taskSavannah Administration - Tasks: task #9873, Submission of VladNput

 
 

task #9873: Submission of VladNput

Submitter:  Patrick Higgins <patrick133t>
Submitted:  Thu 05 Nov 2009 11:31:04 PM UTC
   
 
Should Start On:  Thu 05 Nov 2009 12:00:00 AM UTC Should be Finished on:  Sun 15 Nov 2009 12:00:00 AM UTC
Category:  Project Approval Priority:  * 5 - Normal
Status:  Done Privacy:  Public
Assigned to:  marioxcc Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sun 13 Dec 2009 10:33:38 PM UTC, comment #18: 

As far as I am concerned everything looks pretty good. The biggest issue was the some of your files do not have the full copying permissions statement that is recommended by the licenses. The project files are still very clear in what it is licensed under. I have approved your project. You will receive an automated e-mail containing detailed information about the approval.

Regards.

-Deleted Account- <nicalvaro>
Wed 09 Dec 2009 10:34:12 PM UTC, comment #17: 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

December 9th 2009 in GNU Savannah item 9873: "Submission of VladNput"

Hm, the list rejects the tarball.

Well, it is attached to the tracker in 2 parts with split
command. They can be joined with cat.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEAREIAAYFAksgI8AACgkQZ4DA0TLic4i8bACaAzaQ0sib9TYCEtDfJaBbF4hj
5kgAn0ZYTOeaGmfBXBYFibVr3ivphsDU
=WH7X
-----END PGP SIGNATURE-----

Mario Castelán Castro <marioxcc>
Wed 09 Dec 2009 10:07:42 PM UTC, comment #16: 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

December 9th 2009 in GNU Savannah item 9873: "Submission of VladNput"

I think than the hosting requirement are meet but I can't approve the
project. I will send your last tarball to
savannah-hackers-public@gnu.org. An administrator will do a final
review and approve the project if all is ok.

The SHA256 of tarball is
4e17b44b952d0f7f4ad4f35de8435189726e586e9c01bbc8eaf285e794c12eb1.

Regards.

Item status changes:

Status -> Need Admin
Percent complete -> 90%
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEAREIAAYFAksgHZAACgkQZ4DA0TLic4gDNgCeL7FjkYi2ZV6S2CSFS5WRKxAA
BvYAoIKC+hdZs7Nkc1k0Rc4YSubWB+0V
=Ko65
-----END PGP SIGNATURE-----

Mario Castelán Castro <marioxcc>
Wed 09 Dec 2009 09:02:31 PM UTC, comment #15: 

Oops. I put that in following an ant example I found. I've updated my build.xml to put the following footer on the Javadoc API documentation:

This is part of the VladNput API documentation.
Copyright &#169; 2009 Patrick Higgins
Licensed under the GNU Free Documentation License version 1.3 or (at your option) any later version.
See COPYING-DOC in the VladNput distribution for full copying conditions.

I've also added COPYING-DOC to the top-level containing the FDL v1.3.

I'll email the tar to you.

Patrick Higgins <patrick133t>
Wed 09 Dec 2009 12:36:18 AM UTC, comment #14: 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

December 8th 2009 in GNU Savannah item 9873: "Submission of VladNput"

Ohh, I can read "All right reserved" in the HTML files and no further
copy permissions. That turn the documentation into propietary and we
do not allow that.

If you want to make the documentation free put the documentation under
a free documentation licence like the FDL See
http://www.gnu.org/licenses/fdl-howto.html. As this files are not to
be distributed in printed format you can use the (L)GPL too.

Regards.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEAREIAAYFAkse7tQACgkQZ4DA0TLic4iy9ACfQKLL2UIlbJkXvXjpAc2PUdRG
tvwAn384Gp048VFstfe3hr1G+OWFuHKs
=aGBQ
-----END PGP SIGNATURE-----

Mario Castelán Castro <marioxcc>
Tue 08 Dec 2009 10:51:07 PM UTC, comment #13: 

Thanks for the tip about Firefox, Mario. I never knew about that one! I think I was using Chromium at the time, though. :-/

I had a lot of time to work on VladNput today so I went ahead and put license headers on everything except the .tokens files, but there are exactly three of those and that probably won't change over the lifetime of the project. I've put the notice about those into the README.

I've also updated the README with details about the dependencies and their licenses.

I've updated my build script to put license information into the generated jar files and the dist.properties file.

Thus, now all files have license and copyright info whether they come from git or a release tar.

I will send the update VladNput-0.1.4.tar.gz file to you in email (you can ignore the version I sent earlier today).

Thanks for reviewing this for me!

