NETBEANS-1499 - change package.json icon

[Chris2011]

This PR will change the generic js icon for a specific file (package.json) with a specific mimetype (text/package+x-json) to the logo of npm, to make it more prominent.

Before merging, we have to check the licenses of the npm logo: https://www.npmjs.com/policies/trademark. I wrote them an e-mail, will let you know whether it is ok or not. Maybe a license guy can help here too.

This logo is also used inside of a VS Code plugin for better icons for specific filetypes.

[emilianbold]

Seems to me the PR does more than just change an icon.

[Chris2011]

@emilianbold yes, I had to create a DataObject for the file to set a different icon. Otherwise it wont work. Or maybe I didn't know any other solution, maybe there is another one :). But it seems that I can't use it, I'm in contact with the tech support for npm. Will let you know.

[Chris2011]

Today I got the permission to use the npm logo:

Hi, Chris! Sorry for the delay. I wanted to loop our trademark and copyright counsel in on this, just to make sure I wasn't doing something dumb :)

The Apache Netbeans IDE has asked for permission to use the npm logo to represent the filetype of files named "package.json" and "package-lock.json" in the IDE. Thanks for asking, and yes, you have our permission to do so. You also linked the logo at https://github.com/vscode-icons/vscode-icons/blob/master/icons/file_type_npm.svg, which is the icon that you may use. Thanks for your patience and for reaching out to us about this matter. Looking forward to seeing the npm logo in Netbeans :)

Cheers!

So pleaes have a look and leave comments.

[Chris2011]

Summerize:

• Created a new DataObject for "package.json" called PackageJsonDataObject to add a new file icon.
• Removed old layer.xml file
• Moved annotation for MimeResolver from PackageJson.java to PackageJsonDataObject.java
• Added the npm icon to the code. I got the permission to use it.

Let me know, if anything is still unclear.

[Chris2011]

Here you can see the result:

[aalvrz]

I am not very familiar with JavaScript package managers, but isn't package.json also used by other package managers such as Yarn?

[Chris2011]

Yes, and for pnpm too, but initially it came from npm. yarn also uses node_modules, pnpm too. So from the core they are pretty much the same. The difference is how they treat the modules. Hard linking, caching, etc. So in general if someone will see the npm logo or package.json, if they google for it, they will figure it out quickly. https://www.google.com/search?q=package.json

[matthiasblaesing]

From a technical perspective I think this is good to go. I ran the build and found, that the new icon is present in the package.json file, the file still has syntax highlighting and the node actions are also correctly present.

We need to be careful with the artwork though. We already need to discuss enough about licenses. For external files we record the information in a file named licenseinfo.xml - see details here: https://cwiki.apache.org/confluence/display/NETBEANS/Legal+FAQ#LegalFAQ-licenseinfoPerfileinfo-licenseinfo.xml There are several samples in the codebase for the file. Having the file ensures, that the license for the graphics is correctly included in the summary and if needed attributions are included in the NOTICE file.

[Chris2011]

@matthiasblaesing or others, so what is needed here to merge the PR or change it? Would like to add it to the next NB version.

[matthiasblaesing]

@Chris2011 did you see my previous comment?

1. Add/Modify licenseinfo.xml to reflect the license info for the graphics file you are adding (this is covered in my previous comment with links for infos)
2. Squash the commit into one (can be done on merge of course, I personally prefer, that I have control over the commits as the author)

[Chris2011]

@matthiasblaesing ok thix, thought that this was only a discussion topic and for me an info. Will change it. Thx.

Should I squash all commits into one? Or do you mean only the license changing?

[matthiasblaesing]

@Chris2011 from my POV the commits form one logical change and thus should all squashed together.

[Chris2011]

Ok, thx. That makes sense.

[Chris2011]

Am I right, if I say that the license of the logo is creative common? https://www.npmjs.com/policies/trademark I can't find any other info about that. @matthiasblaesing what do you think? I know that license for NPM is "Artistic License 2.0" Is this the same for the logo?

