Re: [VOTE] MADlib v1.9-rc1

[Justin Mclean]

Hi,

> The only new files are build related cmake or yaml files.

That's probably OK but given the statement in the LICENSE that all files 
without Apache headers are BSD licensed it probably would of made sense to add 
the headers to reduce any confusion.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Graduate Johnzon from the Incubator

[Justin Mclean]

Hi,

I agree the project doesn’t have a large visible active community but I’m also 
not sure what the point of having Johnzon staying in the incubator. They tick 
along nicely, they certainly don’t need the incubator to check their releases 
and they understand the Apache Way of doing things. What harm would be done if 
they did graduate as a TLP vs keeping them in incubation?

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Eagle Version 0.3.0 RC3 (Incubating)

[Justin Mclean]

Hi,

+1 (binding)

Nice first release - well done.

I checked:
- release artefact contains incubating
- DISCLAIMER exists
- LICENSE is good
- NOTICE (or perhaps LICENSE) is missing copyright from [1]
- All (non bundled) source files have Apache header
- No unexpected binary files in the release
- Can compile from source

Re missing copyright in NOTICE really up to the PPMC how you want to handle it. 
The Apache licensed bundled code doesn’t have a NOTICE file but if it did it 
would include at least the copyright line. If it did exist you would need to 
add that to NOTICE, as it doesn’t exist and the copyright holder is not the 
ASF, you may want to add this to LICENSE. Currently (IMO) there’s no clear 
policy on this and there’s probably differing options. You could of course do 
nothing and still be within the letter of policy i.e. bundle a non ASF Apache 
licensed code with no NOTICE, so there’s no need to do anything.

Thanks,
Justin

1. https://github.com/dpkp/kafka-python 

Re: [VOTE] Graduate Apex from the Incubator

[Justin Mclean]

Hi,

+1 binding  and well done!

Thanks,
Justin

-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] [FINERACT] 0.1.0.incubating for release

[Justin Mclean]

Hi,

Little confusing if this is a call to vote on the incubator or not but either 
way this may help.

If it is an incubator vote I’d vote -1 (binding) due to LICENSE/NOTICE issues 
and possible inclusion of Category B/Category X licensed software in a release.

I checked:
- Signature and hashes  good (but you may want to upload your KEY to 
http://hkps.pool.sks-keyservers.net)
- DISCLAIMER exists
- LICENSE has issues (see below)
- NOTICE also has issues (see below)
- Several java source files are missing headers
- There an unexpected binary file in the source release [5]

Your mentors should be able to help out with assembling LICENSE and NOTICE. If 
your’ve not done so you may want to run rat over the source release and it’s 
picking up a few issues. [5]

For the NOTICE:
- Year range is wrong replace 2014 with 2016
- There is no need to list PD, BSD or MIT in NOTICE. Only some licenses require 
you to add things to NOTICE. [1]
- Only things that are bundled need to be listed not dependancies. [2]
- There are EPL and CDDL software mentioned. This are category B and are 
generally not allowed to be distributed in a source release. [3]
- There are GPL license software mentioned. There are category X and not 
allowed distributed or be a dependancy of an Apache release [4]

For the LICENSE:
- The short form (i.e. a pointer to the full text of the license) is preferring 
that past the full text of long licenses in LICENSE
- Again only things that are bundled need to be listed. [2]
- Several Category B (Mozilla, CDDL, EPL) licensed items are mentioned. [3]
- The GNU license text is included! [4]
- License is missing several bundled items included jQuery,  normalise, 
bootstrap, moderniser, html5shiv, jszip, respond, uglify, glyph icons halflings 
font, polyfill (and probably others)

Thanks,
Justin

1. http://www.apache.org/dev/licensing-howto.html#mod-notice
2. http://www.apache.org/dev/licensing-howto.html#guiding-principle
3. http://www.apache.org/legal/resolved.html#category-b
4. http://www.apache.org/legal/resolved.html#category-x
5. docs/system-architecture/css/toc-0.1.2.zip
6. http://creadur.apache.org/rat/


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] TinkerPop 3.1.2-incubating Release

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- incubating in name
- signatures good
- DISCLAIMER(s) exists
- source LICENSE and NOTICE good
- binary LICENSEs and NOTICEs good
- no unexpected binaries in source release
- all source files have Apache headers
- can compile from source

Thanks,
Justin



-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Ranger 0.5.3 (incubating)

[Justin Mclean]

Hi,

> LICENSE.txt - 
> https://github.com/apache/incubator-ranger/blob/master/LICENSE.txt
> NOTICE.txt - https://github.com/apache/incubator-ranger/blob/master/NOTICE.txt

Not looked in detail, but I will tomorrow when I get some time. I did notice 
there’s a MPL licensed software mentioned in license, this is not allowed to be 
bundled in a source release. [1]. Also I need to check that none of the Apache 
licensed pieces of software effect the NOTICE file.

Thanks,
Justin

1. http://www.apache.org/legal/resolved.html#category-b
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Ranger 0.5.3 (incubating)

[Justin Mclean]

Hi,

Still needs some work IMO but if a JIRA was raised to fix these issues in a 
later release I’d vote +1 on a new RC without these fixes. Just as long as it’s 
all sorted before graduation.

Minor issues:
- LICENSE is missing MIT licensed Search Icon CSS copyright Nicolas Gallagher 
bundled in  [1]
- Is the copyright on this files correct? [2][3] if so what projects did they 
come from? (may effect content of NOTICE file)
- LICENSE is missing MIT licensed es5-shim copyright Kristopher Michael Kowal 
bundled in [4]
- LICENSE is missing SIL licensed FontAwesome [9]
- LICENSE is missing reset.css. [7] Note this version bundled may not be public 
domain unlike this one [8] so you may need to sort that out.
- LICENSE is missing MIT licensed sizzle.js bundled in several files [10]
- LICENSE is missing MIT license javascript diff engine in [11]
- I think handle bars require plugin is not WTFPL but MIT or BSD? [12] May 
require further investigation.
- LICENSE is missing public domain json2.js [13]
- LICENSE is missing BSD licensed easing equations from Robert Penner [15] in 
this file [14]

This is a more serious concern (and has been asked before):
- How is this file licensed? [5] or this one? [6]

As there this is very complex there may of been a couple of things I missed.

Thanks,
Justin

1. 
./apache-ranger-incubating-0.5.3/security-admin/src/main/webapp/libs/bower/backgrid-filter/css/backgrid-filter.css
2. 
./apache-ranger-incubating-0.5.3/jisql/src/main/java/org/apache/util/sql/Jisql.java
3. 
./apache-ranger-incubating-0.5.3/security-admin/src/test/java/org/apache/ranger/service/PasswordComparisonAuthenticator.java
4. 
./apache-ranger-incubating-0.5.3/security-admin/src/main/webapp/libs/other/backgrid/backgrid.js
5. 
./apache-ranger-incubating-0.5.3/security-admin/src/main/webapp/libs/bower/globalize/generator/HijriCalendar.js
6. 
./apache-ranger-incubating-0.5.3/security-admin/src/main/webapp/libs/bower/globalize/generator/UmAlQuraCalendar.js
7. 
./apache-ranger-incubating-0.5.3/security-admin/src/main/webapp/libs/other/visualsearch/css/reset.css
8. http://meyerweb.com/eric/tools/css/reset/reset.css
9.  
apache-ranger-incubating-0.5.3/security-admin/src/main/webapp/fonts/fontawesome/FontAwesome.otf
10. ./security-admin/src/main/webapp/libs/bower/jquery/js/jquery.js
11. ./security-admin/src/main/webapp/libs/bower/globalize/test/qunit/qunit.js
12. 
/security-admin/src/main/webapp/libs/bower/require-handlebars-plugin/js/hbs.js
13. 
./security-admin/src/main/webapp/libs/bower/require-handlebars-plugin/js/json2.js
14. 
./security-admin/src/main/webapp/libs/other/jquery-ui/js/jquery-ui-1.10.3.custom.js
15 http://robertpenner.com/easing/
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Fineract 0.1.2 (incubating)

[Justin Mclean]

Hi,

-1 (binding) until GPL issues / dependancy clarified.

My understand is that Hibernate is an optional dependancy here and that it is 
only use to run some tests and it is not required to use the product? Can you 
confirm that please. 

As is not bundled then there's no need to mention it at all in LICENSE or 
NOTICE or include the GPL license [1] and doing so just causes confusion.

I checked:
- files include “incubating”
- signature good and md5 hash checks out
- DISCLAIMER exists
- LICENSE is missing a couple of licenses
- NOTICE contain extra text that I’m not sure why it’s included
- Some source files (e.g. SQL and shell scripts) are missing Apache headers
- One unexpected archive in source release [3] but contents are ok.
- didn’t try to compile

LICENSE issues is missing MIT//BSD licensed polyfill bundled in [2]

If something is dual licensed (i.e. uglify) then you only need to select one 
license. This is even more important if it’s MIT or GPL licensed (i.e. 
html5shiv or jszip). There should be no need to include the text of the GPL 
license and t’s probably a risk to do so.

You may want to consider signing the release with an apache email address.

The is an archive included in the source release is this required? [3]

Thanks,
Justin

1. ./licenses/hibernate_lgpl.txt
2. ./docs/system-architecture/js/vendor/bootstrap-3.0.0/assets/respond.min.js
3. ./docs/system-architecture/css/toc-0.1.2.zip
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache CommonsRDF 0.2.0-incubating RC3

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- file name contains incubating
- hashes and signatures good
- DISCLAIMER exists
- LICENSE and NOTICE good
- All source files have headers
- No unexpected binaries in source release
- Can compile from source
- Tests pass

One the simplest and easiest releases I’ve had to review in a long time :-)

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release of Apache Mnemonic-0.1.2-incubating [rc2] (Revised)

[Justin Mclean]

Hi,

+1 binding

I checked:
- file name contains incubating
- DISCLAIMER exits
- LICENSE and NOTICE correct
- All source files have headers
- No binary files in release
- Unable to build from source 

Other than the build issue also a very easy release to review.

I was unable to build from source on OSX even with:
 mvn -pl '!mnemonic-memory-services/mnemonic-nvml-vmem-service' clean package

But assuming it’s my setup.

