nōn-free json.org code used

[mirabilos]

Hi,

my coworkers want to use JSONassert in their project, but (as the person responsible for insisting on proper licences) I need to tell them not to, because your code pulls in code from json.org under Douglas Crockford’s bad licence.

Please replace this; the Debian Wiki page https://wiki.debian.org/qa.debian.org/jsonevil contains background information and a list of alternative implementations. Apparently, https://android.googlesource.com/platform/libcore/+/master/json is a drop-in replacement. I asked a coworker (@tkrille) whether it would be possible to just write a pom.xml file for http://ftp.de.debian.org/debian/pool/main/liba/libandroid-json-org-java/libandroid-json-org-java_20121204-20090211.orig.tar.gz and upload that to Maven Central. It appears to be (note: I’m not a Java™ developer myself) a drop-in replacement, so you’d “just” have to change the reference in your own pom.xml afterwards (and test).

Would also be nice if you could do that yourself.

Thanks for your consideration!

[mirabilos]

Maybe @thkoch2001 the Debian maintainer of this package could also maintain this in Maven Central (so it doesn’t end up being a one-shot). Thomas, what do you think about this, so we can more easily liberate more software using the bad code?

[thkoch2001]

@mirabilos Thx for asking. I'd very much like to help. But I don't do any java development in my current job and therefor also all my contributions to debian-java have stalled in lack of time. Please ask upstream of libandroid-json-org!

[DavidBiesack]

@mirabilos The cited android library https://android.googlesource.com/platform/libcore/+/master/json appears to be GPL. Although as of today that Git repo has a file named "MODULE_LICENSE_BSD_LIKE" that file is empty (thus not very BSD like at all) and the parent https://android.googlesource.com/platform/libcore/+/master has a LICENSE file which is GPL Version 2.

[mirabilos]

David Biesack dixit:

Although as of today that Git repo has a file named
"MODULE_LICENSE_BSD_LIKE" that file is empty (thus not very BSD like
at all) and the parent
https://android.googlesource.com/platform/libcore/+/master has a
LICENSE file which is GPL Version 2.

No, that’s not how Android’s way of tagging licences works.
They use the following schema:

Any module that has some sort of licence has one of those
“MODULE_LICENSE_*” files in it. They are empty unless in
special cases, they are merely used as “tags”.

The licence of a piece of code is not determined by the
presence of some licence in some other directory anyway
but by the licence grant on the particular work. The
JSON implementation in question has an explicit grant
under the Apache 2.0 licence.

It’s actually common for a bigger project to accumulate
various licences; the GPL you saw doesn’t apply to the
JSON implementation, only to other parts of libcore (and
ordinarily to the whole when combined, but it’s not just
GPL, it’s GPL with classpath exception, so effectively
not “viral”).

[DavidBiesack]

Ahh, thanks for clearing that up.

[DavidBiesack]

http://search.maven.org/#artifactdetails%7Ccom.vaadin.external.google%7Candroid-json%7C0.0.20131108.vaadin1%7Cjar is an Apache 2.0 clean room implementation of org.json
(only missing the org.json.JSONString interface). Switching to that works. I'll try to submit a pull request.

[mirabilos]

David Biesack dixit:

http://search.maven.org/#artifactdetails%7Ccom.vaadin.external.google%7Candroid-json%7C0.0.20131108.vaadin1%7Cjar is an Apache 2.0 clean room implementation of org.json

That’s precisely what we used in one of our projects, yes.

    <json.version>0.0.20131108.vaadin1</json.version>

    <dependency>
        <groupId>com.vaadin.external.google</groupId>
        <artifactId>android-json</artifactId>
        <version>${json.version}</version>
    </dependency>

(only missing the org.json.JSONString interface). Switching to that works. I'll try to submit a pull request.

OK, thanks!

bye,

//mirabilos

I believe no one can invent an algorithm. One just happens to hit upon it
when God enlightens him. Or only God invents algorithms, we merely copy them.
If you don't believe in God, just consider God as Nature if you won't deny
existence. -- Coywolf Qi Hunt