Patrick Higgins <patrick133t>
Tue 08 Dec 2009 01:59:08 AM UTC, comment #12: 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

December 7th 2009 in GNU Savannah item 9873: "Submission of VladNput"

>Sorry, I had written a long response last week and then accidentally
>closed my browser window before I could post it. (Ugh!) I haven't had
>time to write it again until now.


Oh, it's a pity than you loose your long response. I have happen a
couple of times to me. In Fire Fox (Or derivated like IceCat or
IceWeasel) you can go to Historial -> Recently closed pages, then
you click the appropiate one, FF reminds the text in text box :).

>I have not yet written any code to automatically add copyright and
>license information to individual files.


>That way I don't have to manually maintain the README file every time
>I add a new source file.


>Of course, that means that files will not have those notices in git,
>only in the distribution tar files. Is that acceptable?


AFIK public GIT counts as distribution since the code will then be
publicly available through anonymous access, therefore same conditions
apply.

So yes, AFAIR you should maintain README and licence notices up to
date. For be sure write your question to licencing@gnu.org.

Usually one add the copy-permissions to the hand writen files at
creation time. At least I do it in that way. For auto generated files
remember if it is too hard to make the generation program put the
copy-permissions you can instead list it in the README file.

>The upload failed because my tar file is too large. I've gone ahead
>and added a target to my build.xml to create the README file when
>building a distribution tar file.


You try to compress it with bzip2 -9?.

Well, anyway you can send the tarball to me
<mariocastelancastro@gmail.com>. I will evaluate it an resent to
-email is unavailable- so an administrator can do an final
review.

Regards.

Item status changes:

Status -> In progress.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEAREIAAYFAksdstUACgkQZ4DA0TLic4gycgCdHRWaXNNU74nB0lQ34zMBquC4
w4UAnR4AiQk70V9UeucGqa23iFX4l8/V
=RtaZ
-----END PGP SIGNATURE-----

Mario Castelán Castro <marioxcc>
Tue 08 Dec 2009 01:26:17 AM UTC, comment #11: 

The upload failed because my tar file is too large. I've gone ahead and added a target to my build.xml to create the README file when building a distribution tar file.

I have not yet written any code to automatically add copyright and license information to individual files.

Patrick Higgins <patrick133t>
Tue 08 Dec 2009 01:22:01 AM UTC, comment #10: 

Sorry, I had written a long response last week and then accidentally closed my browser window before I could post it. (Ugh!) I haven't had time to write it again until now.

The upload link says it restricts file sizes to 512kb, which is too small for my code. I'll try to upload anyway and see how it goes.

I was thinking I could add some code to my "ant dist" build target to automatically generate the file list for the README and to put copyright and license notices on all the files that accept them.

That way I don't have to manually maintain the README file every time I add a new source file.

Of course, that means that files will not have those notices in git, only in the distribution tar files. Is that acceptable?

Patrick Higgins <patrick133t>
Mon 07 Dec 2009 10:16:57 PM UTC, comment #9: 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

December 7th 2009 in GNU Savannah item 9873: "Submission of VladNput"

Hi, I am waiting than you upload a new tarball with all the changes
applied if all is ok and hosting requirements are meet VladNput will
be approved.

If within one week I still do not get a reply, I will remove your
project. You will still be able to register it again once you have the
time to deal with the registration issues.

Are you still willing to host your project at Savannah? If not, please
tell us - we don't bite, and it will make us gain time.

Regards.

Item status changes:

Percent complete -> 80%
Status -> Ping-ed
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEAREIAAYFAksdfskACgkQZ4DA0TLic4hhKQCcCTcvgl3NtXoAgrvwtLZkwljb
2+QAnR07I5o2NV9bsp8qyXsk+19ypuDC
=dBgn
-----END PGP SIGNATURE-----

Mario Castelán Castro <marioxcc>
Thu 03 Dec 2009 12:56:34 AM UTC, comment #8: 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

December 2nd 2009 in GNU Savannah item 9873: "Submission of VladNput"

You can find an form to upload files at the end of this tracker
(Section Attached Files https://savannah.gnu.org/task/?9873#attached).

Update and upload your tarball with the following changes so we can
approve the project if all is ok or comment with your the nessesary
changes (Like we are doing currently):

The clearest the better: README file should enumerate all the files
unless there is a good reason for not do so.

On a GNU box you can easily generate the list of files with the "find"
command: On the VladNput root directory run:

find -name "*.req"
find -name "*.expect"
find -name "*.properties"
find -name "*.tokens"
find -name "*.vlad"
find -name "*.vladi"

Then put this in the README file:

The following files are part of VladNput:

<HERE THE LIST GENERATED BY THE 6 ABOVE COMMANDS>

VladNput is free software: you can redistribute it and/or modify it
under the terms of the GNU Lesser General Public License as published
by the Free Software Foundation, either version 2.1 of the License, or
(at your option) any later version.

