[lsb-discuss] LSB conf call notes for 2008-07-30

[R P Herrold]

On Fri, 8 Aug 2008, Theodore Tso wrote:

> I don't think it's a problem for us, because we will be mandating
> something which passes the TCK (regardless of whether we integrate the
> TCK into the LSB tests or whether we just ask the distributor to
> assert that it passes the TCK).

I read this during the call, but here it is again:

---------------start disclaimer-------------------

I_A_AL, but not your lawyer.  I offer legal advice and formal
opinion only within the confines of a previously  established 
and explicit attorney-client relationship where privilege may 
be had;  and NEVER on a public list server.

----------------end disclaimers ------------------

Let's review the bidding, as Ted was not on the call this 
week.

The license document in question is: openjdk-tck-license.pdf 
from http://openjdk.java.net/ -- documents live here: 
http://openjdk.java.net/legal/

1.9 "Technology Compatibility Kit" or "TCK" means the Test 
Suite and related documentation, for example, the TCK Users 
Guide, as made available to Licensee and may be revised by Sun 
during the Term, associated with the Java Specification and 
that are provided so that Licensee may determine if its 
Implementation is compliant with the Specification.

5.0     CONFIDENTIAL INFORMATION

5.1 Duty of Confidentiality. Licensee will protect the TCK as 
Sun Confidential Information protected under this Section 5.0. 
A party receiving Confidential Information may not: (i) 
disclose Confidential Information to any third party other 
than another party bound by an OpenJDK Community TCK License 
Agreement v. 1.x (and provided that any Confidential 
Information disclosed by Licensee to such party shall be 
provided under such Agreement and subject to Section 5 of the 
recipient's OpenJDK TCK License Agreement v 1.x); or (ii) use 
Confidential Information except for the purpose of developing 
and testing Licensee Implementations. ...

6.0     LIMITATION OF LIABILITY

Except for violation of Sun's Intellectual Property Rights, or 
breach of Section 2.0: (a) each party's liability to the other 
for claims relating to this Agreement, whether for breach or 
in tort, shall be limited to [inapplicable, as we ARE into 
asserted "Sun's Intellectual Property Rights"] ...

> (And if Sun's lawyers decide to go after those distributions 
> with scarry cease-or-we- sue-the-pants-off-of-you letters, 
> particularly with non-commercial distro's such as Gentoo, 
> Debian, etc. --- the LSB wouldn't be involved, and we can 
> just stand back and watch the Slashdot bonfire from a 
> distance.  :-)

So, exposing people to an NDA, and potentially unlimited 
liability, and defense costs, in order to be be able to 
test and demonstrate their distribution is LSB complaint is 
fine?


I think not.  I think the LSB cannot in good conscience place 
distributions in the line of fire, until and unless the 
testing tool is not a 'spring gun'.


'Java' is clearly asserted to be Sun's trademark:
    http://www.sun.com/policies/trademarks/
 	"Java is a trademark when it identifies a software product,"


These are variously objective realities, or my $0.02 personal 
takeaways.  Each person has to find their own path.


I mentioned CentOS position (our user base want Java -- Suns or 
another, all the time -- We would _like_ to have it trivial to 
install properly) and 'indemnification' during the call, as I 
was getting Ray Gans and Onno Kluyt's named (I'd appreciate 
email addresses to go with those.)

Attn: Dalibor Topic: help please.  An email to 
herrold at owlriver.com would be appreciated.


Clearly recent statements from Sun have reiterated and 
ratified the 'indemnification' aspect being intentionally 
present in their licenses:

 	http://java.sun.com/reference/stealourcode/index.html

 	You are free to use this source code for any purpose,
 	commercial or non-commercial, as long as you indemnify the
 	authors and Sun Microsystems, Inc., from any consequences of
 	its use.

The (2006) DLJ, and DLJ FQ 1.3 seem pretty direct to me: 
http://download.java.net/dlj/DLJ-v1.1.pdf 
http://download.java.net/dlj/DLJ-FAQ.pdf

The License (sorry this is such a nasty run-on ... I added 
some CR's and tabs to make it readable):

2. LICENSE GRANT. Subject to the terms and conditions of this 
Agreement, as well as the restrictions and exceptions set 
forth in the Software README file, Sun grants you a 
non-exclusive, non-transferable, royalty-free limited license 
to reproduce and use the Software internally, complete and 
unmodified, for the sole purposes of running Programs and 
designing, developing and testing Programs.

Sun also grants you a non-exclusive, non-transferable, 
royalty-free limited license to reproduce and distribute the 
Software, directly or indirectly through your licensees, 
distributors, resellers, or OEMs, electronically or in 
physical form or pre-installed with your Operating System on a 
general purpose desktop computer or server, provided that:

 	(a) the Software and any proprietary legends or 
notices are complete and unmodified;

 	(b) the Software is distributed with your Operating 
System, and such distribution is solely for the purposes of 
running Programs under the control of your Operating System 
and designing, developing and testing Programs to be run under 
the control of your Operating System;

 	(c) you do not combine, configure or distribute the 
Software to run in conjunction with any additional software 
that implements the same or similar functionality or APIs as 
the Software;

 	(d) you do not remove or modify any included license 
agreement or impede or prevent it from displaying and 
requiring acceptance;

 	(e) you only distribute the Software subject to this 
license agreement; and

 	(f) you agree to defend and indemnify Sun and its 
licensors from and against any damages, costs, liabilities, 
settlement amounts and/or expenses (including attorneys' fees) 
incurred in connection with any claim, lawsuit or action by 
any third party that arises or results from

 		(i) the use or distribution of your Operating 
System, or any part thereof, in any manner, or

 		(ii) your use or distribution of the Software 
in violation of the terms of this Agreement or applicable law.

---- paragraph ends -------

and the FAQ:

 	· Indemnify Sun against claims arising from your OS or your
 	violation of the DLJ (or any applicable law) Note that you
 	are not responsible for changes made to your OS distribution
 	by downstream users or distributors when such changes are out
 	of your control.

 	(later)

 	· Ship only a compatible JDK on your OS. If notified
 	of an incompatibility, you must correct it and offer a
 	patch or replacement to downstream recipients within
 	90 days, or stop shipment and notify downstream recipients.

Combination with, or combined distribution with a competing 
successor 'java-like' program (the existing prior efforts, and 
"OpenJDK") looks like a pretty clear violation to me:

 	(c) you do not combine, configure or
 	distribute the Software to run in conjunction with any
 	additional software that implements the same or similar
 	functionality or APIs as the Software;

I would be delighted to have the indemnification and 
exclusivity clauses deleted, but ... hasn't happened yet. 
I'll ask formally with Gans or Kluyt's contact details.

CentOS have concluded that the indemnification and 
exclusivity clauses on redistributing Sun's Java is already a 
risk we won't undertake.

LSB needs to decide how much and what kinds of risk 
[contractual NDA, contractual indemnification, trademark 
infringement, patent, copyright, more?] it is willing to ask 
distributions to expose themselves to, to become 'LSB 
compliant'.

-- Russ herrold