Proposal: Standardized License tags

[Stephen John Smoogen]

As of this morning, the Fedora Core and Extras repositories have 2884
src.rpm packages in them. Going through them, there are 191 different
licenses listed.. many of them variants of the same name (and
sometimes a mis-spelling). Some of the names are useful, and others
are odd:

libselinux -- License: Public domain (uncopyrighted)

or

cmucl -- License: Public Domain/MIT

needs an explanation on the mailling lists every now and then. [Like
can you license public domain stuff?

Some license tags give the version of the license.. others also add in
where the person can get a definitive copy of the license. I would
like to start a discussion on having a list of licenses names to be
put in these tags to make it easier for people to keep track of what
is installed on a system.

Something like

GNU GPL version 2 or higher [see /usr/share/fedora-licenses/GPL_v2]
GNU LGPL version 2 or higher [see /usr/share/fedora-license/LGPL_v2]
GNU GPL version 2 ONLY [see /usr/share/fedora-licenses/GPL_v2]
Mozilla Public License (MPL) version 2.0 [see
/usr/share/fedora-licenses/MPL_2.0]

etc.

in the cases of BSD-like/BSD-ish/etc you would refer to the packages
license.. but would use the same syntax.

it would also help to have something more clear on the packages listed
as Distributable (all ~100 of them).. having to figure out the
restrictions on each one is a pain.

-- 
Stephen J Smoogen.
CSIRT/Linux System Administrator

[Michael J. Knox]

Stephen John Smoogen wrote:
>  As of this morning, the Fedora Core and Extras repositories have
> 2884
>  src.rpm packages in them. Going through them, there are 191 different
>  licenses listed.. many of them variants of the same name (and
>  sometimes a mis-spelling). Some of the names are useful, and others
>  are odd:
>  
>  libselinux -- License: Public domain (uncopyrighted)
>  
>  or
>  
>  cmucl -- License: Public Domain/MIT
>  
>  needs an explanation on the mailling lists every now and then. [Like
>  can you license public domain stuff?
>  
>  Some license tags give the version of the license.. others also add in
>  where the person can get a definitive copy of the license. I would
>  like to start a discussion on having a list of licenses names to be
>  put in these tags to make it easier for people to keep track of what
>  is installed on a system.
>  
>  Something like
>  
>  GNU GPL version 2 or higher [see /usr/share/fedora-licenses/GPL_v2]
>  GNU LGPL version 2 or higher [see /usr/share/fedora-license/LGPL_v2]
>  GNU GPL version 2 ONLY [see /usr/share/fedora-licenses/GPL_v2]
>  Mozilla Public License (MPL) version 2.0 [see
>  /usr/share/fedora-licenses/MPL_2.0]
>  
>  etc.
>  
>  in the cases of BSD-like/BSD-ish/etc you would refer to the packages
>  license.. but would use the same syntax.
>  
>  it would also help to have something more clear on the packages listed
>  as Distributable (all ~100 of them).. having to figure out the
>  restrictions on each one is a pain.
>   
Hi,

these are the "valid" licenses as per rpmlint's config found in 
/usr/share/rpmlint/config:

Apache Software License
Artistic
BSD
Commercial
CPL
Distributable
FDL
Freeware
GPL
IBM Public License
LaTeX Project Public License
LGPL
MIT
MPL
NetHack General Public License
Non-distributable
Public Domain
Python Software Foundation License
QPL
Ruby License
Sun Public License
SIL Open Font License
W3C Software License
zlib License

I don't think this list is "authoritive" however, FE packages are meant 
to pass rpmlint checks before inclusion.

Also after reviewing these, looks as if rpmlint's list should be trimmed 
to remove unacceptable licenses like "Commercial" and "freeware"

Michael

[Ville Skyttä]

On Thu, 2006-06-15 at 09:23 +1200, Michael J. Knox wrote:

>  these are the "valid" licenses as per rpmlint's config
> found in 
>  /usr/share/rpmlint/config: 
I suggest forgetting about that list, the next version of upstream
rpmlint will have an updated list of valid license names synced with
http://www.opensource.org/licenses/, see DEFAULT_VALID_LICENSES at
http://rpmlint.zarb.org/cgi-bin/trac.cgi/browser/trunk/TagsCheck.py?rev=1164
The FE rpmlint package will revert to using that list by default.

[Tom Callaway]

On Wed, 2006-06-14 at 15:18 -0600, Stephen John Smoogen wrote:
>  As of this morning, the Fedora Core and Extras repositories have
> 2884
>  src.rpm packages in them. Going through them, there are 191 different
>  licenses listed.. many of them variants of the same name (and
>  sometimes a mis-spelling). Some of the names are useful, and others
>  are odd:
>  
>  libselinux -- License: Public domain (uncopyrighted) 
Isn't this due to unique restrictions around NSA generated source code?

>  Something like
>  
>  GNU GPL version 2 or higher [see /usr/share/fedora-licenses/GPL_v2]
>  GNU LGPL version 2 or higher [see /usr/share/fedora-license/LGPL_v2]
>  GNU GPL version 2 ONLY [see /usr/share/fedora-licenses/GPL_v2]
>  Mozilla Public License (MPL) version 2.0 [see
>  /usr/share/fedora-licenses/MPL_2.0] 
Do we really need to overload this License field with all that? I'd
prefer:

GPL version 2 or higher
LGPL version 2 or higher
GPL version 2
MPL version 2.0

Where the syntax is:

$LICENSE_SHORT_NAME version $LICENSE_VERSION or higher

>  it would also help to have something more clear on the packages
> listed
>  as Distributable (all ~100 of them).. having to figure out the
>  restrictions on each one is a pain. 
Yeah, we should audit the "Distributable" packages. Got a list of those?