Would be nice for the README could have slightly clearer instructions on how to 
build on different platforms.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache CommonsRDF 0.2.0-incubating RC3

[Justin Mclean]

Hi,

> @Justin is this the equivalent of a PPMC throwing you a freebie? :-)

They didn't need to be added to my “owe me a beer” list :-)

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release of Apache Tephra-0.8.0-incubating [rc1]

[Justin Mclean]

Hi,

> The source code still shows "Copyright © 2015 Cask Data, Inc." notices.

Are you sure you are looking at the source release bundle? I can’t see 
copyright Cask Data anywhere.

> The code is still organized in co.cask.tephra... packages. That should be 
> org.apache.tephra..., right?

That a nice to have but not a must have  requirement for an incubating release.

> There is no NOTICE file

There is in the source release that I looked at. On reflection it could also 
have a line saying “Original software developed at Cask Data” if some of the 
files had that above copyright removed.

>  Is there any 3rd party code included under other (open source) licenses that 
> we would need to include?

AFAIK there no 3rd party code bundled in this source release, no no need to add 
anything to LICENSE or NOTICE.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Accept Pony Mail into the Apache Incubator

[Justin Mclean]

+1 (binding)

-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release of Apache Tephra-0.8.0-incubating [rc1]

[Justin Mclean]

Hi,

+1 binding. Minor issue with LICENSE file.

I checked:
- name includes incubating
- DISCLAIMER exists
- LICENSE is missing license appendix, please raise a JIRA and fix for next 
release
- NOTICE is fine
- All source files have headers
- No unexpected binary files
- Can compile from source and all tests pass

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Fineract 0.1.2 (incubating)

[Justin Mclean]

Hi,

> Sadly we still have an unwanted dependency bundled and we are using it in the 
> code.
> That's why we still have the GPL reference in the LICENSE file.

I can’t see that you have any GPL code bundled in the source release, you may 
depend on something that’s GPL license but that's another issue.

Even that may be OK if it’s an optional dependancy, i.e. it only used to run 
tests and/or most users of the software wouldn’t download it then that’s OK. [1]

> We were under the impression that we can 'release' incubation releases with 
> some
> issues and clean them out during the polling.

That is correct but bundling/depending on GPL licensed software is a bit more 
serious. One option is to ask on legal@dicuss and get permission to make a one 
off release with a GPL dependancy.

> [1] Given we use some Hibernate annotations we thought it is best to bundle 
> the license
> as long as we did not fixed that.

You only need to put things in license if the code is bundled, I’m not sure 
that annotating code would require a mention in license.

Thanks,
Justin

1. http://www.apache.org/legal/resolved.html#optional
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Ranger 0.5.3 (incubating)

[Justin Mclean]

Hi,

> Just so that we get it right the next time, can you verify that the current
> NOTICE is acceptable or does it require further changes?

Doesn’t look correct to me as you are including items that should be in LICENSE 
not NOTICE. In general permissive licensed items don’t need to be mentioned in 
NOTICE [1]

Do any of the Apache licensed bundled items have a NOTICE file? If so then 
their required notices are needed to be placed in your NOTICE [2]

I am however more concerned with the missing licenses.

Thanks,
Justin

1.  http://www.apache.org/dev/licensing-howto.html#permissive-deps
2. http://www.apache.org/dev/licensing-howto.html#mod-notice
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Mynewt 0.8.0-incubating

[Justin Mclean]

Hi,

+1 (binding) carried over from dev list - all usual checks done.

Thanks,
Justin

-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Ranger 0.5.3 (incubating)

[Justin Mclean]

Hi,

As far as I can see the license and notice issues brought up in the previous 2 
incubator releases have not been addressed. Is there any reason for this?

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Ranger 0.5.3 (incubating)

[Justin Mclean]

Hi,

-1 binding as there were several issue raised with the last release and they 
have not been fixed. This include missing licenses from LICENSE / NOTICE issues 
and one file which the license is unclear. [1]

I )checked:
- signatures all good
- name contains incubating
- DISCLAIMER exists
- LICENSE is still missing a few things (same issues as previous release)
- NOTICE year is wrong and contains far too much text. There is not need to 
mention any permissive MIT licenses here. [2]
- no unexpended binary files
- a few source file are missing Apache headers
- can compile from source 

Thanks,
Justin

1. http://markmail.org/message/2d36x33mev5fbd2o
2. http://www.apache.org/dev/licensing-howto.html#permissive-deps


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Apex Core Release 3.2.1-incubating (RC1)

[Justin Mclean]

Hi,

+1 binding - carried over form dev list all of the usual checks done.

Thanks,
Justin

-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release apache-singa-incubating-0.3.0 (RC3)

[Justin Mclean]

Hi,

+1 binding

I checked:
- name contains incubating
- DISCLAIMER exists
- LICENSE and NOTICE good.
- All Apache licenses source files have headers
- No binary files in the source release

Thanks,
Justin

-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Geode (incubating) 1.0.0-incubating.M2

[Justin Mclean]

Hi,

+1 binding

I checked:
- incubating in name
- signatures correct
- DISCLAIMER exits
- source LICENSE has some minor issues (see below)
- source NOICE is good
- several JS files are missing Apache headers
- no unexpected binary files in source release
- can compile from source

Source license minor issues:
- MIT licensed [1], note that this file also contains MIT licensed MooTools 
framework
- This file [3] is under MX4J license, I think this should be mentioned in 
LICENSE and also NOTICE as it’s similar to Apache's 1.1 license.
- The Droid fonts [5] are Apache licensed, but it’s not obvious as they are 
binary files, so may be good to mention that in LICENSE.

For the binary as above and:
- binary NOTICE some text can be removed (e.g. for the spring projects if you 
read what you’ve included they tell what text should be included)
- binary NOTICE no need to mention the name and copyright of the most of the 
bundled Apache projects
- didn’t check full contents but brief heck showed no issues.

Other minor things:
-  A number of ASF licensed files are copyright "Clearspring Technologies, 
Inc.” (for example) [2] should they be copyright ASF?
- This file still has a Pivotal copyright and patent notice [4]
- The year is incorrect in a number of NOTICE files having "Copyright (c) 
2002-2015 Pivotal, Inc.” or "Copyright (c) [2012-2014] Pivotal Software, Inc.”

Thanks,
Justin

1. ./geode-pulse/src/main/webapp/scripts/lib/jit.js
2. ./geode-core/src/main/java/com/gemstone/gemfire/internal/hll/Bits.java
3. 
./geode-core/src/main/java/com/gemstone/gemfire/admin/jmx/internal/MX4JModelMBean.java
4 
./geode-cq/src/test/java/com/gemstone/gemfire/internal/cache/RemoteCQTransactionDUnitTest.java
5. ./geode-pulse/src/main/webapp/css/fonts/DroidSans-Bold-webfont.* and 
DroidSans-webfont.*


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] [FINERACT] 0.1.0.incubating for release

[Justin Mclean]

Hi,

> Since we are intending to make source only release and not include any jar
> or compiled binaries.

Part of the issue here is your current LICENSE/NOTICE lists dependancies not 
just what is bundled in the release. You only need to list what is bundled.

> In such case, we wouldn't have anything other than apache text in these
> files isnt't it?

No. You bundle several MIT and BSD licensed bits of software, they will need to 
be added to LICENSE. Just follow the  the instructions here. [1]

> We cannot even depend on cat-x licensed libraries?

No you can’t have any category X dependancies. The terms of those licenses are 
not compatible with the Apache license.

Thanks,
Justin

1. http://www.apache.org/dev/licensing-howto.html
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] TinkerPop 3.2.0-incubating Release

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- incubating in name
- signatures good
- DISCLAIMER(s) exists
- source and binary LICENSE/NOTICE identical to 3.1.2 release (and no new 
copyrights) so all good
- no unexpected binaries in source release
- all source files have Apache headers
- can compile from source

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release apache-singa-incubating-0.3.0 (RC1)

[Justin Mclean]

Hi,

Sorry -1 (binding) as there’s a CC license source file in the release [1]. This 
is category B [2] and generally can only be included in binary form. [3] The 
file also IMO incorrectly has an apache header on it. Depending on other IPMC  
opinions on this issue I’ll reconsider.

Are there any differing opinions? Obviously one option would be to ask the 
author to release it under another license or rewrite the file in question. 
Would it be OK to pass release this if a JIRA is raised and the issue fixed in 
a future release?

I checked:
- name contains incubating
- DISCLAIMER exists
- LICENSE and NOTICE good. May be an issue with file CC licensed.
- All source files have headers (minor issue - see below)
- No binary files in the source release
- unable to compile on OS X, but I don’t think that’s a supported platform?

Some of the Apache headers contain "Copyright 2015 The Apache Software 
Foundation” this is not required. [4]

Also:
> and the result is at:
> http://mail-archives.apache.org/mod_mbox/singa-dev/201604.mbox/%3CCAJz0iLt=ALvT012V5fgxiGX=5cxewphavv3dh5o27ydvbks...@mail.gmail.com%3E

This states 5 non binding votes, which of those votes are from PPMC members?

Thanks,
Justin

1. ./include/singa/utils/safe_queue.h
2. https://issues.apache.org/jira/browse/LEGAL-167
3. http://www.apache.org/legal/resolved.html#category-b
4. http://www.apache.org/legal/src-headers.html#headers


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Gearpump (incubating) 0.8.1-RC4 as 0.8.1

[Justin Mclean]

Hi,

Looks much better than the last release candidate, however still +0 (binding) 
due to LICENSE issues, the items brought up for the last RC have not been 
addressed and possible GPL dependancies.

All like like there may be license dependancy issues, but I’m not familiar 
enough with sbt and the project to comment. This "sbt dependencyLicenseInfo | 
grep GNU” shows several GPL dependancies (may be duplicated?). It may be that 
these items are dual licensed with a license that is comparable with the Apache 
license?

I also notice that you have release downloads on your web site. [3] Please make 
it clear that these are not Apache releases. I assume this is a work in 
progress but you might also want to look at the branding requirements at the 
same time and fix those as well. [4]

I checked:
- incubating in release name
- signatures and hashes good
- LICENSE is better, but still missing bundled items brought up last RC
- there a few files with incorrect Apache headers [2] (also brought up last RC)
- can compile from source

LICENSE is still missing, in general anything that is bundled needs to be added 
to LICENSE. [1]
- pygments CSS
- normalize (in bootstrap)
- polypill (in moderniser)

One issue here is that you’re not following the terms of the bundled licenses 
(also brought up last RC) Just mentioning the license in LICENSE is not enough, 
the full text of the license needs to be included somewhere, usually this is in 
the header, but if it’s not there you need to include it. I see you have added 
some files to the licenses directory but having "Copyright (c)  
” in them doesn’t really tell the whole story does it :-)

Also What happen to the binary files that were in the the last RC? Has the 
creative commons licensing issue been resolved?

