Hi, On Tue, Jan 20, 2015 at 3:05 PM, Werner Keil <[email protected]> wrote: > The JAR is the official Java distro of the W3C DDR API: > http://www.w3.org/TR/DDR-Simple-API/#sec-java-representation
Once again I don't care about binary jar files in this context - to be able to release stuff that has the W3C DDR API as a core dependency, we need to be able to point people to a place where they can download its source code, with an explicit license that's appropriate for a core dependency as per http://apache.org/legal/resolved.html The source code that you point to at http://www.w3.org/2005/MWI/DDWG/drafts/api/simple/java/src doesn't include any license information and I don't see a pointer to the W3C license that you mention (http://www.w3.org/Consortium/Legal/2002/copyright-software-20021231) in that source code. Now, I agree with you that it doesn't seem risky to use that code, and as a user I might be safe assuming it's under standard W3C license, but IMO it doesn't fit the requirements of "not adding any restrictions beyond the Apache License" due to the missing explicit license. We cannot push that lack of clarity down to our users, at least not without warning them. At this point I see two options: a) The modules that depend on this W3C DDR API are forked out to a non-Apache project, which we can point to from our website b) You draft a brief statement for the NOTICE file of our modules that depend on the W3C DDR APIs that points to that W3C source code and warns users about the slightly unclear licensing. The PMC can then vote to make that statement official and we'll have a clear warning about that source code, that's acceptable IMO. -Bertrand
