Ugo,
- There may be licensing issues (I am not in a position to judge this
properly). The files all contain a comment "Based on the eID Applet
Project code. Original Copyright (C) 2008-2009 FedICT". Is there a
new relationship between POI and "eid-applet"? Could we at least
document somewhere that this code contribution is properly
sanctioned?
Originally the code was LGPL. I asked the author if it were
possibile to release it as AL and he agreed. Here is his reply:
From: fcorneli <[email protected]>
"I've discussed the license issue here at FedICT. We're willing to
dual-
license (LGPL/AL) the Java source code files concerning the creation
and validation of OOXML signatures as found under the eid-applet-
service-signer artifact. The headers on these Java source files have
been adopted accordingly."
The original files which have been copied can be found here:
http://code.google.com/p/eid-applet/source/browse/trunk/eid-applet-service-signer/src/main/java/be/fedict/eid/applet/service/signer/
Yes, I see the dual licenses in the code. I think the attribution is
proper, but I am not a legal expert.
I've put an attribution notice in the NOTICE file.
Yes, here it is.
"This product contains parts that were originally based on the eID
Applet project (http://code.google.com/p/eid-applet/). Copyright (C)
2008-2009 FedICT."
I have a big problem with what I see when I go to that link. Someone
who is looking at Apache POI would find the reference to LGPL and run
away. If we provide a link in the NOTICE then it must go to a place
that is unambiguous. My preference would be to ask the eID Applet
project to make the dual licensing issue crystal clear on their home
page. The alternative would be to link directly to the source
directory from our NOTICE.
Anyway, we can have a discussion and vote on whether we want to keep
this code or revert it. As you wrote, it should have happened
beforehand, but it was not my intention to introduce it as a "fait
accompli". I'll be OK with reverting the change if so we decide.
Let's make dual licensing crystal clear.
As far as the number of dependencies, I'll leave that for you guys
(BTW - Yegor is on vacation and I don't think we'll hear from him for
a few more days.)
Best Regards / Keep Pounding the POI,
Dave
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