Thanks,
Justin

1. http://www.apache.org/dev/licensing-howto.html#guiding-principle
2. 
gearpump-0.8.1-RC4-incubating/services/dashboard/views/cluster/workers/worker/worker.js
3. http://gearpump.apache.org/downloads.html
4. http://incubator.apache.org/guides/branding.html
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache HAWQ (incubating) 2.0.0.0-incubating Release

[Justin Mclean]

Hi,

-1 (binding) binary in source release, LICENSE and  NOTICE issues, ASF header 
added to files not under Apache 2.0 license, possible inclusion of GPL licensed 
software and possible Category X software included in release (BSD with ad 
clause).

This is not a simple release to check and I may of missed a few things due to 
the large amount of noise.

I checked:
- release contains incubating
- signatures and hashes good
- I’m not sure what the intent of COPYRIGHT is. I also don't think as it has 
been suggested that this should be merged with NOTICE, NOTICE doesn’t not list 
all copyrights just those that have be relocated from source files. [1]
- NOTICE incorrecly contains a long list of copyright statements. I would 
expect to see one or perhaps two here i.e. the original authors who donated the 
software and who copyright statements were removed from the original files.
- LICENSE is missing a large number of things (see below)
- Please use the short form of the license linking to a license files in LICENSE
- Looks like there is an unexpected binary in the release [2] May be others 
given rat reports 770+ binary files
- Impossible to say if files have correct ASF headers or not, given the large 
number of files with ASF headers (5000 odd files)
- Failed to compile form source but likely my setup

License is missing (in some cases note the different copyright owners)
- BSD licensed code [3]
- BSD license code [7]
- license for this file [9]
- license for this file [10] Are we OK this was taken form GNU C?
- MIT license PSI [11]
- BSD licensed code [12]
- BSD licensed code [13] Is this regard as cryptography code? [14]
- BSD licensed code [15][16]
- license for this file [17]
- license of these files [18][19]
- license of this file [20]
- regex license [21]
- How are these files licensed? [22] + others copyright AEG Automation GmbH
- How is this file licensed? [23]
- BSD licensed libpq [24]. Is this consider crypto code and may need an export 
license?
- pgdump [25] 
- license for this file [26]
- license for this file [27] Look like an ASF header may of been incorrectly 
added to this.
- This BSD licensed file [36]
- license for these files [37][38] and others in [39]
- This BSD licensed file [40]
- This BSD licensed file [41]
- BSD licensed pychecker [42]
- licenses for all of these files [43]
- BSD license pg800 [44]
- how is this file licensed? [45]
- license for this file [47]
- Python license for this file [48]. Is this an Apache comparable license?
- How are these files licensed? [49] Note multiple copyright owners and missing 
headers.
- BSD licensed fig leaf. [50] Note that files incorrectly has had ASF headers 
applied.
- This BSD licensed file [51]
- This public domain style sheet [52]
- This file [53]
- License for unit test2 [54]
- MIT licensed lock file [55]
- JSON code here [56]
- License for this file [57]

And I may of missed some, as I wasn't doing a full review - that would likely 
take many many hours.

Looks like GPL/LPGL licensed code may be included [4][5][6] in the release.

This file [8] and others(?) may incorrectly have an ASF headers on it. Also why 
does this file have an ASF header with copyright line? [46]

Code includes code licensed under the 4 clause BSD license which is not 
compatible with the Apache 2.0 license. [28][29][30][31][32][33] It may be that 
this clause has been rescinded [35] and it OK to include but that needs to be 
checked.

I’d suggest that build instructions  are included in the release rather than a 
link to them. If the instructions at the URL change in the future how do I know 
how to build this release?

Also some one owes me a beer!

Thanks,
Justin

1. http://www.apache.org/legal/src-headers.html#headers
2. depends/thirdparty/thrift/lib/erl/rebar
3. ./tools/bin/pythonSrc/unittest2-0.5.1/setup.py
4. ./depends/thirdparty/thrift/debian/copyright (end of file)
5. ./depends/thirdparty/thrift/doc/licenses/lgpl-2.1.txt
6. ./tools/bin/gppylib/operations/test/test_package.py
7. ./depends/thirdparty/thrift/compiler/cpp/src/md5.?
8. ./tools/sbin/hawqstandbywatch.py
9. ./src/backend/port/dynloader/ultrix4.h
10. ./src/port/inet_aton.c
11. ./tools/bin/pythonSrc/PSI-0.3b2_gp/
12. ./src/port/snprintf.c
13 ./src/port/crypt.c
14. http://www.apache.org/dev/crypto.html
15. ./src/port/memcmp.c
16. ./src/backend/utils/mb/wstrcmp.c
17. ./src/port/rand.c
18. ./src/backend/utils/adt/inet_net_ntop.c
19. ./src/backend/utils/adt/inet_net_pton.c
20 ./src/port/strlcpy.c
21. ./src/backend/regex/COPYRIGHT
22. ./src/backend/port/qnx4/shm.c
23. ./src/backend/port/beos/shm.c
24. ./src/backend/libpq/sha2.?
25. ./src/bin/pg_dump/
26. ./src/port/gettimeofday.c
27. ./depends/thirdparty/thrift/lib/cpp/src/thrift/windows/SocketPair.cpp
28. ./src/backend/port/dynloader/freebsd.c
29. ./src/backend/port/dynloader/netbsd.c
30. ./src/backend/port/dynloader/openbsd.c
31. ./src/bin/gpfdist/src/gpfdist/glob.c
32. ./src/bin/gpfdist/src/gpfdist/include/glob.h
33. 

Re: [VOTE] Apache Gearpump (incubating) 0.8.1-RC4 as 0.8.1

[Justin Mclean]

Hi,

> [Kam] This analyzes jars required to build the binary artifacts - so my 
> assumption is that it is not relevant to release just the source?

Apache project cannot have GPL dependancies [1][5][6] (there are however a few 
exceptions for optional parts[2] and some build tools [3]). I’d first check to 
see if the software is question is dual licensed. [4]

> Based on just releasing source there are no CCL related artifacts included in 
> the .tgz.

Again see [1] and [6] for problematic licenses.

Thanks,
Justin

1.http://www.apache.org/legal/resolved.html#prohibited
2. http://www.apache.org/legal/resolved.html#optional
3. http://www.apache.org/legal/resolved.html#build-tools
4. http://www.apache.org/legal/resolved.html#mutually-exclusive
5. http://www.apache.org/licenses/GPL-compatibility.html
6. http://www.apache.org/legal/resolved.html#category-x
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache DataFu 1.3.1 release RC1

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- release contains incubating
- signatures and hashes good
- DISCLAIMER exists
- LICENSE and NOTICE OK
- Most files has ASF headers
- No unexpected binaries in release
- Can compile from source

Minor issues:
- year is wrong in NOTICE file
- year range in site footed doesn’t match that in NOTICE [1]
- a few files missing ASF headers e.g. [2]

Thanks,
Justin

1. ./site/source/layouts/_footer.erb
2. ./site/source/docs/datafu/1.3.0/script.js


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release of Apache Mnemonic-0.2.0-incubating [rc3]

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- release contains incubating
- signature and hash good
- LICENSE and NOTICE good
- No binaries in source
- All files have ASF headers
- Could compile from source but some minor issues (on OSX)

I think the README could do with some clearer information on how to compile on 
OSX. It seem the optional parts are not optional by default?

I manage to get it to compile by skipping the optional bits:
mvn -pl '!mnemonic-memory-services/mnemonic-nvml-vmem-service' -pl 
'!mnemonic-memory-services/mnemonic-pmalloc-service' clean package install

You may want to double check your dependancies as I’m seeing a LGPL dependancy 
but it seems to be for testing?

[INFO] org.apache.mnemonic:mnemonic-utilities-service:jar:0.2.0-incubating
[INFO] +- org.testng:testng:jar:6.8.17:test
[INFO] |  +- org.beanshell:bsh:jar:2.0b4:test
[INFO] |  \- com.beust:jcommander:jar:1.27:test
[INFO] +- org.apache.mnemonic:mnemonic-core:jar:0.2.0-incubating:compile
[INFO] |  +- org.flowcomputing.commons:commons-resgc:jar:0.8.9:compile
[INFO] |  \- com.squareup:javapoet:jar:1.6.1:compile
[INFO] +- org.apache.mnemonic:mnemonic-collections:jar:0.2.0-incubating:compile
[INFO] \- org.flowcomputing.commons:commons-primitives:jar:0.6.0:compile


Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Fluo Parent POM 1-incubating (rc2)

[Justin Mclean]

Hi,

Also you seem to non approved releases [1] on your Apache website [2] please 
remove these or make it clear that these are not Apache releases (which I 
assume is the case).

Thanks,
Justin

1. http://www.apache.org/dev/release.html#what
2. https://fluo.apache.org/docs/
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Fluo Parent POM 1-incubating (rc2)

[Justin Mclean]

Hi,

> I know you voted +1, so I think you're okay with it as-is this time around. 
> Is this correct?

Yep, it only a minor thing.

> I'm still a little confused about the location to place the files
> pre-release for voting. Should I understand that there is an "official"
> staging area to use for voting?

Yes and it’s [1], the apache nexus is a secondary area.[2] See also [3][4][5]. 
Note the MAY in [2] but the MUST in [5].

> it's my understanding that people used to upload
> artifacts to people.apache.org/~user/ prior to that

That changed about 5 years ago ;-)

> We can additionally put the same artifacts in /dev/dist (what is the full
> location?). Does that put the files in the mirrors?

No it doesn’t put the files in the mirrors. [6] The dev area is not mirrored. 
You can release them with a simple svn move command.

> Regarding "apache-" as a filename prefix

It’s a good idea as it may give you some extra legal protection and make it 
clear from a branding point of view that it’s an Apache project. Is it required 
by policy? Not that I’m aware but most projects I’ve been involved in do have 
apache in the release name.

