Weekly Edition
Return to the Front pageSponsored link
Vyatta –
Linux & Open Source
Alternative to Cisco –
Advanced Routing,
Firewall, VPN, QoS..
Free Download ->
| |||||||||||
How Sun's Java got into Debian
One of the comments posted on last week's article about the Java
license change asked: how can Debian distribute Sun's Java under the
new license? A number of clauses, including the requirement that Java be
distributed with the operating system and the restrictions on shipping Java
"in conjunction with" alternative implementations, would seem to rule out a
Debian Java package. It turns out that a number of Debian developers are
wondering the same thing; in addition, there are questions about the
process that was involved. Sun's Java was fast-tracked into non-free, with
the traditional extended debate on debian-legal having been shorted out
entirely. Since Debian does very few things without enduring a public
brawl first, the addition of Java without discussion raised some eyebrows.
Various people have tried to answer the resulting questions. The definitive word, perhaps, comes from Debian Project Leader Anthony Towns:
There are three factors that are particularly relevant: the first
is Sun's intentions and ability and interest to work with us as a
proxy for the broader free software community -- this is an
important issue because it ensures that we can resolve any problems
with the license, and reduces the concern that Sun will try to
screw us over, as it would become a PR problem rather than just a
quiet argument on the lists;
There is a point here: Sun has been very public about how happy it is about Debian's inclusion of Java. For the company to suddenly say that it isn't happy after all would be a big, public turnaround and would invite a fair amount of criticism. There would have to be a big reason for Sun to make such a move. Anthony continues:
the second is that both the legal principle of estoppel and the
general common sense principle of not going back on your word if
you want people to work with you prevents Sun from realistically
saying "the FAQ is completely wrong and should be ignored";
The DLJ FAQ does, indeed, make a lot of encouraging noises about what the license terms really mean. It says, for example, that there is no problem with shipping other Java implementations. The FAQ leads off with this rather less encouraging text, however:
Note: This FAQ is provided to help explain the Operating System
Distributor License for Java; nothing in this FAQ is intended to
amend the license, so please consult the license itself for the
precise terms and conditions that actually apply.
This is the text that makes many Debian developers say that the FAQ is irrelevant and should be ignored. It may well be that Sun has, by way of estoppel, blocked itself from a rigorous enforcement of the license terms by publishing this FAQ, but that is a question which cannot be definitively answered outside of a courtroom - and, even then, the answer only applies to one jurisdiction. Finally:
and the third aspect, which is probably most important, is that
should any of these problems actually happen, we can fairly simply
just drop Sun Java from non-free if we can't come to a better
conclusion.
So, if things go wrong, Debian can just stop distributing Java and the problems go away. These arguments all make sense, but there is something important which should be noted about them: they are arguments of convenience. They could be loosely paraphrased as "it looks like we can get away with it, and, if that turns out not to be true, we'll just stop." Debian, however, has never been about convenience - the project is far more concerned with freedom and doing the right thing. Distributing software in a way which does not comply with its license is very much counter to the way the Debian Project works - even if it looks like the act would go unpunished. But there is little in Anthony's response saying that Debian is truly compliant with the Distributor License for Java. Sun employee Tom Marble has argued that there is no conflict between Debian and the DLJ. Like Anthony, he refers to the FAQ, but without addressing the text in the FAQ itself directing people to the license for the "precise terms and conditions." With regard to alternative technologies, Tom says:
From FAQ #8, "there is nothing in the DLJ intended to prevent you
from shipping alternative technologies with your OS distribution."
When I say mix and match I mean please don't take bits from the
alternate technologies (see above) and put them into use with the
Java platform (e.g. replace rt.jar which is part of the platform
with an alternate rt.jar). In a similar way please don't take bits
from the Java platform and use them as part of or to complete
alternate technologies (e.g. plugin.jar).
