for this issue.

          Activity

          Hide
          jukkaz Jukka Zitting added a comment -

          As an update, I've already cleared the external libraries (see below for JAI) and I'm currently working on embedded resources and test files.

          Java Advanced Imaging (JAI) components are included in PDFBox as the Java implementation in externals/jai_*.jar and as the ICC profiles in src/main/resources/Resources/colorspace-profiles. The licensing of these components (the Sun Binary Code License) conflicts with Apache policies, and thus we can't distribute them in Apache releases. I'll start a discussion on the mailing list about what to do with this issue.

          For the resources, see the following issues I raised with the Apache legal team about the licensing of specific items we include. My understanding is that all of these should be OK for us to distribute, but it's better to have an official approval.

          The test files under pdfbox/trunk/test are an interesting issue. There we have a wide variety of different real-world PDF documents. This is a great test suite, but a bit problematic from a licensing point of view. At least the files in test/encryption, test/input, and test/pdfparser don't seem to come with licensing or copyright information. I'll raise also this issue on the mailing list.

          Show
          jukkaz Jukka Zitting added a comment - As an update, I've already cleared the external libraries (see below for JAI) and I'm currently working on embedded resources and test files. Java Advanced Imaging (JAI) components are included in PDFBox as the Java implementation in externals/jai_*.jar and as the ICC profiles in src/main/resources/Resources/colorspace-profiles. The licensing of these components (the Sun Binary Code License) conflicts with Apache policies, and thus we can't distribute them in Apache releases. I'll start a discussion on the mailing list about what to do with this issue. For the resources, see the following issues I raised with the Apache legal team about the licensing of specific items we include. My understanding is that all of these should be OK for us to distribute, but it's better to have an official approval. LEGAL-35 PDF core font metrics from Adobe LEGAL-36 CMaps for PDF CJK Fonts LEGAL-38 Bitstream Vera Fonts The test files under pdfbox/trunk/test are an interesting issue. There we have a wide variety of different real-world PDF documents. This is a great test suite, but a bit problematic from a licensing point of view. At least the files in test/encryption, test/input, and test/pdfparser don't seem to come with licensing or copyright information. I'll raise also this issue on the mailing list.
          Hide
          jukkaz Jukka Zitting added a comment - - edited

          I have been able to resolve all but the following three remaining issues in this license review:

          Once these issues have been resolved I think we are clear for making the first Apache release of PDFBox.

          Show
          jukkaz Jukka Zitting added a comment - - edited I have been able to resolve all but the following three remaining issues in this license review: LEGAL-36 CMaps for PDF CJK Fonts PDFBOX-391 Remove or replace troublesome test files PDFBOX-392 Remove or replace the ICC profiles Once these issues have been resolved I think we are clear for making the first Apache release of PDFBox.
          Hide
          lehmi Andreas Lehmkühler added a comment -

          I'd like to remove the CMap files from svn as discussed in LEGAL-36.

          I'm thinking about the following procedure:

          • remove the CMaps from svn
          • put the 3 zip-files from adobe containing the cmaps in some repositiory
          • extend the build.xml to download the 3 zip-files and to extract them to the Resources directory during building the binary release of pdfbox
          • add some hints to the documentation why we have to remove the files and where to find them using the source distribution

          Is this procedure ok?

          Where should I put the the zips, to a maven repository?

          Show
          lehmi Andreas Lehmkühler added a comment - I'd like to remove the CMap files from svn as discussed in LEGAL-36 . I'm thinking about the following procedure: remove the CMaps from svn put the 3 zip-files from adobe containing the cmaps in some repositiory extend the build.xml to download the 3 zip-files and to extract them to the Resources directory during building the binary release of pdfbox add some hints to the documentation why we have to remove the files and where to find them using the source distribution Is this procedure ok? Where should I put the the zips, to a maven repository?
          Hide
          jukkaz Jukka Zitting added a comment -

          Yes, the procedure is correct.

          I've just filed http://jira.codehaus.org/browse/MAVENUPLOAD-2485 for getting the files uploaded to the central Maven repository. The upload bundle I created contains both the CMaps we now have in Resources/cmap and the font metrics in Resources/afm.

          Show
          jukkaz Jukka Zitting added a comment - Yes, the procedure is correct. I've just filed http://jira.codehaus.org/browse/MAVENUPLOAD-2485 for getting the files uploaded to the central Maven repository. The upload bundle I created contains both the CMaps we now have in Resources/cmap and the font metrics in Resources/afm.
          Hide
          lehmi Andreas Lehmkühler added a comment -

          The next question would had been how to upload the files to the maven-repo. But you were faster, now it's obvious how to do that.

          Thanks for that.

          Show
          lehmi Andreas Lehmkühler added a comment - The next question would had been how to upload the files to the maven-repo. But you were faster, now it's obvious how to do that. Thanks for that.
          Hide
          jukkaz Jukka Zitting added a comment -
          Show
          jukkaz Jukka Zitting added a comment - The files are now available at http://repo2.maven.org/maven2/com/adobe/pdf/pcfi/2009.06.14/
          Hide
          lehmi Andreas Lehmkühler added a comment -

          I removed all afm files and all cmap files which are part of the adobe-package. They will be automatically downloaded from the maven repository.

          There are still 91 cmap files left. Does anyone knows where these came from?