Thanks,
Justin

1. https://dist.apache.org/repos/dist/dev/incubator/
2. http://www.apache.org/dev/release-distribution#maven
3. http://www.apache.org/dev/release.html#where-do-releases-go
4. http://www.apache.org/dev/release-distribution#channels
5. http://www.apache.org/dev/release-distribution#public-distribution
6. http://www.apache.org/dev/release.html#stage


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Fluo Parent POM 1-incubating (rc2)

[Justin Mclean]

Hi,

+1 binding

I checked:
- release name includes incubating
- signature and hashes correct
- DISCLAIMER exits
- LICENSE and NOTICE correct. Although you might want to add “(incubating)” 
after the project name in NOTICE.
- No source files to check for Apache headers
- No binary files in release
- Can “compile” without any issues

The release needs be placed in the /dev/dist incubator area. It's also a good 
idea to include the word “apache” in the release file name.

Thanks,
Justin


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Fluo Parent POM 1-incubating (rc2)

[Justin Mclean]

Hi,

> It's not released yet. It was my understanding that we don't put stuff
> there until the vote actually passes a vote for a release, and for that we
> need the IPMC to vote after the PPMC votes

You put stuff into the dev area after a release has been approved but before 
that it needs to go in the /dist/dev. That way you can easily release exactly 
what was voted on.

> It's just a Maven parent POM. There isn't any code. Just a POM, which is an
> XML file. 

Seem odd to have a release with no code but I guess that that’s allowed.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Fluo Parent POM 1-incubating (rc2)

[Justin Mclean]

Hi,

Looking a bit further the the Apache Fluo web site I see a couple of concerning 
things, but presumably this is part of a ongoing effort and will be sorted out 
before graduation:
- It seems the main source of distribution is github [1][2] and Sonatype [2] 
not the Apache mirrors.
- There are links to unapproved releases in these places [1][3][5][6]. This can 
be fixed by making it clear that these are not Apache releases.
- There are several branding issues. For instance Fluo should be referred to as 
“Apache Fluo”, please review the branding guidelines. [4] I can see it's done a 
couple of times on the first page, but other pages like docs, downloads and 
release process page do not make this entirely clear this is an Apache project.

Thanks,
Justin

1. https://fluo.apache.org/download/
2. https://fluo.apache.org/release-process/
3. https://fluo.apache.org/docs/
4. http://www.apache.org/foundation/marks/pmcs.html
5. https://github.com/apache/incubator-fluo/releases/tag/1.0.0-beta-2
6. https://github.com/apache/incubator-fluo/releases
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Fluo Parent POM 1-incubating (rc2)

[Justin Mclean]

Hi,

> Staging repo:
> https://repository.apache.org/content/repositories/orgapachefluo-1003
> Source (official release artifact):
> https://repository.apache.org/content/repositories/orgapachefluo-1003/org/apache/fluo/fluo-parent/1-incubating/fluo-parent-1-incubating-source-release.tar.gz

I’m a little confused as to what we are voting on here as:
1. This is no release in the offical area [1][2]
2. There is no code in the above release, is this intentional or is something 
missing?

Thanks,
Justin

1. https://dist.apache.org/repos/dist/dev/incubator/
2.incubator apache https://dist.apache.org/repos/dist/dev/incubator/
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache HAWQ (incubating) 2.0.0.0-incubating Release

[Justin Mclean]

Hi,

> Do you mean this should be put in VOTE email?

I expected it in BUILD_INSTRUCTIONS.md but it just contains a link to the wiki 
page, but anywhere in the release is fine.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache HAWQ (incubating) 2.0.0.0-incubating Release

[Justin Mclean]

Hi,

> However, do you think that'd be a release blocker if we just have a link
> not full content in the source tarsal?

No it’s a very minor issue. I listed what I considered release blockers in my 
vote email next to the -1 vote.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache HAWQ (incubating) 2.0.0.0-incubating Release

[Justin Mclean]

Hi,

>   @Justin - I've checked all [1]-[57] reference.  [34] ./src/port/glob.c
>   
> 
>was not referred in your previous email anywhere. But given the
>   context, I think it fits in your comments about [28]-[33] and [35], let me
>   know if I'm wrong.

Correct that should of originally been [28]-[34].

>   - https://issues.apache.org/jira/browse/HAWQ-952 (for merging
>   copyright/NOTICE file, based on Justin and Alan's feedback) - it's arguable
>   what's the right way, may need more guidance.

Why do you you think that all copyright notices need to go in NOTICE? Given 
there 30 or more that are not listed in the there what makes these copyrights 
special?

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Beam, version 0.2.0-incubating

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- file name contains incubating
- signature and hash good
- LICENSE and NOTICE good. (Although not 100% sure why the NOTICE mentions 
google twice)
- No binary files in release
- All source code has ASF headers
- Can compile from source

Just a few minor things I noticed while looking at your web site. You have a 
direct link to your last release here [1] rather than a link going via the 
Apache mirrors script [5] and this link [2] in Learn menu goes nowhere. 
Branding wise I think you are missing a few of the required links [3] including 
a link back to the Apache homepage. A feather ASF logo would be a nice addition 
as well. [4]

Thanks,
Justin

1 . http://beam.incubator.apache.org/releases/
2. http://beam.incubator.apache.org/docs/learn/programming-guide/
3. http://www.apache.org/foundation/marks/pmcs.html#navigation 
4. http://www.apache.org/foundation/press/kit/#links
5. http://www.apache.org/dev/release-download-pages.html#closer
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache HAWQ (incubating) 2.0.0.0-incubating Release

[Justin Mclean]

Hi,

> If you're asking why adding ALv2 header is against the letter of the
> policy, the answer is simple.
> Quote:
>"3.  Do not add the standard Apache License header to the top of
> third-party source files.”

In the case when they are not actually ALv2 licensed. It assumed that any files 
that is APLv2 license would already have a APLv2 header.

> Because I actually don't know what the original license on the file is.

That should ring alarm bells.

> IOW, I can't add ALv2 header because of #3 on the policy

No you can’t add ALv2 because you don’t know that the file is licensed under 
ALv2. Given the age of some of the files (predating when ALv2 was created) it’s 
very likely that they are not.

> I think documenting it in LICENSE should be enough, no?

Yep that’s one one of doing it. Again I don’t thing everything has to be solved 
for the next release, but documenting the issues/what may be missing is 
probably the best way to go.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache HAWQ (incubating) 2.0.0.0-incubating Release

[Justin Mclean]

Hi,

> Why? It would be perfectly fine for PG project to include, lets say an MIT
> source code.

That would be compatible with our license. But what if they included GPL or 
CDDL licensed software?

> That's why I don't feel comfortable putting the overall PG  licensed header 
> there on my own.

Nor should you if the files are not licensed that way.

> I think we're talking slightly past each other -- I told you I do KNOW that 
> they
> are licensed under the different ALv2 compatible license.

The package as a whole is licensed that way. But you stated you didn’t not know 
how that file is licensed it may be ALv2 or it may be something else. Just as 
it has different copyright owner it also likely is under a different license, 
whose terms are very likely to be APv2 compatible, but may not be.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache HAWQ (incubating) 2.0.0.0-incubating Release

[Justin Mclean]

Hi,

One of my concerns was that the code may be a port of something under a 
different license (given the directory naming). For example there’s QNX FS code 
in Linux which is GPL licensed. [3] (date seem to be about 2.2) However I think 
it may be a port to get the software to run on QNX4 and written from scratch 
[1]. But I’m not certain where exactly the code may of come from. 1999 predates 
ALv2 and at the time postgres 6.5 wasn’t licensed under APv2 but was free [2]. 
We’re talking 20 years ago!

There's probably an alternative simpler solution if you prefer. Do you need to 
support QNX4 file system? If not remove the files.

Thanks,
Justin

1. http://grokbase.com/t/postgresql/pgsql-ports/99cfhywfjm/qnx4-port
2. https://github.com/postgres/postgres/blob/REL6_5_PATCHES/COPYRIGHT
3. http://lxr.free-electrons.com/source/ipc/shm.c?v=2.2.26
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [RESULT][VOTE] Apache Gearpump (incubating) 0.8.1-RC3

[Justin Mclean]

Hi,

> 1. A tie (and if the voting period will be extended when a tie occurs)

Would not pass. For a release you need at least 3 +1 binding votes and more +1 
votes than -1 votes. [1]

> .2. Less than the required number of votes (+3 and how this will extend the 
> voting period)

The vote lasts until you have the required votes and a minimum amount of time 
has passed (usually 72 hours). [2]

> 3. Whether a non-incubator PMC member (who is the release manager) has CANCEL 
> authority at the general@ voting level.

Usually the release manager (i.e. the one who called the vote) cancels it.

> 4. Veto rule differences (or lack thereof) within the general@ voting vs 
> dev@ voting

Releases can not be vetoed [3], a -1 is not a veto. 3 +1 are required and more 
+1s than -1s.

Thanks,
Justin

1. http://www.apache.org/dev/release.html#approving-a-release
2. 
http://www.apache.org/foundation/voting.html#expressing-votes-1-0-1-and-fractions
3.http://www.apache.org/foundation/voting.html#ReleaseVotes
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [RESULT][VOTE] Apache Gearpump (incubating) 0.8.1-RC3

[Justin Mclean]

Hi,

Thanks Ted for a friendly explanation of all that.

> Typically what happens in a smooth functioning project is that if somebody
> points out a heinous problem (forgot to include the source code in a source
> release, say), everybody (or nearly everybody) who previously voted +1 will
> immediately change their vote to -1 for the release.

Also sometimes you can convince someone to change their mind and turn a -1 into 
a +1 as well.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Pony Mail (Incubating) 0.9.RC2 as 0.9

[Justin Mclean]

Hi,

+1 binding

I checked:
- name continues incubating
- good signature and hashes
- LICENSE is missing a couple of things (see below)
- NOTICE is possibly missing NOTICE file from quokka? [2][3]
- Source files have ASF header
- No unexpected binary files in release
- No need to compile

LICENSE is missing:
- normalise CSS - contained within [1]
- glyphicons halflings font [4]

Looks like the the source bundles may be missing jQuery? It’s mentioned in 
license and needed by bootstrap but I don't see it bundled.

Very minor things:
- remove the first line of the LICENSE file

Thanks,
Justin

1 ./site/css/bootstrap.min.css
2../site/js/quokka.js
3. https://github.com/Humbedooh/quokka.js/blob/master/NOTICE
4. ./site/fonts/glyphicons-halflings-regular.svg


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Pony Mail (Incubating) 0.9.RC2 as 0.9

[Justin Mclean]

Hi,

> Looks like they're using the hosted version in the site:
> https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js

If it not bundled then there's no need to mention it in LICENSE.