This could be a reasonable interpretation of the license, though it would be much nicer if the license expressed these terms directly. Anybody who finds this argument to be a suitably convincing and binding statement of the intent of the license can, perhaps, conclude that Debian's distribution of Java in non-free is compliant with that license. Of course, some of the other terms, having to do with choice of venue for legal disputes, export restrictions, and indemnification of Sun, may still be problematic for a number of Debian developers. Regardless of whether one believes that Debian's distribution of Java is compliant, there is still the question of process: why was the Debian community not involved in the decision? The answer is straightforward: all of the relevant information was under embargo until Sun made its announcement at JavaOne. The only way for Debian to have a Java package when Sun announced - and for Sun to announce that said package existed - was for the process to happen in secret. So the new license was examined privately by Anthony Towns, James Troup, and Jeroen van Wolffalaar, and all three pronounced it to be acceptable. Michael Banck had an interesting take on this process:
I think this was somewhat similar to the embargoed security
releases our security team handles for us. Sure we could just have
disclosed the license to -legal beforehand, but then Sun probably
would never talk to us about doing things like this one again and
just tend to OpenSUSE or some other community distribution next
time to collaborate with when they might open source Java.
So Debian, by cooperating with Sun on the disclosure of information, was able to be a part of the initial PR splash. A question which has not been asked - in public, at least - is: just how does Debian benefit from participating in Sun's PR experience, and is it worth the cost of bypassing the usual public discussion? (Log in to post comments)
How Sun's Java got into Debian Posted May 25, 2006 2:01 UTC (Thu) by joey (subscriber, #328) [Link] > Sun's Java was fast-tracked into non-free, with the traditional> extended debate on debian-legal having been shorted out entirely.
That's a mighty thin wire to hang an article on. It's traditional for new licences for potentially DFSG-free software targeted at Debian main to be hammered on in debian-legal first, but the process is much less stringent for packages going into non-free, and -legal is generally bypassed altogether in these cases unless there's some question about the redistributability of the software.
For example, when I uploaded the uqm-content package to non-free, I don't recall asking debian-legal for their opinion of its clearly non-free license. I did rely on the ftp-masters (James Troup, et al) to review the license and make sure they were ok with it being distributed by Debian mirrors in non-free. This seems much the same as how the java thing was handled, minus the publicity that surrounds java as a proprietary product backed by PR.
Come on... Posted May 25, 2006 3:09 UTC (Thu) by error27 (subscriber, #8346) [Link] Comparing uqm-content with java is pretty bogus. You know Corbet is right that Debian traditionally would debate the java license endlessly.
They still are going to in fact. See if I'm wrong.
Come on... Posted Jun 1, 2006 23:39 UTC (Thu) by wolfrider (guest, #3105) [Link] --My take on it is this:
o Debian "traditionally" debates things endlessly, and Things Don't Get Done in a Timely Manner as a result.
o The Duly Elected Head Honchos were approached by Sun, short-circuited the debate after examining the circumstances, and now Debian has the right to distribute Java from Sun.
--I'm not seeing a Downside here... ;-)
How Sun's Java got into Debian Posted May 25, 2006 17:30 UTC (Thu) by slef (subscriber, #14720) [Link] Most licences are obvious enough not to refer to debian-legal, even non-free ones like uqm-content, but the DLJ one is clearly not obvious. You can tell just by looking at the size of the non-binding FAQ. It's a confusion of lawyerbombs and indemnifications, in my opinion.
I think this short-cutting of debian's usual good practices is a fair topic for an LWN article. Good, even. The more pressure on debian to sort this out, the better.
What does Debian gain from being in Sun's proprietary software PR? A bad name in free software circles, confusion among wider IT circles ("does this mean debian includes proprietary software, or that debian considers Java free software?"), a reputation for accepting NDAs and RMS criticising us deservedly. Deep joy.
Meanwhile, DPL Anthony Towns reacts by trying to cut down discussion (again), criticising free software supporters and writing that Java is important but free software Java implementations aren't effective...
How Sun's Java got into Debian Posted May 26, 2006 18:06 UTC (Fri) by pimlott (subscriber, #1535) [Link] What does Debian gain from being in Sun's proprietary software PR?While non-free has indeed long been a source of confusion, Debian made a decision in the beginning that user convenience trumps the confusion and moral taint. Sun's Java is nothing new in this sense--except that its convenience value is particularly high. (Yes, I say this as someone who, reluctantly, has this program on some of my computers.) reputation for accepting NDAsNDA's are not uniformly evil. Temporary secrecy, even for PR purposes, may sometimes be acceptible. As Michael Banck pointed out, the security team does something similar all the time. RMS criticising us deservedlyRMS has always criticised non-free, citing it as the reason he doesn't endorse Debian. Sun's Java in non-free doesn't give him any new arguments. Meanwhile, DPL Anthony Towns reacts by trying to cut down discussion (again), criticising free software supporters and writing that Java is important but free software Java implementations aren't effective...I think you're overreacting. Anthony Towns is encouraging people (from Debian and Sun) to discuss this on -legal, and I can't find him criticizing anyone (quite unusual for a Debian discussion!). And I really think it's unfair to imply that Anthony Towns is not a true "free software supporter". To your last point, he said that free implementations aren't effective as a replacement for Sun's Java, not that they aren't effective in general. It's hard to dispute this.
