[gentoo-dev] Last rites: dev-java/oracle-{jre,jdk}-bin

[gentoo-dev] Last rites: dev-java/oracle-{jre,jdk}-bin

[Georgy Yakovlev]

[-- Attachment #1: Type: text/plain, Size: 523 bytes --]

# Georgy Yakovlev <gyakovlev@gentoo.org> (17 Apr 2019)
# The Oracle JDK License has changed for releases starting April 16, 2019
# While it may be fine to use for some usecases it's not comepletely clear
# what is considered "personal use" and if we can legally distribute it.
# License states:
# "You may not:
# make the Programs available in any manner to any third party"
#
# Alternatives: icedtea, icedtea-bin, openjdk, openjdk-bin, openjdk-jre-bin
# removal in 30 days
dev-java/oracle-jdk-bin
dev-java/oracle-jre-bin


[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-dev] Last rites: dev-java/oracle-{jre,jdk}-bin

[Mike Gilbert]

On Wed, Apr 17, 2019 at 3:35 PM Georgy Yakovlev <gyakovlev@gentoo.org> wrote:
>
> # Georgy Yakovlev <gyakovlev@gentoo.org> (17 Apr 2019)
> # The Oracle JDK License has changed for releases starting April 16, 2019
> # While it may be fine to use for some usecases it's not comepletely clear
> # what is considered "personal use" and if we can legally distribute it.
> # License states:
> # "You may not:
> # make the Programs available in any manner to any third party"

I don't agree with your rationale here.

Gentoo does not distribute the JDK due to RESTRICT="fetch mirror" in
the ebuild, so Oracle's license has no relevance.

Oracle cannot prohibit us from distributing a shell script that moves
some files around. That liability is on the user who runs it.

We cannot force you to continue maintaining this package, but I think
we should have a better reason for masking/removing it. If you cannot
provide one, please just drop this to maintainer-needed.

Re: [gentoo-dev] Last rites: dev-java/oracle-{jre,jdk}-bin

[Georgy Yakovlev]

[-- Attachment #1: Type: text/plain, Size: 2172 bytes --]

On Wednesday, April 17, 2019 6:31:42 PM PDT Mike Gilbert wrote:
> On Wed, Apr 17, 2019 at 3:35 PM Georgy Yakovlev <gyakovlev@gentoo.org> 
wrote:
> > # Georgy Yakovlev <gyakovlev@gentoo.org> (17 Apr 2019)
> > # The Oracle JDK License has changed for releases starting April 16, 2019
> > # While it may be fine to use for some usecases it's not comepletely clear
> > # what is considered "personal use" and if we can legally distribute it.
> > # License states:
> > # "You may not:
> > # make the Programs available in any manner to any third party"
> 
> I don't agree with your rationale here.
> 
> Gentoo does not distribute the JDK due to RESTRICT="fetch mirror" in
> the ebuild, so Oracle's license has no relevance.
> 
> Oracle cannot prohibit us from distributing a shell script that moves
> some files around. That liability is on the user who runs it.
> 
> We cannot force you to continue maintaining this package, but I think
> we should have a better reason for masking/removing it. If you cannot
> provide one, please just drop this to maintainer-needed.

I've modified the mask for now, but I still believe we should drop it.
I do not maintain it at all, I only work on openjdk and a bit of icedtea.

For a while[1] we've been modifying provided jar:

zip -d jre/lib/rt.jar sun/misc/PostVMInitHook.class || die

but license[2] states that

"You may not:
...
    make the Programs available in any manner to any third party
...
    create, modify, or change the behavior of, classes, interfaces, or 
subpackages that are in any way identified as "java", "javax", "sun", “oracle” 
or similar convention as specified by Oracle in any naming convention 
designation.

"

Is it even legal?