[Chris2011]

This will be the code, that I want to add it into the licenseinfo.xml file inside of the Node.js Project Support module

    <fileset>
        <file>src/org/netbeans/modules/javascript/nodejs/resources/npm.png</file>
        <license ref="Artistic License 2.0" />
        <comment type="COMMENT_UNSUPPORTED" />
    </fileset>

[matthiasblaesing]

@Chris2011 the license for the logo file might not be the same, so you need to check: Where did you get the graphics and which license is referenced there? This might be implicit (from the context of the project) or explicit from a concrete information.

The license ref entry must match an entry in the nbbuild/licenses directory, else it will be rejected.

[Chris2011]

Thx, will check.

[isaacs]

I'm a little bit confused by the questions here. The logo is not "software", it's an image, and so there's a bit of a category error talking about what OSI license it uses. The logo is not covered by Artistic 2.0. IANAL, but I believe that even if it were covered under that license, it would cover the specific bits distributed (which you aren't using), not the design as such (which is a mark used in trade to refer to a specific entity).

It's governed by trademark, and our trademark policy says in a nutshell, "all rights reserved", and thus may not be used without permission for anything other than nominative use or fair use (which are protected by law anyway). It's certainly not Creative Commons.

One could make the case that this is nominative use. But you don't have to, because we've provided written permission. I don't know how it can be more clear that you're allowed to use it than the trademark owner saying in writing that they give you permission, but maybe I'm missing something.

[matthiasblaesing]

Of course the logo is covered under a license. I can only speak for germany, if I don't give you a license to use my work, than can't use it. I don't need to do anything to protect it. I'll assume, that it is similar in other countries. That is independed of trademark law, which from my POV in this case does not even apply, as the icon only symbolizes the application the file belongs to.

I'll make a sample. Consider font-awesome:

https://github.com/FortAwesome/Font-Awesome/blob/master/svgs/brands/npm.svg

The file is covered by the CC-BY-4.0 license:

https://github.com/FortAwesome/Font-Awesome#license

So we could render that, add attribution for it to the apache notice file and be done with it.

For a list of acceptable licenses, please see the apache legal faq: Good: https://www.apache.org/legal/resolved.html#category-a Problematic, but possible: https://www.apache.org/legal/resolved.html#category-b

[isaacs]

The license is "All rights reserved". But we gave you (that is, Apache NetBeans) written permission to use the logo in the way described.

If you want to put that in some more agreeable legal language for us to sign, go for it. I don't want to seem rude here, but as this is a favor to Netbeans rather than the other way around, I'm not super interested in investing much energy in making this happen.

[matthiasblaesing]

@Chris2011 please find a logo file with a clearly stated license. A license "for us" is not enough. It has to be compatible with the ASFs requirements for licenses (I inlined the white-listed licenses above) - I don't want to involve apache legal, just to get one icon included. I would prefer a source, that does not require attribution and licenses the logo according to category-a above.

[emilianbold]

A license "for us" is not enough. It has to be compatible with the ASFs requirements for licenses (I inlined the white-listed licenses above)

Good point. An Apache Licensed projects allows all kinds of usage downstream, including commercial. So, we can't have a logo that only "NetBeans" can use, because then we basically cannot release that.

From reading https://www.npmjs.com/policies/trademark

The npm Logo signifies us, or a special relationship with us, and you should use it only with our permission. Since the goal is to avoid confusion about you being us, or your relationship with us, context counts. We will consider requests on a case-by-case basis.

it seems clear that we cannot include the logo in NetBeans as each NetBeans derivative will have to get specific permission for the npm logo.

Since I don't believe npm inc will grant us such a generous permission given the terms in their trademark policy we can probably reject this PR.

I'm also thinking if we really need the npm logo there. We could differentiate the file from a plain .js file with some hint. Even for Maven projects, we don't have a specific icon for pom.xml, we have the normal XML icon and we just group the pom.xml file under the "Project Files" subtree.

[isaacs]

Since I don't believe npm inc will grant us such a generous permission given the terms in their trademark policy

Indeed, that would not be something we would be comfortable with. Some downstream uses could imply a relationship with npm, Inc. or the npm project, and would thus cause confusion in the marketplace.

