Bug#721072: libjson-java contains non free elements from json.org

[Emmanuel Bourg]

It seems the author of JSON-lib removed the "shall be used for Good, not
Evil" license in 2009 [1] because in 2006 Douglas Crockford released a
version of the json.org library licensed under the Apache-2.0 license to
allow its integration with the Apache Abdera project [2]. In the Abdera
repository the NOTICE file [3] contains this note:

"This software's extensions module contains a JSON writer for Atom XML
that utilizes a JSON parser, Copyright (c) 2002, json.org. The code was
licensed using Apache License by the author Douglas Crockford and made
available at http://json.org/java/apache.zip We have included portions
of the code in the extensions module."

The URL http://json.org/java/apache.zip no longer works, but there are
confirmations this URL contained an Apache licensed version of the
library [4] and a copy of this file is hosted by the Fedora project [5].

This confirms the json.org code used in JSON-lib is legitimately
licensed under the Apache-2.0 license.

[1] http://sourceforge.net/p/json-lib/bugs/87/
[2] http://markmail.org/message/tgugrzi2unaowerh
[3]
https://svn.apache.org/repos/asf/abdera/java/branches/0.3.0-incubating/NOTICE
[4]
http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201007.mbox/%3caanlktimxlavjzcvsoeujmd7frwde-1zn9sqaswzqf...@mail.gmail.com%3E
[5]
http://pkgs.fedoraproject.org/repo/pkgs/json/apache.zip/8f822e604866f92fde5c7b3f67b66809/apache.zip

__
This is the maintainer address of Debian's Java team
. 
Please use
debian-j...@lists.debian.org for discussions and questions.

Bug#721072: libjson-java contains non free elements from json.org

[Emmanuel Bourg]

Package: libjson-java
Version: 2.3-2
Severity: serious
Justification: Policy 2.2.1

JSON-lib, packaged as libjson-java, contains some elements from
the json.org Java API which is distributed under the non free
"shall be used for Good, not Evil" license.

The JSONString interface from libjson-java [1] is identical to the one
from json.org [2] but includes an additional Apache License header.
The Javadoc comments in JSONArray and JSONObject are also copied verbatim
from json.org.

It's not clear if JSON-lib is derived from the json.org implementation
or if the authors started from scratch and copied only the Javadoc.


[1] http://sources.debian.net/src/libjson-java/2.3-2/net/sf/json/JSONString.java
[2] https://github.com/douglascrockford/JSON-java/blob/master/JSONString.java

__
This is the maintainer address of Debian's Java team
. 
Please use
debian-j...@lists.debian.org for discussions and questions.