[REVIEW]: easyaccess

[whedon]

Submitting author: @mgckind (Matias Carrasco Kind)
Repository: https://github.com/mgckind/easyaccess
Version: 1.4.5
Editor: @arfon
Reviewer: @ngoldbaum
Archive: 10.5281/zenodo.2553673

Status

Status badge code:

HTML: <a href="http://joss.theoj.org/papers/95239edd5e74da1d7da5db96b1fd75d0"><img src="http://joss.theoj.org/papers/95239edd5e74da1d7da5db96b1fd75d0/status.svg"></a>
Markdown: [![status](http://joss.theoj.org/papers/95239edd5e74da1d7da5db96b1fd75d0/status.svg)](http://joss.theoj.org/papers/95239edd5e74da1d7da5db96b1fd75d0)

Reviewers and authors:

Please avoid lengthy details of difficulties in the review thread. Instead, please create a new issue in the target repository and link to those issues (especially acceptance-blockers) in the review thread below. (For completists: if the target issue tracker is also on GitHub, linking the review thread in the issue or vice versa will create corresponding breadcrumb trails in the link target.)

Reviewer instructions & questions

@ngoldbaum, please carry out your review in this issue by updating the checklist below. If you cannot edit the checklist please:

1. Make sure you're logged in to your GitHub account
2. Be sure to accept the invite at this URL: https://github.com/openjournals/joss-reviews/invitations

The reviewer guidelines are available here: https://joss.theoj.org/about#reviewer_guidelines. Any questions/concerns please let @arfon know.

✨ Please try and complete your review in the next two weeks ✨

Review checklist for @ngoldbaum

Conflict of interest

• As the reviewer I confirm that I have read the JOSS conflict of interest policy and that there are no conflicts of interest for me to review this work.

Code of Conduct

• I confirm that I read and will adhere to the JOSS code of conduct.

General checks

• Repository: Is the source code for this software available at the repository url?
• License: Does the repository contain a plain-text LICENSE file with the contents of an OSI approved software license?
• Version: Does the release version given match the GitHub release (1.4.5)?
• Authorship: Has the submitting author (@mgckind) made major contributions to the software? Does the full list of paper authors seem appropriate and complete?

Functionality

• Installation: Does installation proceed as outlined in the documentation?
• Functionality: Have the functional claims of the software been confirmed?
• Performance: If there are any performance claims of the software, have they been confirmed? (If there are no claims, please check off this item.)

Documentation

• A statement of need: Do the authors clearly state what problems the software is designed to solve and who the target audience is?
• Installation instructions: Is there a clearly-stated list of dependencies? Ideally these should be handled with an automated package management solution.
• Example usage: Do the authors include examples of how to use the software (ideally to solve real-world analysis problems).
• Functionality documentation: Is the core functionality of the software documented to a satisfactory level (e.g., API method documentation)?
• Automated tests: Are there automated tests or manual steps described so that the function of the software can be verified?
• Community guidelines: Are there clear guidelines for third parties wishing to 1) Contribute to the software 2) Report issues or problems with the software 3) Seek support

Software paper

• Authors: Does the paper.md file include a list of authors with their affiliations?
• A statement of need: Do the authors clearly state what problems the software is designed to solve and who the target audience is?
• References: Do all archival references that should have a DOI list one (e.g., papers, datasets, software)?

[whedon]

Hello human, I'm @whedon, a robot that can help you with some common editorial tasks. @ngoldbaum it looks like you're currently assigned as the reviewer for this paper 🎉.

⭐ Important ⭐

If you haven't already, you should seriously consider unsubscribing from GitHub notifications for this (https://github.com/openjournals/joss-reviews) repository. As a reviewer, you're probably currently watching this repository which means for GitHub's default behaviour you will receive notifications (emails) for all reviews 😿

To fix this do the following two things:

1. Set yourself as 'Not watching' https://github.com/openjournals/joss-reviews:

2. You may also like to change your default settings for this watching repositories in your GitHub profile here: https://github.com/settings/notifications

For a list of things I can do to help you, just type:

@whedon commands

[whedon]

Attempting PDF compilation. Reticulating splines etc...