How Sun's Java got into Debian Posted May 26, 2006 18:28 UTC (Fri) by slef (subscriber, #14720) [Link] I really think it's unfair to suggest that I implied stuff about Anthony Towns. Read his article. His "bad" scare quotes and comments about other Java implementations are there. Decide for yourself. Maybe I'm overreacting given other stuff he's done, as DPL and before, but that should be understandable.
If the free Java implementations aren't effective replacements, why does so much Java software seem to run on them now? It seems quite easy to dispute it, but I'm no Java fan.
I can't see how PR is an acceptable reason for secrecy. Security secrecy helps our users. PR secrecy helps Sun and it seems this time it screws our users by giving a false impression of safety of the DLJ. Not the same thing at all.
How Sun's Java got into Debian Posted May 26, 2006 19:53 UTC (Fri) by pimlott (subscriber, #1535) [Link] If you didn't mean to imply that aj is not a "free software supporter", then I retract that, though that is how I read it. However, I can't find anything objectionable in what he wrote. You made some pretty strong changes for which I don't see evidence. (If you had just said aj can be a jerk, I would have let it go.)If the free Java implementations aren't effective replacements, why does so much Java software seem to run on them now?In general, only Java software that has been "ported" to GCJ or whatever runs. Since much software (especially non-free) hasn't been ported, it usually doesn't run without hacking. This makes GCJ not an effective replacement. As a more concrete test, try viewing a random web page with an embedded applet using a free appletviewer. PR secrecy helps Sun and it seems this time it screws our users by giving a false impression of safety of the DLJ.The standard disclaimer for software in non-free is that the only thing you should conclude is that Debian can get away with distributing it. No implied freedom to use it in a jurisdiction or for a purpose, to redistribute verbatim, etc. Presence in non-free is not much of an endorsement.
Improving the free stack Posted May 28, 2006 12:15 UTC (Sun) by mjw (subscriber, #16740) [Link] In general, only Java software that has been "ported" to GCJ or whatever runs. Since much software (especially non-free) hasn't been ported, it usually doesn't run without hacking.At least for free software this is mostly untrue now, no "porting" should be needed, if there is, that is just a bug. Just see http://wiki.debian.org/Java/AlreadyMovedToMain It is probably fair to say that Sun wanted their non-free packages included now because so many packages can these days be build and used on a completely free stack without any need for Sun proprietary code anymore. As a more concrete test, try viewing a random web page with an embedded applet using a free appletviewer.If you find such any applet that doesn't yet work please do add it to the GNU Classpath applets page http://developer.classpath.org/mediation/Applets and if it really doesn't work at the moment we will make sure it works soon.
Improving the free stack Posted May 28, 2006 15:22 UTC (Sun) by pimlott (subscriber, #1535) [Link] Awesome, it gets better all the time! I would still tend to back up aj's statement, because I have almost always had to do some fiddling to get my development infrastructure working with gcj, especially when it involves proprietary code. I'm willing to do that, but I could understand that for some people, it might not be worth it. This is not a judgement on the merit of gcj or classpath (or anything else) per se (I much prefer them to the proprietary alternatives!), just why they may not be "effective replacements" for everyone.
Improving the free stack Posted May 29, 2006 16:57 UTC (Mon) by slef (subscriber, #14720) [Link] Unsurprisingly, buggy proprietary code may not work on some implementations or platforms.
It seems that free software Java is an effective replacement on a free software operating system, which makes that statement by the *Debian* project leader somewhat disappointing.
