1:01 p.m.
On Mon, Feb 19, 2024 at 12:28 PM Mark Wielaard <mark(a)klomp.org> wrote:
Hi Richard,
On Wed, 2024-01-17 at 21:22 -0500, Richard Fontana wrote:
> On Wed, Jan 17, 2024 at 6:57 PM Mark Wielaard <mark(a)klomp.org> wrote:
> > On Fri, Nov 24, 2023 at 08:07:02PM +0100, Mark Wielaard wrote:
> > > On Mon, 2023-09-18 at 20:47 -0400, Richard Fontana wrote:
> > > > On Sun, Sep 17, 2023 at 11:37 AM Mark Wielaard <mark(a)klomp.org>
wrote:
> > > > > Likewise for valgrind we have examples of the above. For example
the
> > > > > dhat tool which have a GPLv2+ copyright and license header, but
also
> > > > > say:
> > > > >
> > > > > /*
> > > > > Parts of this file are derived from Firefox, copyright
Mozilla Foundation,
> > > > > and may be redistributed under the terms of the Mozilla
Public License
> > > > > Version 2.0, as well as under the license of this project. A
copy of the
> > > > > Mozilla Public License Version 2.0 is available at at
> > > > > https://www.mozilla.org/en-US/MPL/2.0/.
> > > > > */
> > > > >
> > > > > Again, although there is a reference to MPLv2 here, the code is
only
> > > > > available under GPLv2+.
> > > >
> > > > But that notice literally says there is code available under MPL
2.0.
> > > >
> > > > If the notice is incorrect, that is a bug that should be fixed
> > > > upstream. But a mere conflict with a project's conception of what
its
> > > > effective license is would not mean that the license notice is
> > > > incorrect.
> > >
> > > In the case of relicensing MPLv2 to GPLv2+ you could indeed argue that
> > > no notice at all should remain in the source file to the MPLv2. The
> > > MPLv2 does indeed require you remove all MPL notices when converting a
> > > source file to the GPL. But again I consider it rude to not even
> > > mention the origin of the source code and provide a (historical)
> > > reference.
> >
> > So in the above case, what would be your advice? Should upstream
> > change that notice that tells the user the original code (over there)
> > is also available under the MPL, but that this derived version is only
> > distributed under the GPL? Or should they just completely remove the
> > reference to the original MPL code?
>
> What MPL-2.0 actually says on this (if I'm understanding the situation
> correctly) is:
>
> "You may create and distribute a Larger Work under terms of Your
> choice, provided that You also comply with the requirements of this
> License for the Covered Software. If the Larger Work is a combination
> of Covered Software with a work governed by one or more Secondary
> Licenses, and the Covered Software is not Incompatible With Secondary
> Licenses, this License permits You to additionally distribute such
> Covered Software under the terms of such Secondary License(s), so that
> the recipient of the Larger Work may, at their option, further
> distribute the Covered Software under the terms of either this License
> or such Secondary License(s)."
>
> If dhat is the 'Larger Work' here (caveat, I haven't actually looked
> at dhat and I don't know what it actually copies from Firefox source
> code), what MPL seems to be saying is that the original creator of
> dhat has to provide the choice of licenses to their recipients. I seem
> to remember telling Luis Villa that I found this a little puzzling
> when I first looked at it but that was many years ago now.
Right, the MPL-2.0 "combining" FAQ also says you have to do this double
step dance. First publish as a dual license subject to the terms of the
MPL 2.0 and then further distribute it just under the secondary
license. Which is what seems to have happened in the valgrind git
repository. It is a little puzzling because the creator and the
recipient could simply be the same person (but technically in the
valgrind git repo the commits were made by different people).
> > I assume the License tag in the above case would simply be
> > GPL-2.0-or-later without any mention of the MPL?
>
> Given the wording of that notice, plus the underlying compliance issue
> noted above, I think the License tag should include `(GPL-2.0-or-later
> OR MPL-2.0)`.
I still don't understand why we should add the OR MPL-2.0 part. Since
the files as a whole are now publish under GPL-2.0-or-later (no longer
dual licensed). There is just the notice that parts of the code were
derived from code available under both the MPL-2.0 and the project
license (GPLv2). Which seems ok to preserve the historical record. But
adding OR MPL-2.0 to the license tag seems false advertisement, the
(now modified) code as (re)distributed is only available under the GPL-
2.0-or-later (since we aren't redistributing the whole valgrind git
history).
I'm just going by this language:
Parts of this file are derived from Firefox, copyright Mozilla
Foundation,
and may be redistributed under the terms of the Mozilla Public License
Version 2.0, as well as under the license of this project. A copy of the
Mozilla Public License Version 2.0 is available at at
https://www.mozilla.org/en-US/MPL/2.0/.
This reads as though there is code in the file that (in theory) can be
extracted and used under MPL 2.0. If they wanted it to no longer be
dual licensed they could have omitted that language. I don't think
from that language alone you can conclude that " the (now modified)
code as (re)distributed is only available under the GPL-2.0-or-later".
It's obviously not a very important issue, at least in this specific
case, but I think we should aim for some sort of consistent approach.
Richard