Thanks,
Justin

-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Sirona 0.4-incubating

[Justin Mclean]

Hi,

-1 binding due to LICENSE and NOTICE issues and missing DISCLAIMER files

I checked:
- artefact names contain incubating
- signatures and hashes good
- source DISCLAIMER exists
- source LICENSE is missing many things. Note that the full text of the license 
needs to be included in some cases (MIT/BSD) if it is not in the header of the 
file, this is legally required by the terms of the license. It best to add a 
pointer in the LICENSE file to the license in this case [1]
- source NOTICE contains stuff that should be in LICENSE. There is no need to 
list permissive items in NOTICE [1][2] under most cases.
- NOTICE contains wrong year range (2008-2013). Has the project really been 
incubating that long?
- No unexpected binaries in source release
- Source files have ASF headers
- Can compile from source

LICENSE Is missing:
- jQuery Flot (MIT) which also includes jQuery resize event (dual  MIT/GPL) [3] 
Note that the various plugs have different authors and license dates.
- Bootstrap (MIT) [4]
- normalize.css (MIT) [5]
- RequireJS (dual MIT/BSD)  [7]
- jQuery table sorter (dual MIT/GPL) [8]
- Raphael (MIT with two copyright owners) [9]
- morris (BSD) [10]
- angular bootstrap nav tree (MIT) [11]
- angular (MIT) [12]
- jQuery (MIT) [13]
- moment (MIT) [14]
- ng grid (MIT) [15]
- angular ui bootstrap [16]
- bootstrap table [17]
- glyph icons halflings regular fonts (MIT?) [19]
- font awesome font (SIL OSF) [20]
- font awesome css (MIT) [21]

No need to include in LICENSE as per [2]:
- bootstrap date time picker (Apache) [6]
- bootstrap table (Apache) [17]
- bootstrap (Apache) [18] Note however that both the Apache 2.0 and MIT 
versions of Bootstrap are included.
- SB Admin HTML template (Apache) [22]

For the connivence binaries:
- DISCLAIMERs are missing
- LICENSE files do not represent what is bundled [23] and are missing the 
Apache license text
- NOTICE file is missing ASF part
- NOTICE file are likely missing information from bundled Apache v2 licensed 
NOTICE files [2]
- May contain creative commons licensed Category X software? [24]

Thanks,
Justin

1. http://www.apache.org/dev/licensing-howto.html#permissive-deps
2  http://www.apache.org/dev/licensing-howto.html#alv2-dep
3. 
./server/reporting/reporting-ui/src/main/webapp/js/plugins/flot/jquery.flot.js
4. ./server/reporting/reporting-ui/src/main/webapp/js/bootstrap.3.2.0.js
5. 
./server/reporting/reporting-webapp/src/main/resources/resources/css/bootstrap.css
6. 
./server/reporting/reporting-webapp/src/main/resources/resources/js/bootstrap-datetimepicker.min.js
7. ./server/reporting/reporting-ui/src/main/webapp/js/require-2.1.14.js
8. 
./server/reporting/reporting-webapp/src/main/resources/resources/js/jquery.tablesorter.js
9. 
./server/reporting/reporting-ui/src/main/webapp/js/plugins/morris/raphael-2.1.2.min.js
10. 
./server/reporting/reporting-ui/src/main/webapp/js/plugins/morris/morris.min-0.5.0.js
11. ./server/reporting/reporting-ui/src/main/webapp/js/abn_tree_directive.js
12. ./server/reporting/reporting-ui/src/main/webapp/js/angular-1.3.0.js
13. ./server/reporting/reporting-ui/src/main/webapp/js/jquery-1.11.0.min.js
14. ./server/reporting/reporting-ui/src/main/webapp/js/moment-2.8.1.min.js
15. ./server/reporting/reporting-ui/src/main/webapp/js/ng-grid-2.0.12.debug.js
16 
./server/reporting/reporting-ui/src/main/webapp/js/ui-bootstrap-tpls-0.11.0.js
17. 
./server/reporting/reporting-webapp/src/main/resources/resources/js/bootstrap-tab.js
18. 
./server/reporting/reporting-webapp/src/main/resources/resources/js/bootstrap.js
19. ./server/reporting/reporting-ui/src/main/webapp/fonts/
20. ./server/reporting/reporting-ui/src/main/webapp/font-awesome-4.1.0/fonts/
21. 
./server/reporting/reporting-ui/src/main/webapp/font-awesome-4.1.0/css/font-awesome.css
22. 
./server/reporting/reporting-webapp/src/main/resources/resources/css/sb-admin.css
23. http://www.apache.org/dev/licensing-howto.html#guiding-principle
24. http://www.apache.org/legal/resolved.html#cc-sa




-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Sirona 0.4-incubating

[Justin Mclean]

Hi,

> » unzip -p
> /cygdrive/c/Users/romain/.m2/repository/org/apache/sirona/sirona-reporting-ui/0.4-incubating/sirona-reporting-ui-0.4-incubating.war
> META-INF/NOTICE | egrep -i 'flot|boot’

Why are you searching NOTICE for “flat” or “boot”? They should not be in NOTICE 
but mentioned in LICENSE as I explained. Please look at the link(s) I provided 
and/or ask your mentors for help on how to assemble LICENSE and NOTICE files.

Thanks,
Justin


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Sirona 0.4-incubating

[Justin Mclean]

Hi,

> can you confirm which artifacts are missing it please?

All of them.

Justin

-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Gearpump (incubating) 0.8.1-RC3

[Justin Mclean]

Hi,

-1 binding, missing DISCLAIMER and LICENSE and header issues

I checked:
- artefact names contain incubating
- hashes and signature good
- DISCLAIMER file is missing
- LICENSE contains things that are not bundled and missing things that are (see 
below). It also contains paths to files that do not exist.
- NOTICE is OK but contain extra unneeded information 
- Some file have incorrect Apache headers e.g. [1]

From what I can tell only the following is bundled in the source release is:
anchor JS
bootstrap
jquery
modernizr
glyph icons font
pigments CSS
normalize.css (in bootstrap)
polypill (in moderniser)

The LICENSE file in the source release needs to reflect this. [2] Perhaps you 
included all dependancies or created a LICENSE for the convience binary file 
not the source file?? Note that also a short pointer to a license is preferred 
over the long form [4] License also includes licenses that are not category A 
which would not normally be allowed in a source release.

This file contains 3rd party code but it not clear how that is licensed. [3]

I made a video the other month that may help understand what’s needed with 
bootstrap. [5]

Thanks,
Justin

1. /services/dashboard/views/cluster/workers/add_worker.js
2. http://www.apache.org/dev/licensing-howto.html#guiding-principle
3. ./experiments/akkastream/src/main/scala/akka/stream/ModuleGraph.scala
4. http://www.apache.org/dev/licensing-howto.html#permissive-deps   
5. https://vimeo.com/171210141





-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release: Apache Eagle 0.4.0-incubating

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- artefact name contains incubating
- hashes and signature good
- DISCLAIMER exits
- LICENSE and NOTICE good
- Most source file have apache headers
- No unexpected binaries in source release
- Can compile from source

Minor issue you (IMO) should fix in the next release:
- there a number of python script without Apache headers

Very minor things you may or may not want to fix in the next release:
- wrong copyright year (2015) in [1]
- year range may be wrong in LICENSE "Copyright (c) 2010-2016 Benjamin 
Peterson”, looks to be 2014 to me?
- how is this patch [2] licensed?

Thanks,
Justin

1. mkdocs.yml
2. 
eagle-external/eagle-ambari/lib/EAGLE/package/patches/add-eagle-quicklink.patch
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: Worked LICENSE and NOTICE example

[Justin Mclean]

Hi,

> Perhaps showing a negative example of a resource you then realize you
> can't add, e.g. you find a picture on flickr.com that you want to
> bundle, but it's classified as CC Non-Commercial; so you find one that
> you CAN include instead, but need to provide attribution for it.

Nice idea thanks.

> Also propagation of NOTICE, e.g. you want to add

I already have that on my list to do.

> Your tutorial would be great to show at ApacheCon at the Incubator session, 
> btw.

I plan to submit a longer version of it as a talk at the next ApacheCon and 
hopefully it will be selected.

It is however a little hard to turn this sometimes dry subject into something 
that people will come along and listen to.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: Worked LICENSE and NOTICE example

[Justin Mclean]

Hi,

> I wondered why you did not mention file headers further (beyond for
> inspecting licenses), as that is part of ASF policy (while not a legal
> requirement for using the Apache license)

Very good question, I was just focused on the license and notice and didn’t 
look at headers and it may be that the “release” would not pass a vote.

> The example is very simple, but actually there is no actual content
> that would be (c) ASF :-) --  except the README file and index.html, I
> think both (or at least index.html) should have ASF headers.

The README doesn’t need one [1] (but it wouldn't hurt if it did), index.html 
(despite [2]) probably does.

Thanks,
Justin

1. http://www.apache.org/legal/src-headers.html#faq-exceptions
2. http://www.apache.org/legal/src-headers.html#faq-webpages


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Kudu (incubating) 0.9.1 RC1

[Justin Mclean]

Hi,

And also:
- no need to mention point “d” or list Apache 2.0 licensed software. [1]

Justin

1. http://www.apache.org/dev/licensing-howto.html#alv2-dep
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Kudu (incubating) 0.9.1 RC1

[Justin Mclean]

Hi,

> which as I understand it is the preferred way to include MIT-style licenses
> in LICENSE.txt.

That is the case. However other MIT license software include the LICENSE text 
are included in full (e.g. UTF-8 Library, epoch, jQuery).

In all cases they are bundled with the source so I don’t see why they are 
treated differently or why boost comes after the confusing part in the the 
LICENSE file.

AFAICS re that part:
- Point “a” is incorrect as boost is bundled in the source code.
- Point “b” while legally correct doesn’t follow current ASF legal advice. [1] 
(i.e. add a pointer to the license to LICENSE)
- Point “c” is also against policy, only things bundled need to be mentioned. 
[2] Having extra stuff in LICENSE is not an licensing error but it makes the 
situation a little confusing IMO.

> Good point. This isn't new in this release, but we should address it. Do
> you think a README file in this directory would be sufficient?

Totally up to the PPMC, as long as users know what is going on and aware how 
they are licensed.