          Show
          lehmi Andreas Lehmkühler added a comment - I removed all afm files and all cmap files which are part of the adobe-package. They will be automatically downloaded from the maven repository. There are still 91 cmap files left. Does anyone knows where these came from?
          Hide
          lehmi Andreas Lehmkühler added a comment -

          I've found most/all of the cmap files on the oreilly ftp-server [1]: A guy named Ken Lunde has publish the book "CJKV Type Development" and offers additional stuff for download. Obviously he is with Adobe and I don't found a link to download it directly from adobe. Perhaps it is only available for somehow registered people
          The question is, do we have to update the bundle jukka made. Or do we attach them to jira? Or do we just delete them, because for the moment I'm not sure that all of them are really used.

          I've found an other license issue. The file glyphlist.txt originates from adobe too [2]. Somehow the license header got lost. I'll check in a corrected version of that file. Of course we have to remove it sooner or later from svn.

          [1] ftp://ftp.oreilly.com/pub/examples/nutshell/cjkv/adobe/
          [2] http://www.adobe.com/devnet/opentype/archives/glyphlist.txt

          Show
          lehmi Andreas Lehmkühler added a comment - I've found most/all of the cmap files on the oreilly ftp-server [1] : A guy named Ken Lunde has publish the book "CJKV Type Development" and offers additional stuff for download. Obviously he is with Adobe and I don't found a link to download it directly from adobe. Perhaps it is only available for somehow registered people The question is, do we have to update the bundle jukka made. Or do we attach them to jira? Or do we just delete them, because for the moment I'm not sure that all of them are really used. I've found an other license issue. The file glyphlist.txt originates from adobe too [2] . Somehow the license header got lost. I'll check in a corrected version of that file. Of course we have to remove it sooner or later from svn. [1] ftp://ftp.oreilly.com/pub/examples/nutshell/cjkv/adobe/ [2] http://www.adobe.com/devnet/opentype/archives/glyphlist.txt
          Hide
          jukkaz Jukka Zitting added a comment -

          Duh, I was so hoping we'd already be done with all this...

          Well, it looks like the files in [1] all come with the same Adobe copyright header as discussed in LEGAL-36, so at least we know where we are with them. In the long run it would be nice to have those files too in Maven central, but I guess for now we can live with just a Jira attachment. I'd be a bit vary of simply removing the files.

          The glyphlist.txt file should probably go into the same bundle as the licensing terms seem similar to LEGAL-36.

          PS. I made a slight update to the get.adobefiles target in revision 793993. Now the build doesn't try to unpack the downloaded files in the middle of the files in svn.

          Show
          jukkaz Jukka Zitting added a comment - Duh, I was so hoping we'd already be done with all this... Well, it looks like the files in [1] all come with the same Adobe copyright header as discussed in LEGAL-36 , so at least we know where we are with them. In the long run it would be nice to have those files too in Maven central, but I guess for now we can live with just a Jira attachment. I'd be a bit vary of simply removing the files. The glyphlist.txt file should probably go into the same bundle as the licensing terms seem similar to LEGAL-36 . PS. I made a slight update to the get.adobefiles target in revision 793993. Now the build doesn't try to unpack the downloaded files in the middle of the files in svn.
          Hide
          lehmi Andreas Lehmkühler added a comment -

          I'll move the files in question from svn to jira in a few days, so that we will be able to concentrate on the first apache release of pdfbox.

          Finally, I can see the light at the end of the tunnel ....

          Show
          lehmi Andreas Lehmkühler added a comment - I'll move the files in question from svn to jira in a few days, so that we will be able to concentrate on the first apache release of pdfbox. Finally, I can see the light at the end of the tunnel ....
          Hide
          lehmi Andreas Lehmkühler added a comment - - edited

          I've removed all files in question from svn to PDFBOX-494.

          Show
          lehmi Andreas Lehmkühler added a comment - - edited I've removed all files in question from svn to PDFBOX-494 .
          Hide
          jukkaz Jukka Zitting added a comment -

          The LEGAL-36 (CMaps) and LEGAL-55 (Glyps) issues are now both resolved, so those resources are officially OK for use in an Apache release.

          Show
          jukkaz Jukka Zitting added a comment - The LEGAL-36 (CMaps) and LEGAL-55 (Glyps) issues are now both resolved, so those resources are officially OK for use in an Apache release.
          Hide
          lehmi Andreas Lehmkühler added a comment -

          Great!! Thanks Jukka for your patience clearing that point. So, If there aren't any further objections I'll set this issue to resolved.

          If no one else volunteers I'll start building a first release candidate to vote on in a few days.

          Show
          lehmi Andreas Lehmkühler added a comment - Great!! Thanks Jukka for your patience clearing that point. So, If there aren't any further objections I'll set this issue to resolved. If no one else volunteers I'll start building a first release candidate to vote on in a few days.
          Hide
          jukkaz Jukka Zitting added a comment -

          I went through the latest trunk and resolved some remaining loose ends (missing license headers, minor inaccuracies, etc.). Now everything looks good to me, so resolving this issue as Fixed.

          Show
          jukkaz Jukka Zitting added a comment - I went through the latest trunk and resolved some remaining loose ends (missing license headers, minor inaccuracies, etc.). Now everything looks good to me, so resolving this issue as Fixed.

            People

            • Assignee:
              Unassigned
              Reporter:
              jukkaz Jukka Zitting
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development