RJSONIO licensing effectively non-free by Debian interpretation

[jonassmedegaard]

RJSONIO itself is licensed as BSD-3-Clause but links against libjson which has a license considered non-free by Debian and others: https://wiki.debian.org/qa.debian.org/jsonevil

Please consider switching to either r-cran-rjson or r-cran-jsonlite (i.e. revisit #472).

[jonassmedegaard]

For the record, this issue was kindly brought to my attention by a fellow Debian developer, Jonathon Love, when I filed a "request for packaging" of r-cran-rjsonio for Debian: https://bugs.debian.org/802263

[scottdraves]

argh, i heard about this. thanks for the report.
Unfortunately https://cran.r-project.org/web/packages/rjson/index.html does not support unicode.
I will see if jsonlite can do the unboxed values right.

[jonathon-love]

Unfortunately https://cran.r-project.org/web/packages/rjson/index.html does not support unicode

it does support UTF-8

we originally baulked at using it for exactly the same reason, but it actually does.

[scottdraves]

Looks like the libjson included by RJSONIO is not the problematic one.
this license looks good: https://github.com/duncantl/RJSONIO/blob/master/src/libjson/License.txt

[jonathon-love]

look here:

https://github.com/duncantl/RJSONIO/blob/master/src/JSON_parser.c

[scottdraves]

duncantl/RJSONIO#21

[scottdraves]

btw, thank you jonathon

[jonathon-love]

no worries :)

i only know about this because i once tried to package rjsonio for debian, and lintian automagically picked up that a bad license was in the source!

[scottdraves]

Looking at the code, R_readFromJSON does call into the evil code, but is itself only called from oldFromJSON. The other reference in readJSON.R is protected by if(FALSE). oldFromJSON is only called if a 2nd parameter is given to fromJSON, which we never do. So I think we can rip it out.

[jonassmedegaard]

Quoting Scott Draves (2015-11-10 17:46:54)

Looking at the code, R_readFromJSON does call into the evil code, but
is itself only called from oldFromJSON. The other reference in
readJSON.R is protected by if(FALSE). oldFromJSON is only called if a
2nd parameter is given to fromJSON, which we never do. So I think
we can rip it out.

That sounds promising.

I can understand if upstream wants to keep backwards compatibility
and therefore not (yet?) drop even deprecated functions.

Even so, we can in the Debian packaging of RJSONIO patch the code and
add a warning to our packaging documentation that we've killed those
functions due to its licensing problems.

• Jonas

• Jonas Smedegaard - idealist & Internet-arkitekt

• Tlf.: +45 40843136 Website: http://dr.jones.dk/

  [x] quote me freely [ ] ask before reusing [ ] keep private

[scottdraves]

sounds like this can be handled when rjsonio is packaged, not in beaker's code.