[whedon]

👉 Check article proof 📄 👈

[arfon]

Thanks again for agreeing to review @ngoldbaum - please carry out your review in this issue by updating the checklist above and giving feedback in this issue. The reviewer guidelines are available here: https://joss.readthedocs.io/en/latest/reviewer_guidelines.html

Any questions/concerns please let me know.

[mgckind]

Hi @ngoldbaum, thanks again for reviewing this, let me know if you'd need anything from our side including maybe a special access to DES account.

[ngoldbaum]

Hi sorry for being slow to get to this, I've been on vacation this week.

[mgckind]

Thanks!, no problem

[ngoldbaum]

I'm starting my review today, many apologies again for being slow to get to this.

[ngoldbaum]

Comments on the paper text:

The JOSS reviewer guidelines note:

Note the paper should not include software documentation such as API (Application Programming Interface) functionality, as this should be outlined in the software documentation.

So I think Figure 3 and the "architecture" section probably belong in the docs rather than in the paper.

I also think "installation" probably also belongs in the docs. I think it would be sufficient to say "API documentation and installation instructions are available on the online documentation", which you can link to in the text.

Language nits:

• In the summary, the phrase "and support customized" should be "and supports customized"

• In the second setence of the second paragraph, "goals of DES are reveal" should be "goals of DES are to reveal".

[ngoldbaum]

I'm not a lawyer and haven't done much more than cursory googling on the subject, but I'm a little concerned about the direct binary dependency on the oracle client library, which is licensed under the OTN license. Among the terms are the following text:

If You want to use the Programs or Your application for any purpose other than as expressly permitted under this Agreement, You must obtain from Oracle or an Oracle reseller a valid Programs license under a separate agreement permitting such use. However, You acknowledge that the Programs may not be intended for production use and/or Oracle may not make a version of the Programs available for production or other purposes; any development or other work You undertake with the Programs is at Your sole risk.

I read this to say that you're only allowed to write code that depends on OTN-licensed software for testing and development purposes, but must get an oracle license or permission from oracle for production work.

[ngoldbaum]

Regarding the previous comment, I think this means that people can only use easyaccess for production work on a system where someone has paid for an oracle license (e.g. on an NCSA system), but if someone installs easyaccess on another system or e.g. their laptop, then they must not use easyaccess for production work without risking litigation from oracle.

I'm not sure if there's a license expert associated with JOSS who can weigh in here @arfon.

[arfon]

I'm not sure if there's a license expert associated with JOSS who can weigh in here @arfon.

Yeah, I'm really not sure here. On the one hand, I guess this statement may just reflect the licensing terms of Oracle, i.e. you can't use an Oracle DB server in production without a license. That said, these terms do seem to run somewhat counter-culture to the 'Free' in FLOSS.

@Kevin-Mattheus-Moerman - perhaps we can get some help from the OSI on this topic? Would you be able to seek their assistance on our behalf.

Also, @mgckind - is this something you've seen discussed before at NCSA?

[mgckind]

Thanks, easyaccess as cx_Oracle and others are just clients talking with the Oracle DB installed, licensed and running at NCSA, you'd only need the instant client library from Oracle, which you can obtain from their page.
we talked about this in the past and was suggested (it's been a while) that given the nature of the closed collaboration that we had on issues, for the public facing part we might recommend to get the Oracle client from them before installing easyaccess, which in addition (in the public case) is a read-only system just to extract data.
In any case installing these tools doesn't allow to run your own Oracle DB server, just the client.

[ngoldbaum]

Right, the issue is that the client itself is distributed under the OTN license. Since easyaccess depends on it, if I have easyaccess installed on a system where there isn't an oracle license available and I use it for production work, then I'm breaking the Oracle client license. The relevant part of the license is this bit (emphasis mine):

If You want to use the Programs or Your application for any purpose other than as expressly permitted under this Agreement

Here "the Programs" is the oracle client library and "your application" is easyaccess.

By the way, I don't think this issue should prevent getting an easyaccess paper published in JOSS, however we should definitely figure out if this is a real problem for potential users and if so make it extremely clear in the readme and documentation what the legal issues are.