[Chris2011]

@isaacs I'm really sry, that this could be annoying for you, for me too. It seems everything is about license and at the end, nothing is about license. But thx for your help anyway.

To let you know, the icon is the offficial one, how should I find another one? It will be a custom one, from someone else, right? Or should I create my own based on that? If this is legally possible, I can do.

I'm also thinking if we really need the npm logo there. We could differentiate the file from a plain .js file with some hint. Even for Maven projects, we don't have a specific icon for pom.xml, we have the normal XML icon and we just group the pom.xml file under the "Project Files" subtree.

Of course @emilianbold we have, beacuse I implemented it. It is a visual thing: https://github.com/apache/incubator-netbeans/pull/983 and there are lots of more coming: https://issues.apache.org/jira/browse/NETBEANS-1496

Putting under the project files is not enough in my POV, as I said this is a visual thing, if you see the name, maybe you heard about it, but if you see the logo, you can guess that this is related to npm and for pom, it is related to maven etc. So yes I want to change some icons, which are only normal JS icons (also for JSON files, which doesn make sense but this is an other topic) to make them more promiment. I couldn't know that this is such a terrible process to find the right license or whatever.

NetBeans still uses the karma logo for the test runner and where did you guys get it? What license is that?

[matthiasblaesing]

To make this easier - this looks like a good alternative:

https://github.com/simple-icons/simple-icons/blob/develop/icons/npm.svg

That file is CC-0 (see: https://github.com/simple-icons/simple-icons/blob/develop/LICENSE.md). I assume, that black is not the color you want. So I would do this:

1. Get the file referenced above
2. Modify it with an SVG Editor and change color to your liking
3. Add a XML comment with the ALv2 (ASF donation variant) license before the opening svg-tag
4. Add a second comment, that states (preferably as bullet points / numbered list): where did you download the original document (URL above), that the original file was CC-0 licenses, that you modified color and added license comment
5. Render the necessary icon file from it, please the icon file and the svg file together in the resources package (for the package I suggest org.netbeans.modules.javascript.nodejs.ui.resources (https://github.com/apache/incubator-netbeans/tree/b48eb9b1cc267f7e7c768f6e90c4d539ee47d19d/webcommon/javascript.nodejs/src/org/netbeans/modules/javascript/nodejs/ui/resources), as there are already icons
6. Add an entry into the licenseinfo.xml (https://github.com/apache/incubator-netbeans/blob/b48eb9b1cc267f7e7c768f6e90c4d539ee47d19d/webcommon/javascript.nodejs/licenseinfo.xml). As the file is now ALv2, you can just add another file entry to the existing fileset for the png/gif (the svg can hold a license)

This way we can skip the whole license discussion and get on.

[Chris2011]

@matthiasblaesing ok thx. Will do so. Thx for the research.

[emilianbold]

npm Inc still owns the trademark to that logo, regardless who designed an icon representing their logo and under what license the icon itself is. So... this doesn't really change the trademark policy angle.

Also, package.js having the npm logo is not in line with how NetBeans displayed such files before. The Ant / Maven configuration files don't have specific icons! It's all in the tree structure and in how the projects are displayed ("Project Files", etc).

So considering the npm inc trademark angle and this not being something NetBeans does, I would think of working at project level to group / present the package.js file in a different subtree, as a JS file (perhaps with a small decoration in some icon corner).

Needless to say package.js is not "owned" by npm. It's quite possible to have projects that have a package.js without npm (yarn supposedly reads it and any other tool that wants to work with existing projects will have to support package.js).

[matthiasblaesing]

I don't see trademark as not relevant here. Everything that was said regarding trademark here is also true for Google for Chrome, Microsoft for IE, Mozilla for Firefox, Oracle for Java and so on. Apache legal requires us to comply with the licenses and that is the case for the file I mentioned in my previous comment. Independend from that trademark laws may or may not apply. For our use case (icon for a file that is primarily used by the programm that uses that logo), I consider it nominative use, which you can't prevent as the trademark holder.

If we really want to discuss the pro/con of using the NPM logo to represent package.json, I suggest to shift discussion to the mailinglist. My review assumes, that we aggree, that using the logo is a good idea to make the file easily recognizable.

