Clarify the license of com.google.code.findbugs : jsr305 : 3.0.1

[ctron]

The maven artifact containing the JSR 305 annotations on Maven Central [1] declares the Apache License 2 as the license to use for the JSR305 annotations. However, the FindBugs project states that all source code is licensed under the LGPL [2].

Which one is true?

[1] http://search.maven.org/#artifactdetails|com.google.code.findbugs|jsr305|3.0.1|jar
[2] http://findbugs.sourceforge.net/

[ctubbsii]

The original JSR305 code was produced and distributed as BSD, which appears confirmed elsewhere in this repo. I suspect it's just being uploaded to Maven Central incorrectly, and whoever is uploading it needs to do a better job of labeling it with the right license in its POM.

[carlossg]

There is also the question raised in http://stackoverflow.com/a/36198568/1815832 about the license issues of using javax.annotations

If you are distributing a JRE then as you already know you need to comply with the Oracle Java Binary License.

You may want to refresh yourself with the terms of that license, specifically:

F. JAVA TECHNOLOGY RESTRICTIONS. You may not create, modify, or change the behavior of, or authorize your licensees to create, modify, or change the behavior of, classes, interfaces, or subpackages that are in any way identified as "java", "javax", "sun", “oracle” or similar convention as specified by Oracle in any naming convention designation.

So if you are distributing a JRE and the same distribution includes a jar file that defines classes in a javax subpackage, unless the classes comply with a specification released and published by a JSR, you are not complying with the terms of the Oracle Java Binary License.

At this point in time that JSR 305 has not published anything

[ctubbsii]

@carlossg That is out of date. Since that time, the JSR305 page has published a specification, and this is the corresponding code which complies with that specification.

[spectejb]

@ctron - Were you able to resolve the licensing issue?

[ctron]

Not really.

[ctubbsii]

@ctron What remains unclear?

[ctron]

The original authors of the project did never reply to any inquery about the state of the license.

[ctubbsii]

@ctron Why do they need to respond? The fact that it is BSD is documented in numerous places, including in this findbugs repo. What remains unclear?

[ctron]

The Eclipse Foundation wanted to confirm the license. The authors never responded. As we've seen before different locations seems to have different records on this library.

The two possible solutions where to go with IntelliJ annotations or take it as an acceptable risk. The decision for the latter was made.

[KengoTODA]

I agree with @ctubbsii. It should be BSD as described in its license file.

IMHO, license data in pom.xml like [1] is untrustable. Not only this artifact but also others have wrong discription. I recommend you to stop caring about this.
About [2], this is license of FindBugs itself, not this JSR305 artifact.

[jtnord]

@ctubbsii

That is out of date. Since that time, the JSR305 page has published a specification, and this is the corresponding code which complies with that specification.

Really - there is absolutely noting listed on https://jcp.org/en/jsr/detail?id=305 that confirms this in any official way whatsoever that I can find. A WIP drop of code is not an official spec, so @carlossg is correct and #88 stands.

[ctubbsii]

@jtnord I'm not a lawyer, so I can't advise on the proper interpretation of that Oracle binary license clause pertaining to redistributing the JRE. But, it seems to me that the intent was to permit redistribution of the JRE with JSR code, which are expected to use those package naming conventions. It also seems to me that the description of the JSR on that page you linked, specifying the behavior of the JSR, would constitute the "published specification" that license paragraph refers to. That JSR specifies the creation of these annotations, and this code complies with that specification by creating these annotations. So, by both intent and by a literal reading, I think there is no concern regarding the Oracle binary license. But, as I said, I'm not a lawyer.

Regardless, I think that's a separate issue. This one seems resolved: The license is BSD.

As for #88 , I think that should be discussed on that issue.

[spectejb]

@iloveeclipse Can you please give this group guidance on the Apache 2.0 vs. BSD vs. LGPL license question for jsr305? We want to make sure we understand how to comply with using it as you intended.

Any help would be greatly appreciated!

