NETBEANS-1499 - change package.json icon

[Chris2011]

This PR will change the generic js icon for a specific file (package.json) with a specific mimetype (text/package+x-json) to the logo of npm, to make it more prominent.

Before merging, we have to check the licenses of the npm logo: https://www.npmjs.com/policies/trademark. I wrote them an e-mail, will let you know whether it is ok or not. Maybe a license guy can help here too.

This logo is also used inside of a VS Code plugin for better icons for specific filetypes.

[emilianbold]

Seems to me the PR does more than just change an icon.

[Chris2011]

@emilianbold yes, I had to create a DataObject for the file to set a different icon. Otherwise it wont work. Or maybe I didn't know any other solution, maybe there is another one :). But it seems that I can't use it, I'm in contact with the tech support for npm. Will let you know.

[Chris2011]

Today I got the permission to use the npm logo:

Hi, Chris! Sorry for the delay. I wanted to loop our trademark and copyright counsel in on this, just to make sure I wasn't doing something dumb :)

The Apache Netbeans IDE has asked for permission to use the npm logo to represent the filetype of files named "package.json" and "package-lock.json" in the IDE. Thanks for asking, and yes, you have our permission to do so. You also linked the logo at https://github.com/vscode-icons/vscode-icons/blob/master/icons/file_type_npm.svg, which is the icon that you may use.
Thanks for your patience and for reaching out to us about this matter. Looking forward to seeing the npm logo in Netbeans :)

Cheers!

So pleaes have a look and leave comments.

[Chris2011]

Summerize:

• Created a new DataObject for "package.json" called PackageJsonDataObject to add a new file icon.
• Removed old layer.xml file
• Moved annotation for MimeResolver from PackageJson.java to PackageJsonDataObject.java
• Added the npm icon to the code. I got the permission to use it.

Let me know, if anything is still unclear.

[Chris2011]

Here you can see the result:

[aalvrz]

I am not very familiar with JavaScript package managers, but isn't package.json also used by other package managers such as Yarn?

[Chris2011]

Yes, and for pnpm too, but initially it came from npm. yarn also uses node_modules, pnpm too. So from the core they are pretty much the same. The difference is how they treat the modules. Hard linking, caching, etc. So in general if someone will see the npm logo or package.json, if they google for it, they will figure it out quickly. https://www.google.com/search?q=package.json

[matthiasblaesing]

From a technical perspective I think this is good to go. I ran the build and found, that the new icon is present in the package.json file, the file still has syntax highlighting and the node actions are also correctly present.

We need to be careful with the artwork though. We already need to discuss enough about licenses. For external files we record the information in a file named licenseinfo.xml - see details here:
https://cwiki.apache.org/confluence/display/NETBEANS/Legal+FAQ#LegalFAQ-licenseinfoPerfileinfo-licenseinfo.xml
There are several samples in the codebase for the file. Having the file ensures, that the license for the graphics is correctly included in the summary and if needed attributions are included in the NOTICE file.

[Chris2011]

@matthiasblaesing or others, so what is needed here to merge the PR or change it? Would like to add it to the next NB version.

[matthiasblaesing]

@Chris2011 did you see my previous comment?

1. Add/Modify licenseinfo.xml to reflect the license info for the graphics file you are adding (this is covered in my previous comment with links for infos)
2. Squash the commit into one (can be done on merge of course, I personally prefer, that I have control over the commits as the author)

[Chris2011]

@matthiasblaesing ok thix, thought that this was only a discussion topic and for me an info. Will change it. Thx.

Should I squash all commits into one? Or do you mean only the license changing?

[matthiasblaesing]

@Chris2011 from my POV the commits form one logical change and thus should all squashed together.

[Chris2011]

Ok, thx. That makes sense.

[Chris2011]

Am I right, if I say that the license of the logo is creative common? https://www.npmjs.com/policies/trademark I can't find any other info about that. @matthiasblaesing what do you think? I know that license for NPM is "Artistic License 2.0" Is this the same for the logo?

[Chris2011]

This will be the code, that I want to add it into the licenseinfo.xml file inside of the Node.js Project Support module

    <fileset>
        <file>src/org/netbeans/modules/javascript/nodejs/resources/npm.png</file>
        <license ref="Artistic License 2.0" />
        <comment type="COMMENT_UNSUPPORTED" />
    </fileset>

[matthiasblaesing]

@Chris2011 the license for the logo file might not be the same, so you need to check: Where did you get the graphics and which license is referenced there? This might be implicit (from the context of the project) or explicit from a concrete information.

