python-dateutil SPDX license -- some code is Apache-2.0 and all code is BSD-3-Clause

[Miro Hrončok]

Hello,

I wanted to send a pull request to the python-dateutil package to change:

   License:        BSD-3-Clause and Apache-2.0

To:

   License:        BSD-3-Clause AND Apache-2.0

However, the comment above the License tag made me curious:

# According to the LICENSE file:
# - BSD License applies to all code, even that also covered by ASL 2.0
# - ASL 2.0 applies to all contributions after 2017-12-01,

The license file:

https://github.com/dateutil/dateutil/blob/2.8.2/LICENSE

tl;dr:

>  ...snip Apache-2.0...
>  
>  The above license applies to all contributions after 2017-12-01, as well as
>  all contributions that have been re-licensed (see AUTHORS file for the list of
>  contributors who have re-licensed their code).
>  
>  ...snip BSD-3-Clause...
>  
>  The above BSD License Applies to all code, even that also covered by Apache 2.0. 
In other words. There is a subset of the code which is covered by Apache-2.0 
and *at the same time* all of the code is covered by BSD-3-Clause.

Is that an OR case?

Should the license tag be:

   License:        (Apache-2.0 AND BSD-3-Clause) OR BSD-3-Clause

(We can either pick BSD-3-Clause for everything OR a combination of both.)

Or should it be:

   License:        (Apache-2.0 OR BSD-3-Clause) AND BSD-3-Clause

(Some code is BSD-3-Clause and for the rest we can pick either one of them.)


Or is it an AND case (the code is covered by both license "together" (whatever 
that means)? In that case, should it be:

   License:        (Apache-2.0 AND BSD-3-Clause) AND BSD-3-Clause

Or is the current license tag more or less correct:

   License:        Apache-2.0 AND BSD-3-Clause

?

Thanks
-- 
Miro Hrončok
-- 
Phone: [phone]
IRC: mhroncok

[Petr Pisar]

V Mon, Oct 16, 2023 at 03:20:30PM +0200, Miro Hrončok napsal(a):
>  https://github.com/dateutil/dateutil/blob/2.8.2/LICENSE
>  
>  tl;dr:
>  
>  > ...snip Apache-2.0...
>  > 
>  > The above license applies to all contributions after 2017-12-01, as well as
>  > all contributions that have been re-licensed (see AUTHORS file for the list of
>  > contributors who have re-licensed their code).
>  > 
>  > ...snip BSD-3-Clause...
>  > 
>  > The above BSD License Applies to all code, even that also covered by Apache 2.0.
>  
>  In other words. There is a subset of the code which is covered by Apache-2.0
>  and *at the same time* all of the code is covered by BSD-3-Clause.
>  
>  Is that an OR case?
>   
In my humble understanding it is: (Apache-2.0 OR BSD-3-Clause) AND BSD-3-Clause.

-- Petr

[Richard Fontana]

On Mon, Oct 16, 2023 at 10:41 AM Petr Pisar <ppisar(a)redhat.com&gt; wrote:
>  V Mon, Oct 16, 2023 at 03:20:30PM +0200, Miro Hrončok napsal(a):
>  > https://github.com/dateutil/dateutil/blob/2.8.2/LICENSE
>  >
>  > tl;dr:
>  >
>  > > ...snip Apache-2.0...
>  > >
>  > > The above license applies to all contributions after 2017-12-01, as well as
>  > > all contributions that have been re-licensed (see AUTHORS file for the list of
>  > > contributors who have re-licensed their code).
>  > >
>  > > ...snip BSD-3-Clause...
>  > >
>  > > The above BSD License Applies to all code, even that also covered by Apache
> 2.0.
>  >
>  > In other words. There is a subset of the code which is covered by Apache-2.0
>  > and *at the same time* all of the code is covered by BSD-3-Clause.
>  >
>  > Is that an OR case?
>  >
>  In my humble understanding it is: (Apache-2.0 OR BSD-3-Clause) AND BSD-3-Clause. 
Agreed.