Edit: Maven pom.xml files are indeed marked with the maven icon (sinse NB10), that was @Chris2011 first change (see here: https://issues.apache.org/jira/browse/NETBEANS-1496)

[emilianbold]

OK, no need for me to get in the way. Carry on...

[isaacs]

Why not just use the yellow-square JS logo? It’s explicitly public domain, I believe, and saying “this is for JS” is probably about as meaningful for end users as saying it’s for npm.

On Sat, Jan 12, 2019 at 11:51 Emilian Bold notifications@github.com wrote:

OK, no need for me to get in the way. Carry on...

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/apache/incubator-netbeans/pull/1034#issuecomment-453776194, or mute the thread https://github.com/notifications/unsubscribe-auth/AAAkR0qPlnbSxBliUI0tleC3NqGyIAZ6ks5vCjzPgaJpZM4Yw3M3 .

[isaacs]

And, just on behalf of the USA and capitalism, I apologize that trademark and copyright can be such a pita. It does seem like the right thing would be to allow this use, which is why we gave permission, but we can’t make it too broad without losing our ability to control who can claim to speak for us.

I understand the concern from the Apache side, and I appreciate everyone trying to do the right thing here.

On Sat, Jan 12, 2019 at 12:02 Isaac Schlueter i@izs.me wrote:

Why not just use the yellow-square JS logo? It’s explicitly public domain, I believe, and saying “this is for JS” is probably about as meaningful for end users as saying it’s for npm.

On Sat, Jan 12, 2019 at 11:51 Emilian Bold notifications@github.com wrote:

OK, no need for me to get in the way. Carry on...

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/apache/incubator-netbeans/pull/1034#issuecomment-453776194, or mute the thread https://github.com/notifications/unsubscribe-auth/AAAkR0qPlnbSxBliUI0tleC3NqGyIAZ6ks5vCjzPgaJpZM4Yw3M3 .

[Chris2011]

Why not just use the yellow-square JS logo? It’s explicitly public domain, I believe, and saying “this is for JS” is probably about as meaningful for end users as saying it’s for npm.

I don't know whether it was a bit of sarcastic or not, if it was sarcastic, don't read further :), but we already have icons for JS and unfortunately the same for json files, which I also will change, but for this I will make my own with my UX/UI friend David.

Thx for everyone, if everything is fine now, I will use the approach of @matthiasblaesing or should we discuss it further?

I mean not here, but at the mailinglist.

[isaacs]

Oh! No it wasn’t sarcastic. Sorry, I didn’t know that you already had an icon for JS. Can you use the js icon for package.json as well, then?

On Sat, Jan 12, 2019 at 12:08 Chrizzly notifications@github.com wrote:

Why not just use the yellow-square JS logo? It’s explicitly public domain, I believe, and saying “this is for JS” is probably about as meaningful for end users as saying it’s for npm.

I don't know whether it was a bit of sarcastic or not, if it was sarcastic, don't read further :), but we already have icons for JS and unfortunately the same for json files, which I also will change, but for this I will make my own with my UX/UI friend David.

Thx for everyone, if everything is fine now, I will use the approach of @matthiasblaesing https://github.com/matthiasblaesing or should we discuss it further?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/apache/incubator-netbeans/pull/1034#issuecomment-453777308, or mute the thread https://github.com/notifications/unsubscribe-auth/AAAkR07lZ53f9jNnlENuBLULu1Dddgedks5vCkDRgaJpZM4Yw3M3 .

[Chris2011]

Oh! No it wasn’t sarcastic. Sorry, I didn’t know that you already had an icon for JS. Can you use the js icon for package.json as well, then?

We already have that, we have Node and NPM and Bower support and all JS and all JSON files, have the same JS icon. This is what I wanted to change because some files, like bower.json, gruntfile.js, package.json, webpack.config.js, karma.config.js etc. should be more prominent. As this is doing the same for VS Code: https://github.com/vscode-icons/vscode-icons

Please see the gif how it will look the package.json there. First IMHO that JS and JSON files have the same icon is not correct, but this is not going to work here. Second and this is my solution, I want to change some icons for specific files for some technologies. I mean sure we can made all files, doesn't matter which mimetype/filetype make the same icon, blank white icon (this was sarcastic).