[mgckind]

Thanks again,
I went and look again and I think by being more clear in the requisites and instructions for installation we can solve this. easyaccess requires cx_Oracle which is a python wrapper for the Oracle client which is also a requirement. In the cx_Oracle page they describe the installation of the oracle client as a requirement and they have an open-source license for the wrapper.
In short, we just need to be more clear about meeting the requirements in the installation process, but there won't be any issues using easyaccess

[ngoldbaum]

Hmm @arfon am I supposed to actually click the check marks in the comment from whedon at the top? I don't seem to be able to click the check boxes.

[ngoldbaum]

Oops never mind, I see I'm supposed to accept the invitation and that's mentioned in the instructions.

[ngoldbaum]

Just a heads up that I'm once again blocked on making further progress due to mgckind/easyaccess#161.

[ngoldbaum]

Matias has kindly sent me a login and I was able to access the DES database via easyaccess. I was also able to run some of the examples in the presentation on the easyacess website.

Regarding installation and initial configuration issues I ran into I've opened the following issues:

• More graceful failure when oracle client library is not installed mgckind/easyaccess#158
• Oracle client install instructions in the readme are not publicly visible mgckind/easyaccess#159
• Conda installation does not include pandas mgckind/easyaccess#160
• Add FAQ section to the readme mgckind/easyaccess#164

Regarding license issues and documentation of legal issues around the oracle client library:

• Document license issues when using oracle instant client mgckind/easyaccess#162

Regarding documentation on contribution, bug reports and questions about the software:

• Add contribution, support instructions mgckind/easyaccess#163

I'd also like to see the minor issues with the paper text I highlighted above resolved:

• [REVIEW]: easyaccess #1022 (comment)

I've also separately opened mgckind/easyaccess#165, which is more of a "nice to have" rather than something I'm insisting on as part of the peer review process.

As soon as the issues I've added tasks for above are resolved I will go ahead and resolve the remaining check marks in the review checklist and ask @arfon to more forward with publishing the paper.

Overall the experience using easyacess was very pleasant and the examples in the reveal presentation on the website are very clear. I can see why this tool is so popular inside the DES collaboration. Hopefully publishing the paper about it will allow you to get more credit from people who use it as part of their daily workflow.

[mgckind]

Thanks @ngoldbaum for the review!, glad you find the tool useful.
We'll address those issues and come back to this as soon as we can

[arfon]

👋 @mgckind - how are you getting along here making your changes?

[mgckind]

Yes, @arfon. As a matter of fact, I started to work on the issues raised by @ngoldbaum last week and I should be able to finish them pretty soon, thanks!

[ngoldbaum]

I've gone through the issues and I now only have one objection to publishing the paper: the license issues related to the oracle instant client.

I think at a minimum there needs to be a warning about using the oracle instant client for production work in the README. It would also be really nice if we could get an expert opinion from someone on the license issue.

[arfon]

It would also be really nice if we could get an expert opinion from someone on the license issue.

Apologies for the delay on this. I've been working with some lawyers at NumFOCUS and hope to have a formal answer on this soon.

[mgckind]

Thanks @arfon , this is what I got from a Oracle representative close to the Oracle Instant client team

You can only distribute a tool with Instant Client as long as the Instant Client terms are adhered to. Since I am not a lawyer I should leave my comments at that; you should consult your own legal resources.

I'll wait a bit more and otherwise will remove the Oracle instant client from our conda account and rely on having it installed first, note that as I mentioned in an issue before the client is also distributed in the anaconda conda channel as well.

[arfon]

OK, I've just heard back from the legal counsel at NumFOCUS:

I looked at the terms of the license for cx_oracle and the way that this is a transitive dependency. I would say that 1) the troublesome terms have mostly disappeared for recent versions of the simple oracle client, and 2), I don't think that the Open Journals use of cx_oracle itself creates a "no commercial use" problem. To the extent that there is a problem, I think it would have to be with the Oracle DB itself, not the client library – but we are not responsible for that.

So, based on my analysis, I would give this the green light.

✨

[ngoldbaum]

yay!! ok, concerns retracted, thanks arfon!

I think we're ready to publish?

[arfon]

I think we're ready to publish?

Yes, I think we are.

@mgckind - At this point could you make an archive of the reviewed software in Zenodo/figshare/other service and update this thread with the DOI of the archive? I can then move forward with accepting the submission.