As these files are bundled in the source release are their licenses mentioned 
in LICENSE? (again see [2])

Thanks,
Justin

1. 
http://www.apache.org/legal/resolved.html#can-works-placed-in-the-public-domain-be-included-in-apache-products
2. http://www.apache.org/dev/licensing-howto.html#guiding-principle
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] $podling.apache.org is the same as $podling.incubator.apache.org

[Justin Mclean]

Hi,

+1 but only if poddlings follow branding guidelines [1] (i.e. include 
disclaimer on website)

I's also suggest that the inclusion of the incubator logo be changed to a MUST 
rather than a SHOULD as the URL may no longer include “incubator”.

The page [1] may require a couple of minor edit as well if this change is voted 
in? Anyone willing to update the page?

Thanks,
Justin

1. http://incubator.apache.org/guides/branding.html
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Releasing Apache Metron 0.2.0BETA-RC2

[Justin Mclean]

Hi,

-1 (binding) until MPL licensed source issue resolved.

I checked:
- name contains incubating
- signatures and hashes good
- DISCLAIMER exists
- LICENSE is OK, but look to be missing one permissive license? and assuming 
its ok it would be best if the MPL was in another file.
- NOTICE is OK (but perhaps requires a notice from MPL?)
- All ASF source file have apache header
- No unexpected binary files
- Can compile from source

For the license I think this file [1] may incorrectly have an apache header. 
I’m also unsure of it’s license, but it’s likely to be permissive [2] and needs 
to be mentioned in LICENSE. Can you fix this in the next release please.

There is a more serious issue in that the source includes MPL licensed 
files.[4][5][6] This is a category B license [3] and as such files under these 
terms can only included in binary form, but they plain text. They are not small 
(10,000 lines) and given they contain list of domain name it seems likely they 
they would change so I don’t think the last paragraph in [3] applies either. It 
would also be a good idea to list where they come from.

Thanks,
Justin

1. 
./metron-platform/metron-data-management/src/test/java/org/apache/metron/dataloads/extractor/stix/StixExtractorTest.java
2. http://stixproject.github.io/legal/
3. http://www.apache.org/legal/resolved.html#category-b
4. ./metron-platform/metron-common/src/test/resources/effective_tld_names.dat
5. 
./metron-platform/metron-enrichment/src/main/resources/effective_tld_names.dat
6. ./metron-platform/metron-parsers/src/test/resources/effective_tld_names.dat


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Atlas version 0.7-incubating RC2

[Justin Mclean]

Hi,

+1 binding

I checked:
- incubating in name
- signature and hashes good
- disclaimer exists
- LICENSE and NOTICE good
- all source file have ASF header
- no unexpected binaries in source release
- can compile from source

You may may to move the build instructions to the README as well as having it 
here [1] as:
- It’s annoying to have to go and search how to compile a project
- They may change over time and thus be out of sync with an old build

Thanks,
Justin

1.http://atlas.incubator.apache.org/InstallationSteps.html


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Releasing Apache Metron 0.2.0BETA-RC2

[Justin Mclean]

Hi,

> .
> If you think it's clearer, we can pull it into its own file and mention it
> in the LICENSE for next release

Sounds fine to me.

> Regarding the effective_tld_names.dat, we had this discussion last release
> and believe that they are reference data and should be considered
> acceptable. 

The nothing that I can see in the legal answered questions to say that Category 
B “reference data” in text form is acceptable. 

Was this discussed on legal discuss? Is there a JIRA anywhere saying it’s OK to 
make a source release containing those files?

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Gearpump (incubating) 0.8.1-RC5 as 0.8.1 Release

[Justin Mclean]

Hi,

> The voting period ends in about 9 hours.

There is no end to a voting period it usually form a minimum of 72 hours if you 
can call a result. A vote can (and sometime does take longer).

Im just looking at it now and will vote shortly.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Gearpump (incubating) 0.8.1-RC5 as 0.8.1 Release

[Justin Mclean]

Hi,

+1 binding. Nice work on the LICENSE/NOTICE files. I checked that the “GPL" 
dependancy issue isn’t one as it dual licensed under GPL/CDDL.

I checked:
- name contains incubating
- signatures and hashed good
- DISCLAIMER exists
- LICENSE and NOTICE good
- All source files have ASF headers
- No unexpected binary files in source release
- can compile from source

You have a very minor issue with LICENSE in that polyfill references the glyph 
icons license and the NOTICE file has a bit of extra text in it that’s not 
required.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache HAWQ (incubating) 2.0.0.0-incubating Release

[Justin Mclean]

Hi,

>> if you're saying that we need to slap an ALv2 license header on something
>> like shm.c -- I don't feel comfortable doing that

Perhaps ask yourself why that is? Is it because the 
licensing/copyright/provenance is unclear? Does the files version control 
history tell you anything? I know in some cases here we’re dealing with files 
10+ years old so that may be difficult. Perhaps list all files somewhere that 
you are unsure of but likely to be Apache or other compatible license?  Issue 
like this if noted don;t have to be sorted out for the next release just before 
graduation.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Fluo parent POM 1 and Build Resources 1.0.0

[Justin Mclean]

Hi,

+1 binding

I checked:
- incubating in release name
- DISCLAIMER exists
- LICENSE and NOTICE fine
- No binaries in the release
- can compile from source

Only one small niggle is that "build-resources-1.0.0-incubating” (one of the 
two artefacts in the release) seems an unusual name for an apache release as 
neither the project name or apache is mentioned in it’s name.

The web site looks much better from a trademark/branding point of view. Thanks 
for be so responsive and quick addressing the issue(s) there.

Justin


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache HAWQ (incubating) 2.0.0.0-incubating Release

[Justin Mclean]

Hi,

> This is why we're relying a great deal on RAT's exclusion file to mark
> the files that came from PG even though their license headers could look weir 
> enough.

Would’t be better to fix/add the headers? That way the licensing of any file 
would be clear and anyone editing those feel in the future is likely to know 
where they come from and how thy are licensed. Also make things a lot easier to 
review in the future.

The issue with rat exclusions is that I find they tend to be made too wide and 
than at some point fail to capture something important.

> and thus we ask folks to run rat as:
>$ mvn verify

I generally run rat manually without exclusions which is probably why I notice 
things a little more often.

>  if you're saying that we need to slap an ALv2 license header on something
> like shm.c -- I don't feel comfortable doing that

If that's how it is licensed then it should have an ALv2 licence header that’s 
ASF policy? The only issue I would have is if ALv2 headers are added to files 
that are not licensed in that way, so yes some care needs to be taken.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Fluo Parent POM 1-incubating (rc2)

[Justin Mclean]

Hi,

> The question of trademarks and groupIds has come up before (
> https://lists.apache.org/thread.html/24c6270458faf64da351027cde5c74e935d6b5760b511b4e2f0c6b98@1388455319@%3Cprivate.accumulo.apache.org%3E),
> but in those circumstances, the conflict was much more direct (reuse of the
> "org.apache.*" groupId in maven artifacts). I would think that the
> "io.fluo" groupId would clearly indicate this is a separate organization,
> clearly distinct from Apache. If the simple reuse of the word "fluo" is
> enough to trigger a branding issue

It can be.

> , then I would imagine things like "maven-checkstyle-plugin" reusing the word 
> "checkstyle" while it depends on
> a 3rd party "checkstyle" artifact would be similarly concerning

No they are not as maven has a long history of working this way so it easily 
understood what’s Apache and what isn’t. This is pointed out in on one of the 
trademark policy pages.

> Further, there's lots
> of third party websites which have ASF project names in their domain name,
> twitter handles, etc...

If there are that’s issue and they should be looked into, for domain names 
policy see [1].

Thanks,
Justin

1. http://www.apache.org/foundation/marks/domains.html
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache HAWQ (incubating) 2.0.0.0-incubating Release

[Justin Mclean]

Hi,

> If you remember, we had a very similar conversation in the context of
> Kudu, and I’d like HAWQ to stick to the same path treating unmodified 
> upstream code that Kudu
> settled on: http://markmail.org/thread/7w7gjmqrzlutx62z

And the result of that is that it almost impossible to review any Kudu releases 
without a direct file by file comparison to the previous release. File headers 
make everyones life easier.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache HAWQ (incubating) 2.0.0.0-incubating Release

[Justin Mclean]

Hi,

> Well, I don't think there's ever a 100% assurance in IP matters,
> but... here's what
> we know AND here's what we would like to advertise to the consumers of HAWQ:
> A certain set of file (how we advertise the filenames is TBD, but
> likely in LICENSE)...
>   1. ...came from PostgreSQL project version 8. With 8.1.0 being a
> bulk of the import, but
>with a few files that came from older PG releases
> 
>   2. ...may have been initially released under whatever license, but
> then were made
>   available by the PostgreSQL project under the PostgreSQL license
> (which is a BSD
>   derivative and compatible with ALv2)
> 
>   3. ...to the best of our software archeology analysis we can trust
> PostgreSQL community
>   on the statement in #2


I think that fine approach. This is one issue here the license in 2 may not be 
Apache compatible. For example I come across a MIT licensed package the other 
week that contained GPL licensed files inside it.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache HAWQ (incubating) 2.0.0.0-incubating Release

[Justin Mclean]

Hi,

> AIUI, if it is 3rd party and otherwise unmodified, modification of the
> headers is not an option.

Even when the files are missing header or missing the license that they were 
originally under?

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache HAWQ (incubating) 2.0.0.0-incubating Release

[Justin Mclean]

Hi,

> Sure, but mu point is: since I'm not comfortable going against the
> current stated policy
> on unmodified 3d party:
>http://www.apache.org/legal/src-headers.html#3party

Why exactly is that against policy? You are adding a header to make clear what 
the license of that file is. That not a modification or removal of the license 
(point 1) it’s just documentation. I would note that point 2 states "Do ensure 
that every third-party work includes its associated license, even if that 
requires adding a copy of the license from the third-party download site into 
the distribution”, so in that case if you don’t add the header you would not be 
complying with that policy, unless the full license text is placed somewhere 
else in the release.

Thanks,
Justin



-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] $podling.apache.org is the same as $podling.incubator.apache.org

[Justin Mclean]

Hi,

> The presence of the word "incubator" in the URL is deliberate: it alerts users
> that a podling is incubating.  I'd feel better about this proposal if podlings
> weren't so successful about concealing their incubation status[1][2].
> 
> -0, since the Incubator remains unserious about incubation disclaimers on
> websites.