[iloveeclipse]

@spectejb : I'm neither a lawyer nor the author of the library, but looking at the original license files you will see that this is clearly BSD (https://opensource.org/licenses/BSD-3-Clause):

https://github.com/amaembo/jsr-305/blob/master/ri/LICENSE
https://github.com/findbugsproject/findbugs/blob/3.0.1/findbugs/licenses/LICENSE-jsr305.txt

Whoever put that thing into maven repo under the different license was just plain wrong.
Unfortunately the original JSR-305 author @billpugh never responds any questions related to JSR-305, but you can try to contact him on twitter (https://twitter.com/wpugh), may be you have more luck.

[AlexanderBartash]

I noticed that https://github.com/findbugsproject/findbugs/blob/master/findbugs/licenses/LICENSE-jsr305.txt has a link to https://opensource.org/license/BSD-2-Clause but here http://code.google.com/p/jsr-305/ they have a link to https://opensource.org/license/BSD-3-Clause

[ctubbsii]

I noticed that https://github.com/findbugsproject/findbugs/blob/master/findbugs/licenses/LICENSE-jsr305.txt has a link to https://opensource.org/license/BSD-2-Clause

No, it doesn't. It has a link to http://www.opensource.org/licenses/bsd-license.php, which is an old link that presumably would have explained multiple BSD licenses. Now, those have separate pages and have "See also" links on them. This old link now redirects to the one for BSD-2-Clause, but you have to follow the "See also" link on the page to get to the 3-clause terms. You can't just pay attention to the links... those are there for convenience... you have to look at the name of the license. On that page, it specifically says "New BSD license", which is an alternate name for the BSD-3-Clause. So, that's just an old link that now redirects to the wrong place, not an incorrect description of the license. If you use the old link, you have to follow the subsequent links to the correct license.

The findbugsproject file could be updated to use a newer link directly to BSD-3-Clause to make this less confusing, but it's not technically wrong. It does correctly say "New BSD license", which is the part that matters. I created PR #197 to update the link.

[AlexanderBartash]

@ctubbsii "See also" means "see also" and not "this is actually a BSD-3 license". I can not believe that a single lawyer will take what you've explained seriously. If it leads to BSD2 it is BSD2 and there is no ambiguity here.

[iloveeclipse]

I noticed that https://github.com/findbugsproject/findbugs/blob/master/findbugs/licenses/LICENSE-jsr305.txt has a link to https://opensource.org/license/BSD-2-Clause but here http://code.google.com/p/jsr-305/ they have a link to https://opensource.org/license/BSD-3-Clause

Correct.
I've already commented earlier in this thread that original code used BSD-3 license, and so it is the right one as there were never any public updates in the project licenses cince Bill decided to stop working on FindBugs/JSR-305.

[ctubbsii]

@AlexanderBartash wrote:

"See also" means "see also" and not "this is actually a BSD-3 license".

That's not what I said. The correct license is the BSD-3-Clause (aka "New BSD license") because that's what its authors released it under, not because of the contents of any link, or even what the findbugs project says about it. My point about "see also" links was that, even though the correct license terms cannot directly be found at the provided link, they can be found by following an additional link.

I can not believe that a single lawyer will take what you've explained seriously. If it leads to BSD2 it is BSD2 and there is no ambiguity here.

The link leading to BSD2 doesn't make those terms applicable to JSR-305's redistribution. It just means the link is wrong.

I'm not interested in your hypotheticals about what a lawyer will take seriously. If a lawyer can't understand the facts, I wouldn't hire them. Here are the facts:

1. The file you pointed to correctly identifies the "New BSD license" as the applicable license, by one of its well-known names,
2. The current link is a redirect to a different license, but the correct license can be found by following additional links,
3. The terms of the "New BSD license" applies, whether you find them at the provided link or not,
4. If you find other license terms at the link, those terms don't automatically apply instead of the "New BSD license" terms,
5. opensource.org is not the author or authoritative source of the license terms, so it was provided for convenience.

I don't know why you shared the screenshot of the page; it added no new information. We already know that the link redirects to the wrong license, and I acknowledged that it is confusing. I created a PR to fix it. I'm not sure what you hope to accomplish by further arguing about it.