Re: Recent additions to POI "Added implementation of Digital Signature support"

[David Fisher <df...@jmlafferty.com>]

Hi Josh,

> I noticed a rather significant change submitted recently:
> http://svn.apache.org/viewvc?view=rev&revision=824836

I'm very glad you noticed. Big changes ought to be announced at a  
minimum and preferably discussed in advance.

> My concern is not about the functionality - this sounds very much like
> something that POI should have.  There are a few issues that come to
> mind, however:
>
> - This is a big chunk of work to submit with no supporting discussion
> e.g. a bugzilla entry or dev mail thread
> - There are now 7 new jars that POI depends on to build (my biggest  
> concern)

I think that we should always vote on adding dependencies. What  
dependencies are added?

> - There may be licensing issues (I am not in a position to judge this
> properly). The files all contain a comment "Based on the eID Applet
> Project code.  Original Copyright (C) 2008-2009 FedICT".  Is there a
> new relationship between POI and "eid-applet"?  Could we at least
> document somewhere that this code contribution is properly sanctioned?

The svn comment is: "Added implementation of Digital Signature support  
using code initially developed for the eId Applet project <http://code.google.com/p/eid-applet/ 
 > and re-released under Apache License." Since the google page at  
that link mentions it is licensed as "evil" LGPL, this could indicate  
a deep concern. I think though that link is misleading.

I wonder if the relationship is between Apache XML Security and  
FedICT? Where's the proof of the Apache License?

Also, with new dependencies it seems likely that we might need to edit  
the Apache POI NOTICE and LICENSE files.

Regards,
Dave


> - There is a (small) compiler error introduced apparently because the
> original code was compiled against JDK 6.
>
>
> cheers,
> Josh
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
> For additional commands, e-mail: dev-help@poi.apache.org
>


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org