Java usage tracker will fail due to sandbox during builds.

while writing this email I found out it's probably possible to disable it with 
com.oracle.usagetracker.track.last.usage=false
in
 /etc/oracle/java/usagetracker.properties

need to test it

[1]https://bugs.gentoo.org/559936
[2]https://www.oracle.com/technetwork/java/javase/terms/license/javase-license.html


-- 
Georgy Yakovlev
Gentoo Linux Developer

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-dev] Last rites: dev-java/oracle-{jre,jdk}-bin

[Mike Gilbert]

On Wed, Apr 17, 2019 at 10:44 PM Georgy Yakovlev <gyakovlev@gentoo.org> wrote:
>
> On Wednesday, April 17, 2019 6:31:42 PM PDT Mike Gilbert wrote:
> > On Wed, Apr 17, 2019 at 3:35 PM Georgy Yakovlev <gyakovlev@gentoo.org>
> wrote:
> > > # Georgy Yakovlev <gyakovlev@gentoo.org> (17 Apr 2019)
> > > # The Oracle JDK License has changed for releases starting April 16, 2019
> > > # While it may be fine to use for some usecases it's not comepletely clear
> > > # what is considered "personal use" and if we can legally distribute it.
> > > # License states:
> > > # "You may not:
> > > # make the Programs available in any manner to any third party"
> >
> > I don't agree with your rationale here.
> >
> > Gentoo does not distribute the JDK due to RESTRICT="fetch mirror" in
> > the ebuild, so Oracle's license has no relevance.
> >
> > Oracle cannot prohibit us from distributing a shell script that moves
> > some files around. That liability is on the user who runs it.
> >
> > We cannot force you to continue maintaining this package, but I think
> > we should have a better reason for masking/removing it. If you cannot
> > provide one, please just drop this to maintainer-needed.
>
> I've modified the mask for now, but I still believe we should drop it.
> I do not maintain it at all, I only work on openjdk and a bit of icedtea.
>
> For a while[1] we've been modifying provided jar:
>
> zip -d jre/lib/rt.jar sun/misc/PostVMInitHook.class || die
>
> but license[2] states that
>
> "You may not:
> ...
>     make the Programs available in any manner to any third party
> ...
>     create, modify, or change the behavior of, classes, interfaces, or
> subpackages that are in any way identified as "java", "javax", "sun", “oracle”
> or similar convention as specified by Oracle in any naming convention
> designation.
>
> "
>
> Is it even legal?

That does seem like it might cause some legal problems for users.

> Java usage tracker will fail due to sandbox during builds.
>
> while writing this email I found out it's probably possible to disable it with
> com.oracle.usagetracker.track.last.usage=false
> in
>  /etc/oracle/java/usagetracker.properties
>
> need to test it

If that does not work, a possible alternative would be to install a
file in /etc/sandbox.d to add some path to SANDBOX_PREDICT.

Anyway, this issue does seem like grounds for removal if it is not
addressed by somebody.

Re: [gentoo-dev] Last rites: dev-java/oracle-{jre,jdk}-bin

[James Le Cuirot]