The license ref entry must match an entry in the nbbuild/licenses directory, else it will be rejected.

[Chris2011]

Thx, will check.

[isaacs]

I'm a little bit confused by the questions here. The logo is not "software", it's an image, and so there's a bit of a category error talking about what OSI license it uses. The logo is not covered by Artistic 2.0. IANAL, but I believe that even if it were covered under that license, it would cover the specific bits distributed (which you aren't using), not the design as such (which is a mark used in trade to refer to a specific entity).

It's governed by trademark, and our trademark policy says in a nutshell, "all rights reserved", and thus may not be used without permission for anything other than nominative use or fair use (which are protected by law anyway). It's certainly not Creative Commons.

One could make the case that this is nominative use. But you don't have to, because we've provided written permission. I don't know how it can be more clear that you're allowed to use it than the trademark owner saying in writing that they give you permission, but maybe I'm missing something.

[matthiasblaesing]

Of course the logo is covered under a license. I can only speak for germany, if I don't give you a license to use my work, than can't use it. I don't need to do anything to protect it. I'll assume, that it is similar in other countries. That is independed of trademark law, which from my POV in this case does not even apply, as the icon only symbolizes the application the file belongs to.

I'll make a sample. Consider font-awesome:

https://github.com/FortAwesome/Font-Awesome/blob/master/svgs/brands/npm.svg

The file is covered by the CC-BY-4.0 license:

https://github.com/FortAwesome/Font-Awesome#license

So we could render that, add attribution for it to the apache notice file and be done with it.

For a list of acceptable licenses, please see the apache legal faq:
Good: https://www.apache.org/legal/resolved.html#category-a
Problematic, but possible: https://www.apache.org/legal/resolved.html#category-b

[isaacs]

The license is "All rights reserved". But we gave you (that is, Apache NetBeans) written permission to use the logo in the way described.

If you want to put that in some more agreeable legal language for us to sign, go for it. I don't want to seem rude here, but as this is a favor to Netbeans rather than the other way around, I'm not super interested in investing much energy in making this happen.

[matthiasblaesing]

@Chris2011 please find a logo file with a clearly stated license. A license "for us" is not enough. It has to be compatible with the ASFs requirements for licenses (I inlined the white-listed licenses above) - I don't want to involve apache legal, just to get one icon included. I would prefer a source, that does not require attribution and licenses the logo according to category-a above.

[emilianbold]

A license "for us" is not enough. It has to be compatible with the ASFs requirements for licenses (I inlined the white-listed licenses above)

Good point. An Apache Licensed projects allows all kinds of usage downstream, including commercial. So, we can't have a logo that only "NetBeans" can use, because then we basically cannot release that.

From reading https://www.npmjs.com/policies/trademark

The npm Logo signifies us, or a special relationship with us, and you should use it only with our permission. Since the goal is to avoid confusion about you being us, or your relationship with us, context counts. We will consider requests on a case-by-case basis.

it seems clear that we cannot include the logo in NetBeans as each NetBeans derivative will have to get specific permission for the npm logo.

Since I don't believe npm inc will grant us such a generous permission given the terms in their trademark policy we can probably reject this PR.

I'm also thinking if we really need the npm logo there. We could differentiate the file from a plain .js file with some hint. Even for Maven projects, we don't have a specific icon for pom.xml, we have the normal XML icon and we just group the pom.xml file under the "Project Files" subtree.

[Chris2011]

To be clear, I don't want it to make it the same as VS Code, I only see the benefit out of it and I change the icon for the pom.xml file too as IntelliJ has another icon for that specific file too. I didn't use the same icon for the pom.xml because I already have one and I used that. But for package.json, bower.json and the others, we don't have different icons. Different projects have different icons, different files have different icons, etc.

[Chris2011]

This is how it looks now. Each JS and JSON file have the same JS icon and with my approach the package.json is different, which you can catch with your eye, very well that this file is more important or different from each other. And it has a different mimetype, due to special actions on that file.

angular.json, karma.config.js and other files should have different icons too, because they are related to different technologies/frameworks etc.

IMHO, package-lock.json should also have the npm logo.

[Chris2011]

@isaacs so is there anything wrong to doing what @matthiasblaesing suggested? With the CC licensed Icon, changing the color, change the License to ALv2 and use it? Is this ok?