Richard

[Miro Hrončok]

On 16. 10. 23 17:09, Richard Fontana wrote:
>  On Mon, Oct 16, 2023 at 10:41 AM Petr Pisar <ppisar(a)redhat.com&gt;
> wrote:
> >
> > V Mon, Oct 16, 2023 at 03:20:30PM +0200, Miro Hrončok napsal(a):
> >> https://github.com/dateutil/dateutil/blob/2.8.2/LICENSE
> >>
> >> tl;dr:
> >>
> >>> ...snip Apache-2.0...
> >>>
> >>> The above license applies to all contributions after 2017-12-01, as well as
> >>> all contributions that have been re-licensed (see AUTHORS file for the list
> of
> >>> contributors who have re-licensed their code).
> >>>
> >>> ...snip BSD-3-Clause...
> >>>
> >>> The above BSD License Applies to all code, even that also covered by Apache
> 2.0.
> >>
> >> In other words. There is a subset of the code which is covered by Apache-2.0
> >> and *at the same time* all of the code is covered by BSD-3-Clause.
> >>
> >> Is that an OR case?
> >>
> > In my humble understanding it is: (Apache-2.0 OR BSD-3-Clause) AND BSD-3-Clause.
>  
>  Agreed. 
Thanks both.

-- 
Miro Hrončok
-- 
Phone: [phone]
IRC: mhroncok

[Ben Beasley]

Speaking as an unqualified observer, as I see it, there are three kinds 
of work in this project:

- Work after 2017-12-01, which is BSD-3-Clause (only).

- Old work for which the maintainers could not secure consent for 
relicensing, which is Apache-2.0 (only).

- Old work for which the maintainers did secure consent for relicensing, 
which is BSD-3-Clause. One might pedantically call this work 
(BSD-3-Clause OR Apache-2.0) since the old license terms can’t be 
rescinded, but this falls into the category of trying to represent 
historical license terms after a relicensing, which I don’t think Fedora 
should want to attempt in general. Since the maintainers don’t *intend* 
to offer a choice of licenses, I think just BSD-3-Clause is a better 
representation for this category.

The part that makes this awkward is that individual files in the binary 
RPMs could contain any combination of these types of work. If you assume 
all possible mixtures are present, and consider only the “most current” 
license (as discussed above, no disjunctive license expression for 
relicensed old work), this would give:

     BSD-3-Clause AND (BSD-3-Clause AND Apache-2.0) AND Apache-2.0

in order to represent the possible combinations of license terms in 
individual installed files.

I’ll stop short of making claims about whether to simplify that as e.g. 
(BSD-3-Clause AND Apache-2.0), or about whether there are actually any 
files that are still Apache-2.0 only.

On 10/16/23 10:41 AM, Petr Pisar wrote:
> V Mon, Oct 16, 2023 at 03:20:30PM +0200, Miro Hrončok napsal(a):
>> https://github.com/dateutil/dateutil/blob/2.8.2/LICENSE
>>
>> tl;dr:
>>
>>> ...snip Apache-2.0...
>>>
>>> The above license applies to all contributions after 2017-12-01, as well as
>>> all contributions that have been re-licensed (see AUTHORS file for the list
of
>>> contributors who have re-licensed their code).
>>>
>>> ...snip BSD-3-Clause...
>>>
>>> The above BSD License Applies to all code, even that also covered by Apache
2.0.
>> In other words. There is a subset of the code which is covered by Apache-2.0
>> and *at the same time* all of the code is covered by BSD-3-Clause.
>>
>> Is that an OR case?
>>
> In my humble understanding it is: (Apache-2.0 OR BSD-3-Clause) AND BSD-3-Clause.
>
> -- Petr
>
> _______________________________________________
> legal mailing list -- legal(a)lists.fedoraproject.org
> To unsubscribe send an email to legal-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Miro Hrončok]

Thanks Ben, but I am a bit confused:

On 16. 10. 23 17:10, Ben Beasley wrote:
>  Speaking as an unqualified observer, as I see it, there are three
> kinds of work 
>  in this project:
>  
>  - Work after 2017-12-01, which is BSD-3-Clause (only). 
This contradicts "The above [Apache-2.0] license applies to all contributions 
after 2017-12-01"

>  - Old work for which the maintainers could not secure consent for
> relicensing, 
>  which is Apache-2.0 (only). 
This contradicts "The above BSD License Applies to all code, even that also 
covered by Apache 2.0." -- there is no code licensed by Apache-2.0 only in this 
project.

>  - Old work for which the maintainers did secure consent for
> relicensing, which 
>  is BSD-3-Clause. One might pedantically call this work (BSD-3-Clause OR 
>  Apache-2.0) since the old license terms can’t be rescinded, but this falls into 
>  the category of trying to represent historical license terms after a 
>  relicensing, which I don’t think Fedora should want to attempt in general. 
>  Since the maintainers don’t *intend* to offer a choice of licenses, I think 
>  just BSD-3-Clause is a better representation for this category. 
And this relies on the two previous points.

-- 
Miro Hrončok
-- 
Phone: [phone]
IRC: mhroncok