On 18 April 2019 16:56:16 BST, Mike Gilbert <floppym@gentoo.org> wrote:
>On Wed, Apr 17, 2019 at 10:44 PM Georgy Yakovlev <gyakovlev@gentoo.org>
>wrote:
>>
>> On Wednesday, April 17, 2019 6:31:42 PM PDT Mike Gilbert wrote:
>> > On Wed, Apr 17, 2019 at 3:35 PM Georgy Yakovlev
><gyakovlev@gentoo.org>
>> wrote:
>> > > # Georgy Yakovlev <gyakovlev@gentoo.org> (17 Apr 2019)
>> > > # The Oracle JDK License has changed for releases starting April
>16, 2019
>> > > # While it may be fine to use for some usecases it's not
>comepletely clear
>> > > # what is considered "personal use" and if we can legally
>distribute it.
>> > > # License states:
>> > > # "You may not:
>> > > # make the Programs available in any manner to any third party"
>> >
>> > I don't agree with your rationale here.
>> >
>> > Gentoo does not distribute the JDK due to RESTRICT="fetch mirror"
>in
>> > the ebuild, so Oracle's license has no relevance.
>> >
>> > Oracle cannot prohibit us from distributing a shell script that
>moves
>> > some files around. That liability is on the user who runs it.
>> >
>> > We cannot force you to continue maintaining this package, but I
>think
>> > we should have a better reason for masking/removing it. If you
>cannot
>> > provide one, please just drop this to maintainer-needed.
>>
>> I've modified the mask for now, but I still believe we should drop
>it.
>> I do not maintain it at all, I only work on openjdk and a bit of
>icedtea.
>>
>> For a while[1] we've been modifying provided jar:
>>
>> zip -d jre/lib/rt.jar sun/misc/PostVMInitHook.class || die
>>
>> but license[2] states that
>>
>> "You may not:
>> ...
>>     make the Programs available in any manner to any third party
>> ...
>>     create, modify, or change the behavior of, classes, interfaces,
>or
>> subpackages that are in any way identified as "java", "javax", "sun",
>“oracle”
>> or similar convention as specified by Oracle in any naming convention
>> designation.
>>
>> "
>>
>> Is it even legal?
>
>That does seem like it might cause some legal problems for users.
>
>> Java usage tracker will fail due to sandbox during builds.
>>
>> while writing this email I found out it's probably possible to
>disable it with
>> com.oracle.usagetracker.track.last.usage=false
>> in
>>  /etc/oracle/java/usagetracker.properties
>>
>> need to test it
>
>If that does not work, a possible alternative would be to install a
>file in /etc/sandbox.d to add some path to SANDBOX_PREDICT.
>
>Anyway, this issue does seem like grounds for removal if it is not
>addressed by somebody.

IIRC, SANDBOX_PREDICT doesn't really help in this case because it triggers on any package using Java within the home directory of the build user and the HOME environment variable isn't respected.
-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.

Re: [gentoo-dev] Last rites: dev-java/oracle-{jre,jdk}-bin

[Paul B. Henson]

On Wed, Apr 17, 2019 at 07:44:53PM -0700, Georgy Yakovlev wrote:

> I've modified the mask for now, but I still believe we should drop it.
> I do not maintain it at all, I only work on openjdk and a bit of icedtea.

Speaking of openjdk, all versions are masked and the ebuilds contain:

        if use gentoo-vm ; then
                ewarn "WARNING! You have enabled the gentoo-vm USE flag, making this JDK"
                ewarn "recognised by the system. This will almost certainly break things."
        else

When will openjdk be a viable vm? As you say, the Oracle license is screwy
now, and icedtea isn't really current.

Thanks...

Re: [gentoo-dev] Last rites: dev-java/oracle-{jre,jdk}-bin

[James Le Cuirot]

On 18 April 2019 02:31:42 BST, Mike Gilbert <floppym@gentoo.org> wrote:
>On Wed, Apr 17, 2019 at 3:35 PM Georgy Yakovlev <gyakovlev@gentoo.org>
>wrote:
>>
>> # Georgy Yakovlev <gyakovlev@gentoo.org> (17 Apr 2019)
>> # The Oracle JDK License has changed for releases starting April 16,
>2019
>> # While it may be fine to use for some usecases it's not comepletely
>clear
>> # what is considered "personal use" and if we can legally distribute
>it.
>> # License states:
>> # "You may not:
>> # make the Programs available in any manner to any third party"
>
>I don't agree with your rationale here.
>
>Gentoo does not distribute the JDK due to RESTRICT="fetch mirror" in
>the ebuild, so Oracle's license has no relevance.
>
>Oracle cannot prohibit us from distributing a shell script that moves
>some files around. That liability is on the user who runs it.
>
>We cannot force you to continue maintaining this package, but I think
>we should have a better reason for masking/removing it. If you cannot
>provide one, please just drop this to maintainer-needed.

While I was overjoyed to see this mask, this is a fair point. I had previously been under the impression that Oracle wasn't even going to provide their own builds anymore, giving way to OpenJDK, but I guess that's not the plan now, if it ever was. It doesn't seem like a very Oracle thing to do.
-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.