Perhaps a solution to this it's a require poddlings to be serous about this 
when they make a release? i.e. vote -1 if the incubating disclaimer is not 
clear on a poddling site.

(And I would be willing to vote that way on releases if this vote passes)

Thanks,
Justin


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Trafodion (incubating) release 2.0.1-incubating RC3

[Justin Mclean]

Hi,

1+ binding

I checked:
- name include incubating (except installer)
- signatures and hashes good
- DISCLAIMER exists
- LICENSE and NOTICE good
- no unexpected binary files in source release
- all source files have ASF headers

Is there any reason for the installer to not include apache-trafodion and 
incubating? Please fix for next release.

I’m also a little confused by “trafodion_license” in the installer as it states:
“Project Trafodion includes third party copyrighted software
components, which may be licensed under third party and or
open source license terms as set forth in the LICENSE.TXT
file accompanying the Project Trafodion distribution or as
indicated in the applicable source code file.”

But LICENSE (not LICENSE.TXT) has no 3rd party software. Is the 
trafodion_license file even needed?

With the addition of the new 3 clause BSD licenses the number “2” is the second 
license point has been dropped, you might want to fix that.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Taverna Command-line Tool 3.1.0-incubating RC3

[Justin Mclean]

Hi,

> This is how it was suggested to us by our mentors; but we're open for
> improvements

Not it any way an issue, it’s just a bit more verbose that notice NOTICE files 
I’ve seen.

> But is "Public Domain" valid outside US?  Should we append ASF headers
> on it? (That should be allowed if it's PD.. at least if that is done
> by an USAnian)

Public Domain is complex. I'd go with [1] and add a pointer to the text of it’s 
license in your LICENSE file. [2]

Thanks,
Justin

1. 
http://www.apache.org/legal/resolved.html#can-works-placed-in-the-public-domain-be-included-in-apache-products
2. http://www.apache.org/dev/licensing-howto.html#permissive-deps
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: Request to review updated License (Re: [VOTE] Release Apache Ranger 0.5.3 (incubating))

[Justin Mclean]

Hi,

> I would like to get your feedback on updated LICENSE.txt for Ranger. 
> https://github.com/apache/incubator-ranger/blob/master/LICENSE.txt

Has the full text of each license been placed somewhere? Most permissive 
license (e.g. MIT, BSD) require you to do that, often the legal requirement is 
satisfied by the license being in the header of the file, but this is not 
always the case. It’s ASF policy to add the text to LICENSE (or better still a 
pointer to that LICENSE text). What you done with LICENSE seems to sort of 
cover that but it’s a little odd, it may be missing the BSD text for instance.

Once you have a release candidate or similar ping me and I’ll review. It hard 
to check a license without know exactly what is going to be in the release.

Justin 
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: Request to review updated License (Re: [VOTE] Release Apache Ranger 0.5.3 (incubating))

[Justin Mclean]

Hi,

> Generally speaking, we only need to include the licenses for the
> dependencies, not a notice that the dependency is contained.

My understanding is that on things that are bundled need to be mentioned. [1] 
(and all the things mentioned in that license are bundled).

There no need to mention non included dependancies at all.

Thanks,
Justin

1.http://www.apache.org/dev/licensing-howto.html#guiding-principle
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [DISCUSS] Incubator Logo & Branding

[Justin Mclean]

Hi,

> As a follow up to the current discussions happening, I wanted to get
> opinions from the IPMC on whether or not the Incubator logo should be
> included in podling websites.

+1 It gives a clear indication that the project is under incubation at the ASF.

Bonus points for it linking to somewhere like http://incubator.apache.org.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: IPMC release vote checklist

[Justin Mclean]

Hi,

Perhaps this is what you are looking for?

http://incubator.apache.org/guides/release.html

Justin

-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Geode (incubating) 1.0.0-incubating.M3 release

[Justin Mclean]

Hi,

+1 binding

For the source release I checked:
- names contain incubating
- signatures good
- DISCLAIMER exists
- LICENSE has a few minor issues (see below)
- NOTICE is good
- all files have apache headers (where needed)
- no unexpected binary files in release
- can compile from source

I didn’t check the binary connivence release.

Minor license issues, can you please fix for the next release:
- File missing header and missing in LICENSE [1]?
- LICENSE missing Sizzle.js contained within [2]
- LICENSE is missing MooTools contained within [3]
- Only one version of JQuery is mentioned in LICENSE but two versions are 
bundled [4][5]

I notice a number of files are Apache 2.0 license but have copyright lines in 
the header e.g. "Copyright (C) 2011 Clearspring Technologies, Inc.” is this 
correct?

This NOTICE file year needs updating? [6]

Thanks,
Justin

1. 
apache-geode-src-1.0.0-incubating.M3/geode-core/src/main/resources/com/gemstone/gemfire/admin/jmx/internal/doc-files/mbeans-descriptors.dtd
2. ./geode-pulse/src/main/webapp/scripts/lib/jquery-1.7.2.js
3. ./geode-pulse/src/main/webapp/scripts/lib/jit.js
4. 
./apache-geode-src-1.0.0-incubating.M3/geode-site/website/content/js/jquery-1.10.1.min.js
5. 
./apache-geode-src-1.0.0-incubating.M3/geode-web-api/src/main/webapp/docs/lib/jquery-1.8.0.min.js
6. ./geode-web/src/main/webapp/META-INF/NOTICE


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Geode (incubating) 1.0.0-incubating.M3 release

[Justin Mclean]

Hi,

> Hope that's ok, if not please let us know how we should proceed.

Seems fine to me. Policy is not to include copyright line in ASF headers at 
Apache but if 3rd parties do so I guess we need to respect that.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [DISCUSS] new incubator project Apache IOT

[Justin Mclean]

Hi,

> In Unix operating systems devices are files. For the I2C bus the device id
> would /dev/i2c-0.(I do not believe this would be different on a PI vs and
> Arduino). 

It a little different Arduino’s don't have an OS but a set of API/libraries you 
use. Lots of small devices don't have OSes or file systems so what you target 
is going to change the details a lot.

That even applies to Mynewt but it can be thought of as Linux for computers 
that can't run Linux :-)

BTW Mynewt has also had some luck in getting 3rd parties to relicense their 
code under more permissive licenses (which may be another path to consider).

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [IP CLEARANCE] Apache Celix - Publish Subscribe

[Justin Mclean]

Hi,

> @Justin: The 72 hours have passed, I will keep this vote open for another
> 24 hours. If you stlll have issues please provide an update.

No issues I think you can consider it closed/passed.

Thanks,
Justin

Re: [VOTE] Apache SystemML 0.12.0-incubating (RC2)

[Justin Mclean]

Hi,

+1 binding

I checked:
- incubating in name
- signature and hashes fine (but would be good to include the KEYS file nearby)
- DISCLAIMER exists
- LICENSEs are OK
- NOTICE year need updating from 2016 to 2017
- All ASF files have headers
- No unexpected binary files
- Can compile from source

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release apache-singa-incubating-1.1.0 (RC1)

[Justin Mclean]

Hi,

+1 binding

I checked:
- name contains incubating
- signatures and hashes good (you might consider using something other than md5 
for the hash)
- DISCLAIMER exists
- LICENSE and NOTICE good
- All source files have ASF headers
- No unexpected binary files
- Can't compile from source but likely my setup

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [IP CLEARANCE] Apache Celix - Publish Subscribe

[Justin Mclean]

Hi,

> No, the tar file contains the source files.

Inside the tar file are source files and another tar file, it’s the second tar 
file I’m referring to.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: Binary file inclusion (was [VOTE] Apache Toree (incubating) 0.1.0-rc4 as 0.1.0)

[Justin Mclean]

Hi,

> Same thread.  Specifically Mark T's response [1] and Craig's affirmation [2]

Not sure that applies here as I think we have compiled code without the 
corresponding source. Can someone on the project confirm?

Even then I would expect that to be an unusual exception where there was no 
other way of not including the source code. If it’s compiled it not really open 
source is it?

Documentation (recently changed) [1][2] has been clear that source releases 
should not contain jar files. Both of these pages use to contain a release 
checklist that contained:
"This package may not contain compiled components (such as "jar" files) because 
compiled components are not open source, even if they were built from open 
source.”

BTW that checklist was quite useful perhaps we should put it back somewhere?

Thanks,
Justin

1.https://web.archive.org/web/20161120035911/http://incubator.apache.org/guides/releasemanagement.html#check-list
2. 
https://web.archive.org/web/20160803190705/https://incubator.apache.org/guides/release.html


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: Binary file inclusion (was [VOTE] Apache Toree (incubating) 0.1.0-rc4 as 0.1.0)

[Justin Mclean]

Hi,

> If you look in the tar.gz you'll see that it's R source code, and a JAR for
> testing.  Its not compiled code.

Looks like the jars contain compiled code to me:
./sparkr-interpreter/src/main/resources/sparkr_bundle.tar.gz - Contains R code 
and a jar that contains class files.
./sparkr-interpreter/src/main/resources/R/pkg/inst/test_support/sparktestjar_2.10-1.0.jar
 - Contains class files.
./scala-interpreter/src/test/resources/TestJar2.jar - Contains a class file 
(under a com ibm package which seems odd)
./scala-interpreter/src/test/resources/ScalaTestJar.jar - as above
./scala-interpreter/src/test/resources/TestJar.jar - as above

Class files are compiled java code right?

How hard would it be to package these / compile these from source code as part 
of the build process?

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: Binary file inclusion (was [VOTE] Apache Toree (incubating) 0.1.0-rc4 as 0.1.0)

[Justin Mclean]

Hi,

> My interpretation of the term "compiled code" means compiled versions of the 
> source code within the package.

So how is including a jar in a source release to which there is no source code 
included (or even a pointer to that code that I can see) actually open source 
software?

Given this can be easily resolved by including the code and not the jars / 
changing the build process why is there a need to include the compile code in 
the source release?

But lets assume we allow this in a source release. It seems minor (it’s only 
test code as you say), but once we do allow jars / compiled code in source 
releases where do we draw the line? Is it OK to include gradle wrapper jars for 
instance? Or 3rd party dependancy jars? Or our compiled source code as well? 
All of these situations have resulted in -1 votes on incubator (and TLP) 
releases before.

> I suspect that Toree did all of this in their
> release package because Apache Spark was already doing that, and they were
> leveraging spark functionality, and if a TLP is doing it, it must be correct.