[Chris2011]

To be clear, I don't want it to make it the same as VS Code, I only see the benefit out of it and I change the icon for the pom.xml file too as IntelliJ has another icon for that specific file too. I didn't use the same icon for the pom.xml because I already have one and I used that. But for package.json, bower.json and the others, we don't have different icons. Different projects have different icons, different files have different icons, etc.

[Chris2011]

This is how it looks now. Each JS and JSON file have the same JS icon and with my approach the package.json is different, which you can catch with your eye, very well that this file is more important or different from each other. And it has a different mimetype, due to special actions on that file.

angular.json, karma.config.js and other files should have different icons too, because they are related to different technologies/frameworks etc.

IMHO, package-lock.json should also have the npm logo.

[Chris2011]

@isaacs so is there anything wrong to doing what @matthiasblaesing suggested? With the CC licensed Icon, changing the color, change the License to ALv2 and use it? Is this ok?

[isaacs]

While the copyright license on the logo is CC, it's still bound by our trademark. Which is to say, Netbeans has permission to use our trademarked logo to reference package.json and package-lock.json files, but that permission does not automatically extend to other parties or other uses.

[Chris2011]

Ok I understand, so we have to clarify here, that we are talking about NetBeans IDE. But there is a NetBeans Platform where you can create applications, based on NetBeans. I hope that the icon will not part of the platform, or? @matthiasblaesing. Then we have a problem or would a permission to the icon using in the netbeans platform is ok?

[Chris2011]

@isaacs thx, the last resort is to make a plugin for some icon changes (not only the package.json but others to make it possible to use it, instead of adding them into the core).

[matthiasblaesing]

Ok, this was raised with apache legal: https://issues.apache.org/jira/browse/LEGAL-353 I seriously hope, that we are prepared for the answer....

[matthiasblaesing]

Ok - Apache legal gave its verdict: As long as we use the icon in the way we plan (as an icon representing the programm), it is fair use. We also need a valid license, that satisfies the requirements of the apache foundation regarding the copy right. Using the CC-0 licensed base will keep the copy right easy and the trademark part is covered by fair use. @Chris2011 is suggest, you follow the advise from https://github.com/apache/incubator-netbeans/pull/1034#issuecomment-453753472

[Chris2011]

hey @matthiasblaesing great news. Thx. Will do so. But i want to add the icon to the package-lock.json and npm-debug.log. Do I need to ask again for permission for those files? I mean those files are also part of that and shouldn't be a problem, right?

[matthiasblaesing]

I would be ok with using the icon for the two files. There is a direct relationship from package.json, package-lock.json and npm-debug.log to npm. Using the icon seems logical.

[isaacs]

For what it's worth (I guess not much if it's fair use anyway), I think it's completely reasonable to use the same logo for package.json as package-lock.json and npm-debug.log files.

Glad to hear this reached a reasonable resolution :)

[Chris2011]

Great thx to @isaacs for your help and patience and thx to @matthiasblaesing for the help and the legal part. Will do it in the next couple of days :)

[matthiasblaesing]

@Chris2011 to me the change looks sane. Could you rebase the changeset onto master and squash the changeset? That way we get one or two meaningful commits and it makes it easier to cherry-pick the change, if needed (see here: https://lists.apache.org/thread.html/c9087dec90200badd2528dfd1c315d2c619ee3dadcf735989914fb84@%3Cdev.netbeans.apache.org%3E). I would reword it a bit and say: Make meaningful self contained commits.

[Chris2011]

Hey @matthiasblaesing I'm not done yet, unfortunately. I have a big problem that needs to figure out first. The source/history tab pane is missing, after I registered the PackageJsonDataObject:

After I fix this, I will add the icon for the npm-debug.log and the package-lock.json. When I'm finish, I will squash my commits and see how it will work. Thx for the comment :)

[Chris2011]

Finally. I did it. Everything ok now?

[Chris2011]

I changed it, but I thought I did it correct, now I force pushed it, sry. I fixed it now.