14 messages in org.apache.legal-discussRe: Maven repository issues [Was: Cre...
FromSent OnAttachments
Henri YandellMay 29, 2008 1:06 am 
Stefano BagnaraMay 29, 2008 1:17 am 
Assaf ArkinMay 29, 2008 10:53 am 
Henri YandellMay 29, 2008 12:10 pm 
Stefano BagnaraMay 29, 2008 12:35 pm 
David JencksMay 29, 2008 12:47 pm 
Craig L RussellMay 29, 2008 2:38 pm 
Gilles ScokartMay 30, 2008 1:04 am 
Stefano BagnaraMay 30, 2008 1:47 am 
Assaf ArkinMay 30, 2008 2:50 am 
sebbMay 30, 2008 2:51 am 
Stefano BagnaraMay 30, 2008 3:33 am 
Assaf ArkinMay 30, 2008 4:33 am 
Gilles ScokartMay 30, 2008 4:35 am 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:Re: Maven repository issues [Was: Creative Commons Attribution License]Actions...
From:Assaf Arkin (ark@intalio.com)
Date:May 30, 2008 4:33:07 am
List:org.apache.legal-discuss

On Fri, May 30, 2008 at 3:34 AM, Stefano Bagnara <apa@bago.org> wrote:

I agree. Can't we identify a set of "tags" that do not imply creativity so to be able to paint a line?

IMHO (IANAL) the simplest pom having only a groupId/artifactId/version (so the one automatically generated by maven is not a creative work: does anyone disagree on this?

The name, url, issueManagement, inceptionYear, organization and license tags are "facts" about the described artifact, IMHO there is nothing creative there, do you agree?

Caveat. For all you know, the issueManagement element might contain the next great American novel. I don't think you can make that blank statement on every element in the POM just because the intent is for that element to contain trivial facts.

Assaf

Like the "description" also the "dependency" tag is sometimes (*some times*) simple to guess, but this involve a creative process to choose the right versions. (Choosing the scope is not a creative work, IMHO).

About pratical examples (some artifact I use):

dnsjava pom, IMHO, is *not* the result of a creative work: http://repo1.maven.org/maven2/dnsjava/dnsjava/2.0.1/dnsjava-2.0.1.pom

javamail can be found in 2 repositories: https://maven-repository.dev.java.net/nonav/repository/javax.mail/poms/mail-1.4.pom http://repo1.maven.org/maven2/javax/mail/mail/1.4/mail-1.4.pom both of them includes the javax.activation dependency, so it is questionable. What do you think?

what about junit.pom? Is that descriptor the result of something creative? http://repo1.maven.org/maven2/junit/junit/3.8.1/junit-3.8.1.pom

My main issue is that junit is used by almost any project around, this pom does not include a license header and we cannot guess it is redistributed under the same license of the junit itself (because it is not part of the junit redistributable). So someone wrote it or copied it somewhere and uploaded to central. For what we know it could be something written by someone else and having all right reserved to the original author (that we don't know). For what we know we don't even have the right to automatically let maven download it to build a single project, right? "Central" is used by default by maven. Maven should warn the user that simply running "mvn" against any project could make him violate the copyright for some file automatically downloaded without his consensus?