[Fedora-legal-list] Re: Fwd: SPDX Statistics - University of Constantinople edition
On 3/1/23 3:07 PM, Richard Fontana wrote:
On Wed, Mar 1, 2023 at 4:53 PM Jilayne Lovejoy
<jlovejoy(a)redhat.com> wrote:
>
>
> On 3/1/23 12:55 PM, Miroslav Suchý wrote:
>> Dne 01. 03. 23 v 3:18 Richard Fontana napsal(a):
>>> On Tue, Feb 28, 2023 at 6:49 PM Sérgio Basto <sergio(a)serjux.com>
wrote:
>>>> On Mon, 2023-02-27 at 23:37 +0100, Miroslav Suchý wrote:
>>>>
>>>> 8795 tags can be trivially converted using `license-fedora2spdx`
>>>>
>>>>
>>>> Hello,
>>>> running [1] the result is [2]
>>>>
>>>> [1]
>>>> askalono crawl libcomps-0.1.19
>>>>
>>>> [2]
>>>> libcomps-0.1.19/COPYING
>>>> License: GPL-2.0-only (original text)
>>>> Score: 0.988
>> I tried to use license-diff plugin for Firefox and it shows the same
>> score for GPL-2.0-only and for GPL-2.0-or-later.
>>
>> And license-diff plugin does not show "any later" as diff when I
>> compare it to GPL-2.0-only.
> that is correct b/c - like license diff is comparing full text of the
> license (kind of like what Richard explains below)... maybe good to add
> a note specific to GPL about this in our documentation... and so it
> grows... :)
To the extent that license detection tools are reporting
"GPL-2.0-only" based solely on recognition of the GPL version 2
license text, that is unfortunate, and I would argue, a bug in those
tools and a misapplication of SPDX identifiers.
ideally or technically, the tools
would suggest GPL-2.0-only or
GPL-2.0-or-later b/c the license text itself isn't where the
differentiation is identified, so you have to look elsewhere, which I
think you already pointed out.
This seems to be the
case for askalono. Of course this may be a side effect of the
questionable change SPDX made (resulting, from what I understand, from
lobbying by the FSF) to deprecate the GPL identifiers that don't use
-or-later or -only. :)
yes, the change of SPDX identifiers from GPL-2.0 to
represent GPL-2.0 only
and GPL-2.0+ (by way of adding the + operator) to represent GPL-2.0 or later
to
a license-specific listings on the SPDX License List of:
GPL-2.0-only and GPL-2.0-or-later
was due to pressure from the FSF back in 2017 or 2018. You can read blog
posts about it and the rationale if you want.
I suspect that prior to that, tool makers and others used "GPL-2.0" to
mean: the specific text of the license itself, I'm not sure if it's
"only" or "or later"; and just only that version. Which is what the
FSF
didn't like.
One of the proposals that the SPDX community came up with at that time
was to have GPL-2.0 mean that text of the license itself or I'm not sure
if it's "only" or "or later" and then add an operator to the
license
expression syntax that meant "only" (along the lines of + meaning "or
later"). This would have been much easier for license scanning tools to
consume. But that solution was rejected by the FSF.
Sometimes community leadership is hard.
(I'm not asserting it *matters* -- that is a more complicated question.)
Richard