[isaacs]

While the copyright license on the logo is CC, it's still bound by our trademark. Which is to say, Netbeans has permission to use our trademarked logo to reference package.json and package-lock.json files, but that permission does not automatically extend to other parties or other uses.

[Chris2011]

Ok I understand, so we have to clarify here, that we are talking about NetBeans IDE. But there is a NetBeans Platform where you can create applications, based on NetBeans. I hope that the icon will not part of the platform, or? @matthiasblaesing. Then we have a problem or would a permission to the icon using in the netbeans platform is ok?

[Chris2011]

@isaacs thx, the last resort is to make a plugin for some icon changes (not only the package.json but others to make it possible to use it, instead of adding them into the core).

[matthiasblaesing]

Ok, this was raised with apache legal:
https://issues.apache.org/jira/browse/LEGAL-353
I seriously hope, that we are prepared for the answer....

[matthiasblaesing]

Ok - Apache legal gave its verdict: As long as we use the icon in the way we plan (as an icon representing the programm), it is fair use. We also need a valid license, that satisfies the requirements of the apache foundation regarding the copy right. Using the CC-0 licensed base will keep the copy right easy and the trademark part is covered by fair use. @Chris2011 is suggest, you follow the advise from #1034 (comment)

[Chris2011]

hey @matthiasblaesing great news. Thx. Will do so. But i want to add the icon to the package-lock.json and npm-debug.log. Do I need to ask again for permission for those files? I mean those files are also part of that and shouldn't be a problem, right?

[matthiasblaesing]

I would be ok with using the icon for the two files. There is a direct relationship from package.json, package-lock.json and npm-debug.log to npm. Using the icon seems logical.

[isaacs]

For what it's worth (I guess not much if it's fair use anyway), I think it's completely reasonable to use the same logo for package.json as package-lock.json and npm-debug.log files.

Glad to hear this reached a reasonable resolution :)

[Chris2011]

Great thx to @isaacs for your help and patience and thx to @matthiasblaesing for the help and the legal part. Will do it in the next couple of days :)

[matthiasblaesing]

@Chris2011 to me the change looks sane. Could you rebase the changeset onto master and squash the changeset? That way we get one or two meaningful commits and it makes it easier to cherry-pick the change, if needed (see here: https://lists.apache.org/thread.html/c9087dec90200badd2528dfd1c315d2c619ee3dadcf735989914fb84@%3Cdev.netbeans.apache.org%3E). I would reword it a bit and say: Make meaningful self contained commits.

[Chris2011]

Hey @matthiasblaesing I'm not done yet, unfortunately. I have a big problem that needs to figure out first. The source/history tab pane is missing, after I registered the PackageJsonDataObject:

After I fix this, I will add the icon for the npm-debug.log and the package-lock.json. When I'm finish, I will squash my commits and see how it will work. Thx for the comment :)

[Chris2011]

Finally. I did it. Everything ok now?

[matthiasblaesing]

This looks fishy. I understand, that you want to associate your new Editor with only "npm-debug.log", yet you assign it the mimeType "text/plain". That mimetype matches a big chunk of files on my harddisk, which you would all pull through your special data object.

[Chris2011]

Oops, I didn't know that. I thought the combination of resolver AND filename in this example is enough to make it unique. So for this I really need a new mimetype, right? text/package+plain or text/npm-debug-log. Looks weirdo. Any other solutions?

[matthiasblaesing]

None I'm aware of - this file just describes how a mimetype is assigned. In your case you are using a name to mime-type mapping.

[Chris2011]

Ok, will change the mimetype, weird but ok. I think it must be possible to add more stuff to a fully qualified unique file name like package.json or in my example to npm-debug.log like adding icons to not change or adding a mimetype. But this is another topic. I will change the mimetype to text/npm-log if this is okish.

[Chris2011]

I changed it, but I thought I did it correct, now I force pushed it, sry. I fixed it now.

[matthiasblaesing]

Looks good to me.

[Chris2011]

Rebased as there are no other remarks.

[matthiasblaesing]

I looked at the mime registration again today and while reading about this, I noticed, that the mimetypes should have been different:

• text/package+x-json should have been application/x.npm-package+json
• text/package-lock+x-json should have been application/x.npm-package-lock+json
• text/npm-log should have been text/x.npm-log+plain

Reasoning: The mimetypes are unregistered (thus the x. for the subtype) but they are all based on existing types. For former two are based on application/json and the latter is based on text/plain. The +json parts are the suffix to designate their base type.

Its to late now, but should be considered next time.