Source code for binary files included in the sources

[gvarenni-rvbd]

Good morning.

The following binary files are included in the repository

https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/cc-2008-08-08.jar
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/cc_de-2008-08-08.jar
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/cc_es-2008-08-08.jar
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/cc_fr-2008-08-08.jar
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/cc_it-2008-08-08.jar
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/cc_ja-2008-08-08.jar
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/cc_ko-2008-08-08.jar
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/cc_sv-2008-08-08.jar
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/cc_zh-2008-08-08.jar
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/cc_zh_CC-2008-08-08.jar
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/cc_zh_CN-2008-08-08.jar
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/cc_zh_HK-2008-08-08.jar
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/cc_zh_TW-2008-08-08.jar
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/jato-2005-05-04.jar

Based on this THIRD-PARTY.properties the license for these jars is CDDL, which requires the source code to be made available. Do you know where the source code can be found?

Also, this binary file doesn't have any license information. Do you know where it comes from and what is its license?
https://github.com/OpenIdentityPlatform/OpenAM/blob/14.7.4/extlib/authapi-2005-08-12.jar

Thanks,
GV

[vharseko]

extlib/cc sources lost: author Sun
extlib/authapi-2005-08-12.jar: RSA binary distribution

[gvarenni-rvbd]

Thanks.

For CC, how do we know that the license is CDDL if the sources are not available?

For authapi, do you know the license?

[vharseko]

For CC, how do we know that the license is CDDL if the sources are not available?

Based on THIRD-PARTY.properties history

For authapi, do you know the license?

RSA provides the license files separately from your RSA Authentication Manager SDK download kit https://community.rsa.com/s/article/RSA-Authentication-Manager-License-Support-063551d3

[gvarenni-rvbd]

authapi: it sounds like it comes from RSA, maybe as part of their SDK, which seems to require an RSA login to download (which I don't have). How did we get a copy of this JAR?

[vharseko]

You can obtain legacy SDK from RSA integration partner https://maven.forgerock.org/ui/native/repo/external/authapi/2005-08-12/ or directly obtain legacy or actual SDK from RSA if you are authorized as an integration partner.
To use this integration, you must purchase and register an RSA end-user license on the server.

[gvarenni-rvbd]

The problem is not much about obtaining the binaries or the SDK, it's about understanding the licensing and distribution terms of such jar.