VladNput is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public
License along with VladNput. If not, see
<http://www.gnu.org/licenses/>.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEAREIAAYFAksXDKEACgkQZ4DA0TLic4hibQCfeiZR49vJN0jOlaz6F89aayAC
65EAnieLMwvfoM1w+TKDAp6Jp+xP1b55
=b+jS
-----END PGP SIGNATURE-----

Mario Castelán Castro <marioxcc>
Tue 01 Dec 2009 01:06:23 AM UTC, comment #7: 

The code generation program is ANTLR, which is an external project.

I have added a README and INSTALL file. I have not found a way to upload an updated tar file. Is there one?

In the mean time, here is the contents of the README file. Is this acceptable?

This file is part of VladNput, an input validation framework for
applications using the Java servlet API.

VladNput is free software: you can redistribute it and/or modify it
under the terms of the GNU Lesser General Public License as published
by the Free Software Foundation, either version 2.1 of the License, or
(at your option) any later version.

VladNput is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public
License along with VladNput.  If not, see
<http://www.gnu.org/licenses/>.

There are some files in the VladNput distribution that do not contain
copyright notices. These files typically do not allow comments and
thus cannot contain such notices.

All files with a .req, .expect, .properties, .tokens, .vlad, or .vladi
extension are copyright 2009 Patrick Higgins. They are licensed under
the GNU LGPL version 2.1 or any later version.

Patrick Higgins <patrick133t>
Thu 26 Nov 2009 04:07:13 AM UTC, comment #6: 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

November 25th 2009 in GNU Savannah item 9873: "Submission of VladNput"

All distributed files should carry the Copyright and licence notice,
even if they are auto generated.

Make the generation program to put the licencing information in
genrated files. If they can't carry comments just enumerate the files,
their licence notices and Copyright holder in a file README.

Item status changes:

Status -> In progress.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEAREIAAYFAksN/tIACgkQZ4DA0TLic4hXmgCbBpYo7nzWzL224k9G1UTapFZl
ngUAn0AMsFu/W/ZXiW5lMKtiqjKBxCcf
=4SFQ
-----END PGP SIGNATURE-----

Mario Castelán Castro <marioxcc>
Mon 23 Nov 2009 09:56:17 PM UTC, comment #5: 

Hi Patrick,

we have been following the items on the tracker all the time. But we agreed with Mario's assessments, therefore we didn't write extra comments. :)
Sorry.

But in the meantime Mario has joined our staff anyway.

Sebastian Gerhardt <sgerhardt>
Mon 23 Nov 2009 09:31:04 PM UTC, comment #4: 

I hadn't responded because I didn't think there was any response needed. I thought you said you were not an administrator so I was waiting to see if an administrator would respond. The .tokens files are generated by ANTLR from the .g files and *.expect files are the expected results from running regression tests, so they are basically automatically generated files, too. I don't care to put any notices about copyright on them because they are computer generated.

The only thing I really need to complete is the documentation on the configuration language, but I have been busy and have not gotten around to it yet.

Is there anything else I need to do?

I would still like to use Savannah to host VladNput, I'm just concerned that I have not heard from any admins yet.

Patrick Higgins <patrick133t>
Mon 23 Nov 2009 12:49:38 AM UTC, comment #3: 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

November 22th in Savannah item #9873: "Submission of VladNput"

I am waiting for an answer from you.

If within one week I still do not get a reply, I will remove your
project. You will still be able to register it again once you have the
time to deal with the registration issues.

Are you still willing to host your project at Savannah? If not, please
tell us - we don't bite, and it will make us gain time.

Regards.

Item Status changes:

Status -> Ping-ed
Assigned to -> marioxcc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEAREIAAYFAksJ284ACgkQZ4DA0TLic4g5+ACeMMgSYRa0uV1phKVWWPC7k1oG
VrgAn3Oj0lCE2Wk9TJOmQ7oef+UKoo//
=h0z5
-----END PGP SIGNATURE-----

Mario Castelán Castro <marioxcc>
Sun 08 Nov 2009 04:34:28 AM UTC, comment #2: 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

November 7th in Savannah item #9873: "Submission of VladNput"

You should response using the web interface
https://savannah.gnu.org/task/index.php?9873 or write to
-email is unavailable- but usally simply cliking in reply in
an email client will send the response to -email is unavailable- and
your e-letter is simply discarded.

AFIK OpenJDK is free software too so if your program compiles and run
under it the Java issue is solved.

Maybe the .expect and .tokens files can be considered trivial and
therefore will not need trival notices but i are unsure. Some
administrator can help in this issue?. Anyway a README files than list
that .expect and .tokens files and say than they are under the LGPL
2.1 (Or 3 if you upgrade) will solve this.