How Sun's Java got into Debian Posted May 28, 2006 22:32 UTC (Sun) by pimlott (subscriber, #1535) [Link] What does Debian gain from being in Sun's proprietary software PR?I see that I read this too quickly the first time around. I thought you were asking how Debian benefits from Sun's proprietary software being in non-free, not how Debian benefits from being included in the publicity for their proprietary software. I agree that if Debian developers, including the project leader, avoided public discussion just to appear in print next to Sun, that would be rather unseemly. But the PR may have been just a side effect of the license negotiation: Sun didn't want to go public without a license, but Sun and Debian both had an interest in the license being acceptible for non-free, so they agreed to hammer it out in closed discussions. After that, the coordinated launch and joint press release come for free. You might still object that publicity over proprietary software is not in line with Debian's principles. I think this is a deep and difficult question. One way to look at this is as a public affirmation that Debian indeed supports users who "require the use of works that do not conform to the Debian Free Software Guidelines". On the other hand, you could argue that supporting is one thing, hyping is another.
How Sun's Java got into Debian Posted May 30, 2006 10:09 UTC (Tue) by ballombe (subscriber, #9523) [Link] > For example, when I uploaded the uqm-content package to non-free, I don't recall asking debian-legal for their opinion of its clearly non-free license.
You do not recall, but you actually did the right thing: you properly RTP/ITPed it mentionning the license issue, see the RFP #171314 <http://bugs.debian.org/171314>.
If no one decided to discuss the license on debian-legal, it was
How ignorance is truth Posted May 25, 2006 3:23 UTC (Thu) by bignose (subscriber, #40) [Link] > all of the relevant information was under embargo until Sun made its> announcement at JavaOne. The only way for Debian to have a Java package > when Sun announced - and for Sun to announce that said package existed - > was for the process to happen in secret.
What a complete non-sequitur. Why is process secrecy "the only way" for Debian to distribute a Java package? Why is process secrecy "the only way" for Sun to announce the existence of a package?
It's a totally disingenuous claim. Can we please see this explained and hopefully corrected in the article?
How ignorance is truth Posted May 25, 2006 3:44 UTC (Thu) by corbet (editor, #1) [Link] It was the only way to have a package when the announcement was made. Certainly they could have made one after the fact, but then they would not have been part of the spectacle.Sun, in turn, could have done things differently if it had wanted to, but I wasn't talking about Sun. They were just doing the usual corporate PR thing.
How ignorance is truth Posted May 25, 2006 5:29 UTC (Thu) by bignose (subscriber, #40) [Link] Thanks. The article's phrasing can easily lead a reader to believe that Sun's secret process is somehow necessary to getting the package into Debian *at all*, which is not the case.
How ignorance is truth Posted May 25, 2006 3:46 UTC (Thu) by thedevil (guest, #32913) [Link] Presumably because that was Sun's precondition for the whole thing to happen.
How non-free software is not in Debian Posted May 25, 2006 3:28 UTC (Thu) by bignose (subscriber, #40) [Link] While it makes for a catchy headline, it's simply not true to say that the Sun Java software is or was ever "in Debian".
The 'non-free' repository is *not* part of Debian; it's distributed from the same servers, as a service to users, but it's not "in Debian" since it's not part of the thing called Debian. Only the 'main' repository is "in Debian".
This is more than semantics: it's the leading point of the social contract that is the basis of the Debian project's work.
How non-free software is not in Debian Posted May 25, 2006 3:40 UTC (Thu) by JoeBuck (subscriber, #2330) [Link] But if non-free is not part of Debian, then non-free cannot ship Sun's Java. The license clearly states that it is permission to ship Java as part of an operating system. The Debian project cannot have it both ways.
How non-free software is not in Debian Posted May 25, 2006 5:37 UTC (Thu) by bignose (subscriber, #40) [Link] > But if non-free is not part of Debian, then non-free cannot ship Sun's> Java. The license clearly states that it is permission to ship Java as part > of an operating system.
Indeed, this issue was raised on the Debian discussion lists very soon after the announcement was made -- along with many other issues revealed by a less-hasty investigation of the license terms.
> The Debian project cannot have it both ways.
Yes. I don't think Debian can legally distribute the software (from anywhere) under the current license terms.
I sincerely hope *all* free software projects will learn from this. Rushing the process of investigating license terms, to meet some externally-imposed deadline, conflicts with the trust placed in the project by its users. It's not worth risking copyright infringement just to get some shiny bauble.
