New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue closed: LGPL license #18

Closed
amedee opened this Issue Feb 15, 2017 · 1 comment

Comments

Projects
None yet
1 participant
@amedee

amedee commented Feb 15, 2017

The readme says that this fork is based on iText 4, but to be precise:

  • iText 2.1.7 (7 Jul 2009) was the last MPL/LGPL release by iText Software.
  • 4.2.0 was an internal SVN tag, used to sync up versions between iText (Java) and iTextSharp (.NET). The latter was at 4.1.6 at that point. However, iText Software never released a build based on the 4.2.0 tag. It was a mid-development construct and the software wasn't guaranteed to be stable at that point. When iText migrated from SVN to Git, some technical constructs were cleaned up (by me personally, see full disclosure below), including the internal 4.2.0 tag. As far as iText Software concerns, there never was a release of "iText 4".
  • iText 5.0.0 (8 December 2009) was the first AGPL release by iText Software.
  • On 31 August 2010, GitHub user ymasory uploaded a version of iText "MPL/LGPL" to Github. It is unclear if this was based on 2.1.7 or on 2.1.7-59-g935969371a. They did not accept pull requests or did any other development.
  • On 19 September 2012, a now-defunct New York software startup called InProTopia Corporation (as far as I can tell, founded by a student of the Columbia University) took ymasory's repo and used that to upload a Maven build of "iText 4.2.0" and "iText 4.2.1" to Maven Central. However, they used (or hijacked?) com.lowagie as GroupId, which they were not allowed to do according to Apache's Guide to uploading artifacts to the Central Repository. This is explained in a blog post on iText's website: http://itextpdf.com/maven-update-problem-with-itext-4.2.2. See also this Stack Overflow answer: http://stackoverflow.com/a/14213851/766786
  • For clarity of this overview, I skipped some of the intermediate forks.

Conclusion: this project should do it's due diligence and make absolutely sure what it is based upon: is it iText 2.1.7 or is it iText 2.1.7-59-g935969371a? I don't want to sound like I'm spreading FUD, but you need to make absolutely sure that your users aren't in uncharted territory.

As a side note (maybe this should be a separate issue?), if you ever plan to upload to Maven Central, then you need to change every reference to com.lowagie to something else, as described in the link above.

I recommend that you contact Software Freedom Conservancy for legal and technical advice. They have extensive experience with community developers taking over an Open Source project after a license change.

Full disclosure: I am QA & Release Engineer at iText Software, but I've been an Open Source user & advocate since decades before I joined iText Software. From a personal point of view, I wish this project good luck because it is 8 years behind in development. The fact that I took considerable time to do my research for this issue, should give you a clue that I don't want to intentionally harm this project. From a professional point of view, I welcome the competition. It keeps us on edge. :-)

@ghost ghost closed this Feb 15, 2017

@LibrePDF LibrePDF locked and limited conversation to collaborators Feb 15, 2017

@ghost

This comment has been minimized.

@ghost ghost changed the title from Exact iText commit this project is based on to Issue closed: LGPL license Feb 15, 2017

This issue was closed.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.