[arfon]

@whedon check references

[whedon]

Attempting to check references...

[whedon]

OK DOIs

- http://doi.org/10.1093/mnras/stw641 is OK

MISSING DOIs

- https://doi.org/10.1117/12.959819 may be missing for title: FITS - a Flexible Image Transport System
- https://doi.org/10.1108/09504121211251880 may be missing for title: The Dark Energy Survey
- https://doi.org/10.1108/09504121211251880 may be missing for title: The Dark Energy Survey Data Release 1

INVALID DOIs

- None

[arfon]

Also @mgckind - @whedon has (experimental) abilities to suggest missing DOIs. The top one on this list might be a good suggestion? More generally, please make sure you've checked your bibtex entry for any missing DOIs for the references.

[mgckind]

Thanks @arfon, and @ngoldbaum
I've updated one of the missing DOI, the other 2 papers do not have one.
Also, I pushed the code to Zenodo:
DOI : 10.5281/zenodo.2553673

[arfon]

@whedon set 10.5281/zenodo.2553673 as archive

[whedon]

OK. 10.5281/zenodo.2553673 is the archive.

[arfon]

@whedon accept

[whedon]

Attempting dry run of processing paper acceptance...

[whedon]

OK DOIs

- http://doi.org/10.1093/mnras/stw641 is OK
- http://doi.org/10.3847/1538-4365/aae9f0 is OK

MISSING DOIs

- https://doi.org/10.1117/12.959819 may be missing for title: FITS - a Flexible Image Transport System
- https://doi.org/10.1108/09504121211251880 may be missing for title: The Dark Energy Survey

INVALID DOIs

- None

[whedon]

Check final proof 👉 openjournals/joss-papers#466

If the paper PDF and Crossref deposit XML look good in openjournals/joss-papers#466, then you can now move forward with accepting the submission by compiling again with the flag deposit=true e.g.

@whedon accept deposit=true

[arfon]

@whedon accept deposit=true

[whedon]

Doing it live! Attempting automated processing of paper acceptance...

[whedon]

🚨🚨🚨 THIS IS NOT A DRILL, YOU HAVE JUST ACCEPTED A PAPER INTO JOSS! 🚨🚨🚨

Here's what you must now do:

0. Check final PDF and Crossref metadata that was deposited 👉 Creating pull request for 10.21105.joss.01022 joss-papers#467
1. Wait a couple of minutes to verify that the paper DOI resolves https://doi.org/10.21105/joss.01022
2. If everything looks good, then close this review issue.
3. Party like you just published a paper! 🎉🌈🦄💃👻🤘

Any issues? notify your editorial technical team...

[arfon]

@ngoldbaum - many thanks for your review ✨

@mgckind - your paper is now accepted into JOSS ⚡🚀💥

[whedon]

🎉🎉🎉 Congratulations on your paper acceptance! 🎉🎉🎉

If you would like to include a link to your paper from your README use the following code snippets:

Markdown:
[![DOI](http://joss.theoj.org/papers/10.21105/joss.01022/status.svg)](https://doi.org/10.21105/joss.01022)

HTML:
<a style="border-width:0" href="https://doi.org/10.21105/joss.01022">
  <img src="http://joss.theoj.org/papers/10.21105/joss.01022/status.svg" alt="DOI badge" >
</a>

reStructuredText:
.. image:: http://joss.theoj.org/papers/10.21105/joss.01022/status.svg
   :target: https://doi.org/10.21105/joss.01022

This is how it will look in your documentation:

We need your help!

Journal of Open Source Software is a community-run journal and relies upon volunteer effort. If you'd like to support us please consider doing either one (or both) of the the following:

• Volunteering to review for us sometime in the future. You can add your name to the reviewer list here: http://joss.theoj.org/reviewer-signup.html
• Making a small donation to support our running costs here: https://www.flipcause.com/secure/cause_pdetails/Mjk3Nzk=

[mgckind]

Thanks @arfon . One more thing, is it possible to modify the xml so my last name appears as 'Carrasco Kind' instead of 'Kind' ?
https://github.com/openjournals/joss-papers/blob/master/joss.01022/10.21105.joss.01022.crossref.xml#L40