How non-free software is not in Debian Posted May 25, 2006 22:47 UTC (Thu) by paulmfoster (subscriber, #17313) [Link] Okay, let me get this straight. Debian engineers work on packaging these packages. They're hosted on the same servers as Debian, under the Debian hierarchy. They show up in aptitude. But they're not part of Debian. I dunno. It sure *sounds* like semantics to me.
How non-free software is not in Debian Posted May 27, 2006 9:09 UTC (Sat) by ajk (subscriber, #6607) [Link] That non-free is done by Debian developers and hosted on Debian servers but still "is not part of Debian" is nothing new. It is decade-old diplomatic fiction, a compromise between the faction that wanted Debian to be all free, and the faction that wanted Debian to ship useful software even if it was non-free. This compromise allowed both parties to save face. Nowadays it is an inseparable part of the Debian ethos, a fact of life.
Back then it was mostly about Netscape Navigator, as far as I know. Now it is about Java.
How Sun's Java got into Debian Posted May 25, 2006 4:57 UTC (Thu) by mgb (subscriber, #3226) [Link] > Sure we could just have disclosed the license to -legal beforehand,> but then Sun probably would never talk to us about doing things > like this one again
S: Wanna buy a bridge? I can get you a great deal. Only it's gotta
D: Can't I check with my attorney?
S: Sure. You can check with your attorney after you sign.
D: OK!
How Sun's Java got into Debian Posted May 25, 2006 7:06 UTC (Thu) by davidw (subscriber, #947) [Link] -legal is sort of a dubious resource in any case, as, last I checked, it was mostly amateurs - not legal professionals. While they may have the best of intentions and be smart people, not having a legal background is a big impediment to some legal discussions.
How Sun's Java got into Debian Posted May 25, 2006 15:51 UTC (Thu) by bronson (subscriber, #4806) [Link] True. However, -legal is a LOT better than the non-process that rammed Java into Debian without any meaningful license analysis at all.
How Sun's Java got into Debian Posted May 25, 2006 17:31 UTC (Thu) by mbanck (subscriber, #9035) [Link] True. However, -legal is a LOT better than the non-process that rammed Java into Debian without any meaningful license analysis at all.The license was reviewed by the person who usually reviews licenses for non-free - James Troup. Argueably, more review might not been a bad idea, but to say there was a non-process is totally false; in fact, I believe the correct process has been used. Michael
How Sun's Java got into Debian Posted May 25, 2006 21:29 UTC (Thu) by smitty_one_each (subscriber, #28989) [Link] Not sure why the legal system has to be so obscure that it requires "legal professionals" to understand it. Does the legal system serve us, or we it?
How Sun's Java got into Debian Posted May 27, 2006 22:28 UTC (Sat) by davidw (subscriber, #947) [Link] You may have a point, but unless the system changes, involving legal professionals in the legal review of licenses is a sensible thing to do.
You would hire a professional programmer to work with your source code, wouldn't you?
How Sun's Java got into Debian Posted May 25, 2006 13:04 UTC (Thu) by mjg59 (subscriber, #23239) [Link] > even then, the answer only applies to one jurisdiction.
Really? The license explicitly states that any action concerning the license will be covered by Californian or US federal law.
How Sun's Java got into Debian Posted May 26, 2006 21:08 UTC (Fri) by kleptog (subscriber, #1183) [Link] Yeah, but you're assuming that clause is enforcable too, which is debatable.
The more interesting clause, which wasn't meantioned at all in the article) is the one where Debian indemnifies Sun from any claim arising out of the Debian distributed version. So I imagine something like:
Company X: Oops, the JVM died on us, causing us millions in losses, lets sue Sun, see if we can get anything back.
Arguing the PR department will prevent this seems silly to me. It's the lawyers job to minimise risk and they'd be stupid not to use the above tactic to make a lawsuit go away...
How Sun's Java got into Debian Posted May 27, 2006 0:33 UTC (Sat) by giraffedata (subscriber, #1954) [Link] A legal technical correction: indemnity doesn't work that way. Company X still sues Sun; Sun then sues Debian (assuming Debian is a suable legal entity such as a corporation) for whatever Company X wins from Sun.
