Superfish inclusion in the white list

it seems the package includes:

hoverIntent.js
jquery-1.2.6.min.js
jquery.bgiframe.min.js
superfish.js
supersubs.js

hoverIntent has no license in the .js itself.
jquery and jquery.bgiframe are both dual licensed MIT and GPL based on comments in the source code.

superfish and supersubs are both licensed MIT and GPL:
superfish.js: * Dual licensed under the MIT and GPL licenses:
superfish.js: * http://www.opensource.org/licenses/mit-license.php
superfish.js: * http://www.gnu.org/licenses/gpl.html
supersubs.js: * Dual licensed under the MIT and GPL licenses:

So, it seems the superfish and jquery included code is fine, we just need to track down hoverIntent to see what license it is.

Both MIT and GPL

* hoverIntent is currently available for use in all personal or commercial 
* projects under both MIT and GPL licenses. This means that you can choose 
* the license that best suits your project, and use it accordingly.

http://cherne.net/brian/resources/jquery.hoverIntent.js

Added: http://drupal.org/node/1475994

Tell me what specific download URLs need to be added and I will add them.

Ok cool. I actually changed the URL from the old one to ^https://github\.com/mehrpadin/Superfish-for-Drupal/.+$ because it's both correct and a lot less permissive than the old pattern I had there.

Thanks, drupalninja99!

I would like to be able to download a specific commit, rather than the automatically generated zip file.

Existing white-list patterns don't allow me to use the following .make definition, but instead throws an error:

The library 'superfish' cannot be downloaded from https://github.com/mehrpadin/Superfish-for-Drupal.git, the [error]
URL must be in the whitelist available at http://drupal.org/packaging-whitelist.

; Superfish
libraries[superfish][download][type] = "git"
libraries[superfish][download][url] = "https://github.com/mehrpadin/Superfish-for-Drupal.git"
libraries[superfish][download][revision] = "1571b1d5d3519246fe5b2e40a14579758afac503"
libraries[superfish][destination] = libraries

Following pattern would allow both URLs. Please review, Thanks.
^https://github\.com/mehrpadin/Superfish-for-Drupal.+$
https://github.com/mehrpadin/Superfish-for-Drupal.git
https://github.com/mehrpadin/Superfish-for-Drupal/zipball/master

Changing the status to major and catalog as bug report.

Without the requested change in the pattern, Superfish library cannot be used with specific revision.

See similar issue #1403884: Add ColorBox to packaging whitelist #8.

It is a blocking issue for us to publish our "P6 Profile" distribution.

The drupal-org.make file for project P6 Profile failed verification for Git tag 6.x-1.2.

http://drupal.org/node/642116 -- to learn more about correcting these errors.

PHP Warning: PHP Startup: apc.shm_size now uses M/G suffixes, please update your ini files in Unknown on line 0
The library 'superfish' cannot be downloaded from [error]
https://github.com/mehrpadin/Superfish-for-Drupal.git, the URL must
be in the whitelist available at
http://drupal.org/packaging-whitelist.
The drupal.org validation check failed -- see [error]
http://drupal.org/node/1432190 for more information.
Once these errors are fixed, commit the changes to your drupal-org.make, move the release tag for your project (check the Git manual to learn how to move tags if necessary), and submit the release node again.

I explicitly added ^https://github\.com/mehrpadin/Superfish-for-Drupal.git

The reason for this is with: ^https://github\.com/mehrpadin/Superfish-for-Drupal.+$ this would allow https://github.com/mehrpadin/Superfish-for-Drupal-whatever-i-want/Downloads..

We may want to change how we add github urls to also add the explicit case for the git repo.

IMHO the regex for this entry and others was too permissive. I've updated it again to use the standardized pattern for GitHub listed https://www.drupal.org/node/2295977

Removing the / at the end of ^https://github\.com/mehrpadin/Superfish-for-Drupal.+$, we are also approving https://github.com/mehrpadin/Superfish-for-Drupal-that-Installs-Virus too. Not that @mehrpadin would create Superfish-for-Drupal-that-Installs-Virus, but he could very easily create Superfish-for-Drupal-v2 which could use a different license. Unless there is some

^(git|https|http)://github\.com/mehrpadin/Superfish-for-Drupal[.git/].+$ allows https://github.com/mehrpadin/Superfish-for-Drupal.git, http://github.com/mehrpadin/Superfish-for-Drupal.git, https://github.com/mehrpadin/Superfish-for-Drupal/archive/master.zip, and others.

I'm flagging this as needs review because the primary repo for Superfish is now licensed as just MIT (https://github.com/joeldbirch/superfish/blob/master/MIT-LICENSE.txt) and may include the update that made whitelisting the fork necessary in the first place.

I am cleaning up all the old "Needs review" entries to make the issue queue less messy. This hasn't been touched in 5 years. Don't see any problems with this and moving to "Fixed". Anyone objecting have two weeks to reopen before is is automatically closed.