source contains non-free licensed RFC content

[jonassmedegaard]

The files test/JSONPatchSpec.js and test/JSONPointerSpec.js contains contents from RFC documents which are covered by licensing certainly not MIT and (by some definitions) not free.

Please consider removing that content, to ease (re)distribution e.g. by Debian-based distributions.

[thelunararmy]

This falls under "fair use" under copyright law since it is regarded as research performed under MIT Connection Science platform.
They explicitly allow the use of RFC documents under fair use in their IETF Trust Document, point 1.12, page 4.

[jonassmedegaard]

Quoting JC Bailey (2019-09-11 12:41:52)

This falls under "fair use" under copyright law since it is regarded as research performed under MIT Connection Science platform.

I guess you mean that the work of Anvil Research, Inc is a research project. I highly doubt, however, that excemptions that Anvil Research, Inc receive as a research project is carried over to any and all downstream reusing the project as a whole and/or in parts. Which is generally a requirement for "Free software" or "Open Source" category of software.

They explicitly allow the use of RFC documents under fair use in their [IETF Trust Document, point 1.12, page 4](https://trustee.ietf.org/docs/Copyright-FAQ-2010-6-22.pdf).

I am aware of the notion of "fair use" but question that the size of verbatim copying done here is regarded as "fair use". Concretely, my interest is in redistributing this project as part of Debian where RDF documents are explicitly not permitted - see https://wiki.debian.org/NonFreeIETFDocuments Again, I am happy to be proven wrong here, but simply pointing to the "fair use" principle is unfortnately not convinving. Kind regards, - Jonas

…

-- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private

[christiansmith]

Hi @jonassmedegaard,

I'm the culprit here and included the specs in comments "temporarily" while devising test cases. We never finished this library or pushed a stable release and there's no guarantee we'll ever come back to it. I'm completely shocked – a few years later – to see that anyone using this code at all, let alone packaging it for Debian.

All things considered, I'd rather leave the comments in place for now. Explain to me what you're doing with the code and I'll give it some additional thought. You're also welcome to fork the repo.

Best,

Christian

[jonassmedegaard]

Thanks for your input, @christiansmith - quite interesting!

This project is transitively used by https://github.com/solid/node-solid-server - as seen in this recently computed dependency map: https://wiki.debian.org/Javascript/Nodejs/Tasks/solid-server

I will make the developers of solid-server aware that they rely on unstable code!

[christiansmith]

At their request, we helped the pre-Inrupt Solid team a few years ago. This probably isn't the only dependency you should be concerned about. See the announcement at anvil.io.

[jonassmedegaard]

What announcemeOHH, it appears when you permit javascript on that page...!

Thanks for the informative and inspiring announcement, @christiansmith - and best of luck with Stranger Labs, Inc.!