How Sun's Java got into Debian Posted Jun 5, 2006 21:38 UTC (Mon) by wookey (subscriber, #5501) [Link] Debian is not a legal entity. It has representative legal entities in various juristictions to look after (parts of) its money (SPI in the US, FFII in Europe, The Debian-UK Society in the UK), but Debian itself doesn't really have a legal existence you could sue.
"in conjunction" Posted May 25, 2006 14:35 UTC (Thu) by mattdm (subscriber, #18) [Link] [I posted something similar to this on the Fedora list...]
I think people concerned about the "in conjunction" phrase are misinterpretting. Remember, licenses are written in legalese, which is formed from English words but where the meaning of certain terms is determined by heaps of case law and precedent, not necessarily by the dictionary.
My assumption, given that Sun people say that this clause does not prevent distribution of the JDK _alongside_ GCJ etc., is that people are reading the phrase "in conjunction with" more strongly than it should be. A more narrow reading indicates that you can't use the Sun JVM with GNU Classpath, but you can use and distribute them both _not_ in conjunction.
But really, a lawyer needs to answer this question.
(The new license, by the way, is not helpful for Fedora, which is a pure Free Software distribution. Nor, of course, is it helpful for inclusion in actual Debian.)
How Sun's Java got into Debian Posted May 25, 2006 19:44 UTC (Thu) by zooko (subscriber, #2589) [Link] "They could be loosely paraphrased as "it looks like we can get away with it, and, if that turns out not to be true, we'll just stop.""
Maybe Debian should apply this principle to all of the distribution and not just to special deals from certain corporations. There is probably quite a lot of software and other content which could find its way into the next Debian release which has heretofore been excluded by excessive concern about legal what-ifs!
Regards,
Zooko
P.S. I'm halfway serious. Unless you're a pessimist in which case I'm halfway sarcastic.
As long as it's finally in, I'm happy Posted May 26, 2006 0:44 UTC (Fri) by kenyee (guest, #37992) [Link] As a user, I'm just happy I'm going to be able to do "apt-get install java" and have it get updated on dist-upgrades and it doesn't bother me one bit that it was added under cover of night to be part of a Sun PR event :-)
Up to now, people have had to try and figure out which version to download and install (made more complicated on the 64-bit Linux I'm running on because you have to decide whether to install Blackdown java, or Sun's 32-bit or 64-bit versions) and then it's their problem dealing for deciding on when to upgrade, etc. Anything to make this process less painful for Debian users is a plus in my book (and yeah, I use the Marillat archives for installing Myth, mplayer, and all the weird codecs that aren't part of the official Debian repos too...I just want the system to do what I want ;-)
Now, if Sun would just open source their Plugin so people can figure out how to get the 64-bit version of Java to run as a plugin in the 64-bit version of Mozilla so we don't have to run the 32-bit version of browsers in chroots....
As long as it's finally in, I'm happy (for how long?) Posted May 26, 2006 3:55 UTC (Fri) by jstAusr (guest, #27224) [Link] And that will work just fine until the freedom goes away because no one cared. Then, the system will only work the way the proprietary vendors want it to. At that point you won't be able to do a damn thing about it.
if the proprietary vendors start flexing their legal idiots Posted May 26, 2006 14:29 UTC (Fri) by kenyee (guest, #37992) [Link] just take the package out :-)
What "freedoms" could go away? I still don't get what the big deal is...the important thing for the next step in Linux evolution is to make it easier for users (which is probably why Ubuntu has been so successful, even though I disagree w/ forking the Debien code so I've installed Kanotix instead)...
As long as it's ... in, I'm [un]happy Posted May 26, 2006 21:02 UTC (Fri) by Max.Hyre (subscriber, #1054) [Link] I'd always understood that non-free comprised Free Software which depended on something non-free to operate.Sun's Java is outrageously not Free, and has no business in either the Debian distribution, or in mirrors hosted by Debian, ``in the distribution'' or not.
As long as it's ... in, I'm [un]happy Posted May 27, 2006 0:40 UTC (Sat) by giraffedata (subscriber, #1954) [Link] The description of non-free on Debian's web site, in its entirety, is: Packages in this area have some onerous license condition restricting use or redistribution of the software.
As long as it's ... in, I'm [un]happy Posted May 27, 2006 8:58 UTC (Sat) by ajk (subscriber, #6607) [Link] What you are thinking about is "contrib". Non-free is ... non-free.
|
|||||||||||