Re: Is the Apache Software License DFSG-compliant?

[Scott James Remnant]

On Fri, 2003-08-08 at 02:51, Pierre THIERRY wrote:

 I just looked at the license for some Apache software, like Xalan,
 Xerces of FOP. I noticed that it forbids the use of their name in
 derived work without written permission.
 
No, it forbids the use of their names in derived *Products*, not
works...

5. Products derived from this software may not be called Apache,
   nor may Apache appear in their name, without prior written
   permission of the Apache Software Foundation.

Of course, how much of a difference is implied between the two terms
probably entirely depends on your country and how much you each pay for
your lawyers.


OTOH a quick Google indicates that the Apache Software Foundation
consider packages of Apache (even with modifications  bug fixes) to be
Apache and not another product.

I guess they believe that if it's packaged as Apache, acknowledged as
Apache, says Apache on the box and is Apache, then it's the Apache
product.

Scott


signature.asc
Description: This is a digitally signed message part

Re: Is the Apache Software License DFSG-compliant?

[Adam Warner]

On Fri, 2003-08-08 at 13:51, Pierre THIERRY wrote:
 I just looked at the license for some Apache software, like Xalan,
 Xerces of FOP. I noticed that it forbids the use of their name in
 derived work without written permission.
 
 IIUC, it is absolutely not DFSG-compliant, is it?
 
 It means that Debian must have written permission to redistribute the
 packages, else we are not repecting the terms of the ASL. And if Debian
 have the permission, then the package don't meet the point 8 in the
 DFSG.

There is no question that the Apache Software License is DFSG-free:
http://www.apache.org/licenses/LICENSE

Your concern is with Debian packing derivative works of Apache and still
naming them apache. I understand this is the reason Red Hat names their
web server packages httpd (and people sometimes mistakenly give Red Hat
flack for doing this!)

Debian packages of Apache are built out of source code extremely similar
to the official Apache sources (and only a handful of patches are
separately applied, download
http://ftp.debian.org/debian/pool/main/a/apache2/apache2_2.0.47-1.tar.gz
and take a look for yourself. In the debian/patches directory you'll see
001_apachectl_is_differently_fucked  008_make_include_safe
002_kill_installbuilddir 009_apache2_has_dso
003_build_with_autoconf_2.5  010_more_fhs_compliancy
004_usr_bin_perl_0wnz_j00011_fix_ap-config
005_apxs 012_apxs2_sucks
007_debian_advertising   to-review

Some do nothing more than correct the location of programs like perl,
e.g. the colourfully named 004_usr_bin_perl_0wnz_j00 just changes the
locations of perl from /usr/local/bin/perl and /usr/local/bin/perl5 to
/usr/bin/perl)

If the Apache Software Foundation complained about Debian's practice of
naming their packages apache then I'm sure Debian would do something
about it. As it stands everyone appears to be is happy. There is
certainly close interaction between Debian and Apache developers on the 
mailing lists. The sources are so similar that bugs discovered by Debian
users will likely exist in official Apache sources (and that's what
matters to developers). And Thom May, the Debian apache maintainer,
knows all the details about any differences. Thom May is also a current
Apache HTTP Server Project member:
http://httpd.apache.org/contributors/#thommay

Worst outcome over any fallout as to the definition of a product derived
from Apache: Debian would just stop calling their web server software
apache.

Regards,
Adam