taskSavannah Administration - Tasks: task #15026, Submission of guile-jwt

 
 

task #15026: Submission of guile-jwt

Submitter:  Aleix Conchillo Flaqué <aleix>
Submitted:  Fri 17 Aug 2018 10:23:35 PM UTC
   
 
Should Start On:  Fri 17 Aug 2018 10:00:00 PM UTC Should be Finished on:  Mon 27 Aug 2018 10:00:00 PM UTC
Category:  Project Approval Priority:  * 5 - Normal
Status:  Done Privacy:  Public
Assigned to:  ineiev Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Thu 23 Aug 2018 04:47:43 PM UTC, comment #7: 

Thank you! I just fixed your two last suggestions in all the projects.

Thanks again.

Aleix Conchillo Flaqué <aleix>
Thu 23 Aug 2018 07:52:48 AM UTC, comment #6: 

Thank you!

In ChangeLog, you added a copyright notice, but it still has no license notice; it would be nice if it had.

In README.md, the licensing terms aren't specified quite exactly: it says GPLv3-only, whereas it should be GPLv3+. I recommend using the full canonical form of GPL notice, it leaves room for no ambiguity.

Approving.

Ineiev <ineiev>
Site Administrator
Thu 23 Aug 2018 04:03:52 AM UTC, comment #5: 

Btw, not sure what licensed I set when registering the project, but I guess you should change it to GPLv3.

Aleix Conchillo Flaqué <aleix>
Thu 23 Aug 2018 04:02:14 AM UTC, comment #4: 

Hi again,

I have reconsidered and switched to GPLv3.

I have added notices to README and ChangeLog. I have not updated NEWS and AUTHORS since I consider those trivial files.

Please, take a look to the latest:

https://github.com/aconchillo/guile-jwt

I will also switch all my other guile packages to GPLv3.

Thanks!

Aleix

Aleix Conchillo Flaqué <aleix>
Tue 21 Aug 2018 07:03:07 AM UTC, comment #3: 


> Certainly, I can fix the files that come with SPDX-License-Identifier. See new commit:
>
> https://github.com/aconchillo/guile-jwt/commit/ba2685b53865dbf00c0bd95e700e5f25b515009a


Thank you!

> I initially licensed guile-json with LGPLv3 but GnuCash wanted to use guile-json and since GnuCash it's licensed under the GPL


The LGPLv3 says,


  This version of the GNU Lesser General Public License incorporates
the terms and conditions of version 3 of the GNU General Public
License, supplemented by the additional permissions listed below.


The GPLv3 says, in its turn,


  When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it.


This means that the user may always drop the text of the LGPL and
use your package under the GPL. Weren't you aware of that?

> I've seen a few other projects that do the same. For example:
>
> https://www.gnu.org/software/artanis/


I find this confusing: the LGPL embeds a permission to use under the GPL, why the copyright holders explicitly mention the GPL? They must mean something different, but what?

> About the README and ChangeLog,


For ChangeLog, please check https://www.gnu.org/prep/maintain/html_node/Copyright-Notices.html
(note +verb+Change log files should have a copyright notice and license notice at the end-verb-).

README files are explicitly mentioned in
https://www.gnu.org/prep/maintain/html_node/License-Notices-for-Other-Files.html

Note that some other files in your package still lack the notices; please check them all.

> there are important GNU proejcts that don't include the license notice.
>
> http://git.savannah.gnu.org/cgit/guile.git/tree/


Please file a bug report and make sure it's fixed...

> I believe I haven't added them in any of my other projects in savannah in the past.


...and of course fix your own packages!

Any files that have no copyright and license notices are technically unredistributable, therefore proprietary. There may be an overall notice for the whole program somewhere in README (your package doesn't seem to have it), however, they are easily lost when a file without notices is copied to another package alone.

By the way, are you sure you need the LGPL at all?

Ineiev <ineiev>
Site Administrator
Mon 20 Aug 2018 04:25:13 PM UTC, comment #2: 

Hi!

Thank you for the reply!

Certainly, I can fix the files that come with SPDX-License-Identifier. See new commit:

https://github.com/aconchillo/guile-jwt/commit/ba2685b53865dbf00c0bd95e700e5f25b515009a

I initially licensed guile-json with LGPLv3 but GnuCash wanted to use guile-json and since GnuCash it's licensed under the GPL, I chose to make guile-json available with the two licenses, so you can use whatever one feeds you best. I sent and email to the FSF and the answer was:

"""
This matches closely with the suggested license header block, which we display <https://www.gnu.org/licenses/gpl-howto.html>.

Thank you for your question and happy hacking!
"""

So, I assumed double license was fine. I've seen a few other projects that do the same. For example:

https://www.gnu.org/software/artanis/

So, I created guile-jwt with the same licenses.

About the README and ChangeLog, there are important GNU proejcts that don't include the license notice.

http://git.savannah.gnu.org/cgit/guile.git/tree/

I believe I haven't added them in any of my other projects in savannah in the past.

Please, let me know if the README and ChangeLog changes are a must. I would also be interested to hear about the dual license. I'm not an expert in licenses at all.

Thanks again!

Aleix Conchillo Flaqué <aleix>
Mon 20 Aug 2018 12:31:14 PM UTC, comment #1: 

Hello, Aleix! Thank you for submitting your package!

I see a few issues with your tarball: first, all copyrightable files should have valid copyright and license notices, including files like README and ChangeLog. (I don't think SPDX-License-Identifier alone will do: it may be a nice thing for automatic processing, but the user may not know what it means.)

Then, it isn't clear what your licensing terms ("GPLv3+ and LGPLv3+") actually mean.

By the way, what is the actual license of guile-json? This submission says it's the GPLv3, but its Savannah page claims it's the LGPL.

At last, in your license notice it would be better to use the URL of the license rather than FSF's postal address.

Ineiev <ineiev>
Site Administrator
Fri 17 Aug 2018 10:23:35 PM UTC, original submission:  

A new project has been registered at Savannah
This project account will remain inactive until a site admin approves
or discards the registration.


Registration Administration


While this item will be useful to track the registration process,
approving or discarding the registration must be done using the specific Group Administration page, accessible only to site administrators,
effectively logged as site administrators (superuser):



Registration Details


  • Name: guile-jwt
  • System Name:  guile-jwt
  • Type: non-GNU software and documentation
  • License: GNU General Public License v3 or later (Also licensed under LGPLv3.)





Description:

guile-jwt is a JSON Web Token module for Guile. JSON Web Tokens are an open, industry standard (RFC 7519) method for representing claims securely between two parties. guile-jwt allows you to decode, verify and generate JWT.



Other Software Required:

guile-json GPLv3 https://savannah.nongnu.org/projects/guile-json


Tarball URL:

https://savannah.nongnu.org/submissions_uploads/guile-jwt-0.1.0.tar.gz


Aleix Conchillo Flaqué <aleix>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by aleix (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-08-23 ineiev StatusIn Progress Done
        Open/ClosedOpen Closed
    2018-08-20 ineiev StatusNone In Progress
        Assigned toNone ineiev

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code