Importing SourceForge code that uses ASL

[Scott Eade <se...@backstagetech.com.au>]

A while back someone apparently forked the Jakarta Turbine JCS project 
to a SourceForge project (http://ehcache.sourceforge.net/) to fix some 
bugs and to simplify the code base by reducing the scope of the 
functionality it provides. 

The SF project is listed as being ASL.  The LICENSE.txt file in the most 
recent release (0.7) is ASL 1.1 (Jakarta commons variation), but about 2 
weeks ago this was updated in cvs [1] to assign the copyright to a 
specific individual (Greg Luck) and the attribution to:

 *       "This product includes software developed by Greg Luck
 *       (http://sourceforge.net/users/gregluck) and contributors.
 *       See http://sourceforge.net/project/memberlist.php?group_id=93232
 *       for a list of contributors"


The license included in the source files was updated at the same time.

There is renewed interest in JCS and someone has offered a patch [2] 
that ports all of the bug fixes in Ehcache back to JCS but I am 
wondering if there is anything special we need to do to legitimise this 
code.

I am suggesting we do the following:
1. Update JCS to use ASL 2.0, as is required anyway.
2. Apply the patches and note the Ehcache attribution in NOTICES.txt

Is this the correct approach?

References:
[1] 
http://cvs.sourceforge.net/viewcvs.py/*checkout*/ehcache/ehcache/LICENSE.txt?content-type=text%2Fplain&rev=1.3
[2] 
http://nagoya.apache.org/eyebrowse/ReadMsg?listName=turbine-jcs-user@jakarta.apache.org&msgNo=403

Thanks,

Scott

-- 
Scott Eade
Backstage Technologies Pty. Ltd.
http://www.backstagetech.com.au

Re: Importing SourceForge code that uses ASL

[Jennifer Machovec <je...@golux.com>]

Scott Eade wrote:

> A while back someone apparently forked the Jakarta Turbine JCS project 
> to a SourceForge project (http://ehcache.sourceforge.net/) to fix some 
> bugs and to simplify the code base by reducing the scope of the 
> functionality it provides.
> The SF project is listed as being ASL.  The LICENSE.txt file in the 
> most recent release (0.7) is ASL 1.1 (Jakarta commons variation), but 
> about 2 weeks ago this was updated in cvs [1] to assign the copyright 
> to a specific individual (Greg Luck) and the attribution to:
>
> *       "This product includes software developed by Greg Luck
> *       (http://sourceforge.net/users/gregluck) and contributors.
> *       See http://sourceforge.net/project/memberlist.php?group_id=93232
> *       for a list of contributors"
>
Greg's EHCache program appears to be a derivative work of JCS, and as 
such the copyright attribution should not simply have been changed to 
him.  I would recommend that ASF contact him to ensure that the original 
copyright notices are remaining intact in the work.

> The license included in the source files was updated at the same time.
>
> There is renewed interest in JCS and someone has offered a patch [2] 
> that ports all of the bug fixes in Ehcache back to JCS but I am 
> wondering if there is anything special we need to do to legitimise 
> this code.
>
Based on the information available in SourceForge and the postings on 
the jakarta list, this looks like considerably more than a patch IMHO.

> I am suggesting we do the following:
> 1. Update JCS to use ASL 2.0, as is required anyway.
> 2. Apply the patches and note the Ehcache attribution in NOTICES.txt
>
> Is this the correct approach? 

I think the best option might be to ask Greg and the other SF 
contributors to sign a CLA (and the project committee would then perform 
the review and due diligence ordinarily conducted on contributions).   
The SF notice would be unnecessary if the CLAs were executed.