I ignore the practical differences between LGPL 2.1+ and LGPL 3+ but i
are sure than the FSF have a good reason to publish that new
version. There is some reason to use the version 2.1 instead of the
latest, the 3.0?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkr2SkEACgkQZ4DA0TLic4ixHACfWeP7cSj3lJNxE5MTrX6DYnk6
hAcAoIrK4FjWj7D/cM27T3rFlDUbAvVx
=izSU
-----END PGP SIGNATURE-----

Mario Castelán Castro <marioxcc>
Fri 06 Nov 2009 01:40:11 AM UTC, comment #1: 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

November 5th in Savannah item #9873: "Submission of VladNput"

You must determine whether your project can run on a Free Software
Java suite (see https://savannah.gnu.org/maintenance/JavaIssues and
http://www.gnu.org/software/java/ for more information). It is
mandatory to run on a fully free platform to be hosted in Savannah.

We recommend you to test your project using IcedTea, or GCJ + GNU
Classpath, and ensure that your Java code runs on this Free Software
Java suite.

IceTea is based on Sun's OpenJDK and uses free replacements for its
proprietary parts. GCJ is the GNU Compiler for Java, part of the GCC
(GNU Compiler Collection). The Classpath project aims to develop a
free and portable implementation of the Java API (the classes in the
'java' package).

More information is available at http://icedtea.classpath.org/,
http://gcc.gnu.org/ and http://www.gnu.org/software/classpath/.

Please provide us with more information about this point.

Also, plese put and update (To LGPL 3 "or any later") the appropiate
licence notiches on all files. A lot of files (.expect, .tokens,
*.vlad, etc...) lacks Copyrigth information.

Note that I am not a member of the Savannah administration team. I
only try to help you to fix the remaining issues in this project
submission that I could find. If all hosting requirements for Savannah
are met, an administrator will approve this submission.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkrzfgMACgkQZ4DA0TLic4gNzQCcDVuH/IBAWQ90RfJB5MkBUnoc
7rAAnjZP7COLjsez6laBhNamPPdUUdJV
=mkhb
-----END PGP SIGNATURE-----

Mario Castelán Castro <marioxcc>
Thu 05 Nov 2009 11:31:04 PM UTC, original submission:  

A new project has been registered at Savannah
This project account will remain inactive until a site admin approves or discards the registration.


Registration Administration


While this item will be useful to track the registration process, approving or discarding the registration must be done using the specific Group Administration page, accessible only to site administrators, effectively logged as site administrators (superuser):



Registration Details


  • Name: VladNput
  • System Name:  vladnput
  • Type: non-GNU software & documentation
  • License: GNU Lesser General Public License





Description:

VladNput is an HTTP request validation library for the Java programming language. It is intended to be used to help secure Java web applications written to the Java servlet specification. The library allows a white list of URLs and request parameter names to be defined in a file external or internal to the application. The URLs and parameter names can be expressed as literals or regular expressions for more flexibility. The data types that incoming parameter values are checked against can be defined as one of the pre-defined types or the user can subclass VladType to define their own. For parameter values that violate the policy, an error message will be logged and the application is provided a list of the errors and detailed messages for display to the client. All error messages can be specified in the configuration file if the defaults are not acceptable.


Other Software Required:

ANTLR: BSD http://www.antlr.org/license.html
Log4j: ASL 2.0 http://logging.apache.org/log4j/1.2/license.html
Servlet API: ASL 2.0 http://tomcat.apache.org/



Tarball URL:

http://savannah.gnu.org/submissions_uploads/VladNput-0.1.tar.gz


Patrick Higgins <patrick133t>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #19231:  VladNput-0.1.4.tar.gz.part2 added by marioxcc (372KiB - application/octet-stream)
file #19230:  VladNput-0.1.4.tar.gz.part1 added by marioxcc (488KiB - application/octet-stream - Join with cat command, they are splited to pass the upload limite)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nicalvaro (Posted a comment)
  • -email is unavailable- added by marioxcc (Posted a comment)
  • -email is unavailable- added by patrick133t (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 13 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-12-13 nicalvaro StatusNeed Admin Done
        Percent Complete90% 100%
        Open/ClosedOpen Closed
    2009-12-09 marioxcc Attached File- Added VladNput-0.1.4.tar.gz.part2, #19231
    2009-12-09 marioxcc Attached File- Added VladNput-0.1.4.tar.gz.part1, #19230
    2009-12-09 marioxcc StatusIn Progress Need Admin
        Percent Complete80% 90%
    2009-12-08 marioxcc StatusPing-ed In Progress
    2009-12-07 marioxcc StatusIn Progress Ping-ed
        Percent Complete0% 80%
    2009-11-26 marioxcc StatusPing-ed In Progress
    2009-11-23 marioxcc StatusNone Ping-ed
        Assigned toNone marioxcc

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code