Clarify license implications for those who make custom jackson-core builds

[vlsi]

Jackson seems to redistribute fastdoubleparser in the shaded form.
fastdoubleparser's license requires that every redistribution should include the copyright notice and the permissions must be included.

See https://github.com/wrandelshofer/FastDoubleParser/blob/aeeab26365235cc2fbfb68fea2145a4b86a800fd/LICENSE#L12-L13

Unfortunately, jackson fails to comply with the license requirements.

I would suggest either stop using shaded dependency, or include the relevant information into the jackson's license that is already included into the release jar.

Is it really required to shade the parser? If you use a regular dependency, then the users can upgrade it in case of CVEs.

See a corresponding licensing issue at fastdoubleparser side: wrandelshofer/FastDoubleParser#38

[vlsi]

@cowtowncoder , it would be nice if you could incorporate it into 2.15.1 as well (e.g. either un-shade fastdoubleparser or include the proper licensing information for all the shaded dependencies).

[vlsi]

Looks like jackson uses a custom-licensed implementation: #577 (comment)

[vlsi]

Even though there was a custom agreement between fastdoubleparser and jackson-core developers, it is not clear what are the exact terms of fastdoubleparser code in jackson-core.

For instance, it is not clear if the agreement was for a single version only or if all fastdoubleparser versions.
It is not clear if others can build jackson-core and still get the same licensing preferences for fastdoubleparser.

From the consumer perspective, it would be so much easier if fastdoubleparser shadowing followed the regular procedure, so jackson-core would mention which software is shaded, mention the incense, and so on.

[pjfanning]

@vlsi there is a PR that does just that - #1003

[wrandelshofer]

@pjfanning Unfortunately PR #1003 is not sufficient.

You have to add 2 additional sections to the NOTICE file.

Like so:

fastfloat, Copyright (c) 2021 The fast_float authors. MIT License.
https://github.com/fastfloat/fast_float
https://github.com/fastfloat/fast_float/blob/dc88f6f882ac7eb8ec3765f633835cb76afa0ac2/LICENSE-MIT

bigint, Copyright 2020 Tim Buktu. 2-clause BSD License.
https://github.com/tbuktu/bigint/tree/floatfft
https://github.com/tbuktu/bigint/blob/617c8cd8a7c5e4fb4d919c6a4d11e2586107f029/LICENSE
(We only use those portions of the bigint project that can be licensed under 2-clause BSD License.)

Instead of the perma-links to the license files, you have to paste the license file contents.

I think, the bigint project violates its own license terms by not including the 2-clause BSD license text. So, I made one by myself:
https://github.com/wrandelshofer/FastDoubleParser/blob/a5eb036dd909c7d167219c7ee60c5454b2061926/bigint-LICENSE

[pjfanning]

@wrandelshofer thanks - I'll review this extra bits over the coming days. I'll be travelling so it might take a few days.

Do the extra copyrights also apply to older versions of your lib (eg 0.6.0)? We have a still supported version of Jackson (2.14) that uses an older copy of your code. The latest line of Jackson (2.15) uses your 0.8.0 but shades the classes instead of having a checked in copy of your code. We can update this Jackson 2.15 line to use any updated jars you publish. We will still update our notice and license files regardless.

[wrandelshofer]

Yes, it also applies to 0.6.0.

I am going to check through all references in the code.

I just found one more reference in the code (project fast_double_parser). Also I licensed fast_float and fast_double_parser under Apache 2.0 at the time. I'll update this thread today or tomorrow.