Just because it's being done by a TLP doesn’t automatically make it correct :-)

Thanks
Justin

Re: [VOTE] Release Apache Atlas 0.7.1 (incubating) RC3

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- incubating in name
- DISCLAIMER exists
- LICENSE is good
- NOTICE Is good (but year needs updating)
- No unexpected binary files in source release
- All ASF files have apache headers
- Can compile from source

You may not need jQuery-placeholer or platform.js in LICENSE as they don’t seem 
to be bundled in the source release.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Toree (incubating) 0.1.0-rc4 as 0.1.0

[Justin Mclean]

Hi,

> - The following test jars have been replaced with code to compile source
> and build jars at runtime

Great!

> With regard to sbt, Apache Spark includes a build
> script for sbt here: https://github.com/apache/spark/blob/master/build/sbt Can
> we grab that script and use it?

Sure.

> - With regard to the copyrights being in the LICENSE file, that should only
> be happening for our binary distribution.

I’m not sure they need to be in the binary either. The only reason a copyright 
needs to be mentioned in NOTICE is if it been relocated from a source file 
header. [1] Only a few thing need to go in NOTICE. [2]

>  Is there a specific place we should put the extra license information

No it's up to you.

> Should people be able to build the binary distribution LICENSE, NOTICE, etc 
> from source?


Generally yes. The binary must be made from what’s in the source release see 
[3].

Thanks,
Justin

1. https://www.apache.org/legal/src-headers.html#headers
2. https://www.apache.org/legal/src-headers.html#notice
3. http://www.apache.org/legal/release-policy.html#compiled-packages
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache DistributedLog release 0.4.0-incubating

[Justin Mclean]

Hi,

I also be -1 binding on this due to missing DISCLAIMER, ASF header issues and a 
possible binary release issue.

I checked:
- name includes incubating
- signatures good
- DISCLAIMER is missing
- License is OK
- Year needs updating in NOTICE.
- A large number of files seem to have have incorrect ASF headers with a 
copyright line "Copyright 2007 The Apache Software Foundation”. Did this come 
from somewhere else?
- Can compile from source

If you are creating convenience binaries then the compiled code in them must 
match the code from the source release. It’s not clear to me how the benchmark 
and service binaries relate to the source release. [1]

Thanks,
Justin

1. http://www.apache.org/legal/release-policy.html#compiled-packages
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Guacamole 0.9.11-incubating (RC1)

[Justin Mclean]

Hi,

+1 binding

I checked:
- names include incubating
- signature and hashes good
- please update year in NOTICE
- client LICENSE is missing license for this file [1] (mostly likely BSD but 
not 100% sure). Server LICENSE is fine. Can you fix this in the next release.
- No unexpected binary files
- all source files have ASF headers
- Didn’t compile as don't have correct environment. The README could list 
supported platforms btw.

Thanks,
Justin

1. 
./guacamole-client-0.9.11-incubating/extensions/guacamole-auth-duo/src/main/resources/lib/DuoWeb/Duo-Web-v2.js



-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [IP CLEARANCE] Apache Celix - Publish Subscribe

[Justin Mclean]

Hi,

I assume the binary file celix-pubsub.tar inside the grant is just compiled 
version of the code in the grant?

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache DistributedLog release 0.4.0-incubating

[Justin Mclean]

Hi,

> I think they might come from apache bookkeeper. when we started building
> DL, we might copy some headers from bookkeeper. We will address this in
> next RC.

Look like they may of also fixed this issue [1]. For why see the last bit of 
Step 2 here [2]. I assume there’s no code from bookkeeper included in the 
source release?

> Oh the service and benchmark are two modules in the maven project. What is
> your suggestion for this? Shall we create a giant binary package inckude
> both modules?

I would of expected the source when compiled produces those artefacts.

Not sure what the solution is here as It’s a little unclear me where ether 
source for those modules comes from. I assume it form the source release?

Thanks,
Justin

1. https://issues.apache.org/jira/browse/BOOKKEEPER-976
2. https://www.apache.org/legal/src-headers.html#headers
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Traffic Control 1.8.0-incubating (RC8)

[Justin Mclean]

Hi,

Sorry but it’s -1 (binding) as licensing issues and file headers reported last 
release that were not fixed.

I checked:
- names include incubating
- signature and hashes are OK
- disclaimer exits
- LICENSE still has issues brought up from last release
- NOTICE is OK but has wrong year
- Source files have ASF header. A couple of files have them incorrectly.
- No unexpected binary files in release.

While some of the issues brought up in last release have been fixed, there a 
large number that look like they haven’t.

LICENSE Is still missing licenses for jQuery UI, normalize.css, angular loading 
bar, lz-string (which also incorrectly has an ASF header on it), pretty print  
(and which also has an incorrectly added ASF header) and modernizr. They may be 
others. Also the dual licensing for select2.js has not been dealt with and nor 
has the licensing of multiple font files.

LICENSE also includes WebAppers Progress Bar which as pointed out last release 
is Category B and cannot be included in a source release.

Re licensing around the MaxMind DB GeoLite2 Database [1] (under a CC 
share-alike license) also IMO needs to be sorted. I’m not sure it classifies as 
"unmodified media”, best to ask on legal discuss.

Thanks,
Justin

1. ./traffic_router/core/src/test/resources/geo/GeoLite2-City.mmdb.gz
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Traffic Control 1.8.0-incubating (RC8)

[Justin Mclean]

Hi,

> Thanks again for your time checking our release, and sorry we’re still not 
> there. 

It’s a complex release and may take a little while to get right, and it ’s 
certainly not expected that you get everything right while in the incubator.

In this case the issues where raised with the last release and not fixed. Do 
you have these issues recorded in JIRA? That a good way to remember they need 
to be done before the next release.

Also you still may get enough other people to voting +1 on this release (a -1 
is not a veto) or you or someone else could change my mind.

> We’ve been running https://creadur.apache.org/rat/ 
> 

Rat is a very useful tool, but it wont catch everything and only knows about a 
limited number of licenses.

>  - is there anything else that you use that we can also use? Any tips you 
> have for us to get through this?

Just follow [1] it gives clear instruction off how to deal with most cases. [2] 
is also a help when it come to allowed 3rd party code. Your mentors should also 
be able to help here.

If you want me to take a look at when it comes up on your dev list, before 
offering it up for voting on the incubator list, just ask.

Thanks,
Justin

1. http://www.apache.org/dev/licensing-howto.html
2. https://www.apache.org/legal/resolved
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Impala 2.8.0 release candidate 1

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- name includes incubating
- signatures and hashed correct
- disclaimer exists
- LICENSE is OK
- NOTICE Is OK (but year is wrong - please fix for next release)
- All apache source files have ASF headers
- No unexpected binary files
- Don't have an environment set up to compile

And thanks for fixing the issues brought up in the last review.

Thanks,
Justin


-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Ranger 0.6.3 (incubating) - rc1

[Justin Mclean]

Hi,

-1 (binding) as issue brought up in previous releases have not been fixed.

For items not fixed please see [1][2][3].

Also note that with json2.js license it seems a little unclear to me and may be 
under the JSON license. It does have “public domain” in the code so it may be 
OK, it still however needs to be added to LICENSE. Just be careful as the JSON 
license no longer allowed in Apache software and it is considered category X. 
[4] In this case you do have a few months grace to remove this [5] but you need 
to call it out in NOTICE and it still needs to be removed by end of April. [5]

Also the year in notice is incorrect.

Thanks,
Justin

1. 
https://lists.apache.org/thread.html/6949e2f048b07478c861a675ad8e98d750e0f786b272a6afc69df78e@%3Cgeneral.incubator.apache.org%3E
2. 
https://lists.apache.org/thread.html/9552c63b71a38ed75cd252463e788408aa4a9a05abeba36168df5a12@%3Cgeneral.incubator.apache.org%3E
3. 
https://lists.apache.org/thread.html/de169a09f7527fbc3549518f0227ba40ee8524c6e60ba8105d82479b@%3Cgeneral.incubator.apache.org%3E
4. https://www.apache.org/legal/resolved#category-x
5. 
https://lists.apache.org/thread.html/bb18f942ce7eb83c11438303c818b885810fb76385979490366720d5@%3Clegal-discuss.apache.org%3E
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Release Apache Ranger 0.6.3 (incubating) - rc1

[Justin Mclean]

Hi,

> I'll point out that Ranger has graduated to a TLP, so the IPMC's votes are
> non-binding (unless you're on the Ranger PMC as well)

I was wondering why they put something up to vote just before becoming a TLP.

So I guess they should cancel that vote here?

They probably should still look into those issue particularly are they have 
been outstanding for several releases, but up to them I guess.

Thanks,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [VOTE] Apache Toree (incubating) 0.1.0-rc4 as 0.1.0

[Justin Mclean]

Hi,

Sorry but it’s -1 binding due to unexpected binary in source release and can’t 
compile from source. There are some license and notice issue that also need to 
be sorted.

I checked:
- signatures and hashes exist
- DISCLAIMER exists
- LICENSE needs some work  (has a “\n” in plain text in it btw)
- NOTICE is OK but has incorrect year (also a “\n”)
- Unexpected binaries in source release (see below)
- Source files have ASF headers
- Can’t compile from source

Source release contains several unexpected binary files:
./sparkr-interpreter/src/main/resources/sparkr_bundle.tar.gz
./sparkr-interpreter/src/main/resources/R/pkg/inst/test_support/sparktestjar_2.10-1.0.jar
./scala-interpreter/src/test/resources/TestJar2.jar
./scala-interpreter/src/test/resources/ScalaTestJar.jar
./scala-interpreter/src/test/resources/TestJar.jar

Several of these contain compiled code.

For the license file:
- Why does it contain a list of copyrights?
- Why does it include dependancies, only 3rd party code bundled with the 
release should be mentioned in license. [1]
- In fact I can see no obvious 3rd party code in the release. Is any 3rd party 
code bundled in the release?
- If there is 3rd party code have the original headers has been replaced with 
an ASF headers?

Following the release instruction I did a make dev and got "make: *** No rule 
to make target `etc/legal/LICENSE_extras', needed by 
`dist/toree-legal/LICENSE'.  Stop.”. Is something missing from the release? It 
may just be that my environment is not set up.

A nice to have the artefacts signed with an apache email rather than a gmail 
address.

Thanks,
Justin

1. http://www.apache.org/dev/licensing-howto.html#guiding-principle
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org