~spot
-- 
Tom "spot" Callaway: Red Hat Senior Sales Engineer || GPG ID: 93054260
Fedora Extras Steering Committee Member (RPM Standards and Practices)
Aurora Linux Project Leader: http://auroralinux.org
Lemurs, llamas, and sparcs, oh my!

[Stephen John Smoogen]

On 6/14/06, Tom 'spot' Callaway <tcallawa(a)redhat.com&gt; wrote:
>  On Wed, 2006-06-14 at 15:18 -0600, Stephen John Smoogen wrote:
>  > As of this morning, the Fedora Core and Extras repositories have 2884
>  > src.rpm packages in them. Going through them, there are 191 different
>  > licenses listed.. many of them variants of the same name (and
>  > sometimes a mis-spelling). Some of the names are useful, and others
>  > are odd:
>  >
>  > libselinux -- License: Public domain (uncopyrighted)
>
>  Isn't this due to unique restrictions around NSA generated source code?
>  
Yes. I think it comes under a special exemption for certain US
Government written code.. BUT I am not sure.

>  > Something like
>  >
>  > GNU GPL version 2 or higher [see /usr/share/fedora-licenses/GPL_v2]
>  > GNU LGPL version 2 or higher [see /usr/share/fedora-license/LGPL_v2]
>  > GNU GPL version 2 ONLY [see /usr/share/fedora-licenses/GPL_v2]
>  > Mozilla Public License (MPL) version 2.0 [see
>  > /usr/share/fedora-licenses/MPL_2.0]
>
>  Do we really need to overload this License field with all that? I'd
>  prefer: 
No I do not.. I do wish to have a standard place for Licenses to help
deal with searching for the LGPL Copying that Firefox should have
because it is covered under the MPL and LGPL. I know i have copies of
the LGPL elsewhere.. but knowing that it is in one spot would help.

>  GPL version 2 or higher
>  LGPL version 2 or higher
>  GPL version 2
>  MPL version 2.0
>
>  Where the syntax is:
>
>  $LICENSE_SHORT_NAME version $LICENSE_VERSION or higher
>  
I was wondering about that. Some code has things like GPL v2 ONLY and
some has GPL v2 or higher and some just says GPL version 2.

>  > it would also help to have something more clear on the packages
> listed
>  > as Distributable (all ~100 of them).. having to figure out the
>  > restrictions on each one is a pain.
>
>  Yeah, we should audit the "Distributable" packages. Got a list of those?
>  
Canna -- License: Distributable
FreeWnn -- License: Distributable
adjtimex -- License: distributable
aspell-en -- License: distributable
aspell-nl -- License: distributable
awesfx -- License: GPL/distributable
bin2iso -- License: Distributable (Unknown)
bitmap-fonts -- License: distributable
bitstream-vera-fonts -- License: Redistributable, with restrictions
blacs -- License: Freely distributable
bwidget -- License: Distributable
cleanfeed -- License: distributable
conserver -- License: Distributable
cyrus-sasl -- License: Freely Distributable
dejavu-fonts -- License: Redistributable, with restrictions
dhcp -- License: distributable
diffstat -- License: distributable
docbook-dtds -- License: Distributable
docbook-simple -- License: Distributable
docbook-style-dsssl -- License: Distributable
docbook-style-xsl -- License: Distributable
dos2unix -- License: Freely distributable
epic -- License: Distributable
erlang-esdl -- License: Distributable
eruby -- License: distributable
file -- License: distributable
fonts-ISO8859-2 -- License: Freely distributable
fonts-KOI8-R -- License: distributable
fonts-japanese -- License: Distributable
fonts-korean -- License: Distributable
freeze -- License: Distributable
gnuplot -- License: Redistributable, with restrictions
h2ps -- License: Distributable
hunky-fonts -- License: Redistributable, with restrictions
jadetex -- License: Distributable
jam -- License: Distributable
jlint -- License: Distributable
kinput2 -- License: Distributable
kon2 -- License: distributable
krb5 -- License: MIT, freely distributable.
krbafs -- License: Freely Distributable
lapack -- License: Freely distributable
libjpeg -- License: distributable
libtabe -- License: Redistributable
libtiff -- License: distributable
linuxdoc-tools -- License: Freely distributable
lv -- License: distributable
macutils -- License: Distributable
man-pages -- License: distributable
man-pages-cs -- License: Distributable
man-pages-da -- License: Distributable
man-pages-de -- License: Distributable
man-pages-es -- License: Distributable
man-pages-fr -- License: Distributable
man-pages-it -- License: Distributable
man-pages-ja -- License: Distributable
man-pages-pl -- License: Distributable
man-pages-ru -- License: Distributable
mathml-fonts -- License: Distributable
mgopen-fonts -- License: Redistributable, with restrictions
mod_auth_pam -- License: Distributable
ncftp -- License: Distributable
ncompress -- License: distributable
ncurses -- License: distributable
nhpf -- License: Distributable
ntp -- License: distributable
openjade -- License: Distributable
opensp -- License: Distributable
paraview -- License: Distributable
perl-Crypt-Blowfish -- License: Distributable
perl-File-MMagic -- License: Distributable
perl-Mail-Sender -- License: Distributable
perl-Mail-Sendmail -- License: Distributable
perl-TermReadKey -- License: Distributable
perl-Time-modules -- License: Distributable
ppp -- License: distributable
psutils -- License: distributable
pvm -- License: freely distributable
python-imaging -- License: Distributable
python-numarray -- License: Distributable
qhull -- License: Distributable
ruby-mysql -- License: Distributable
scalapack -- License: Freely distributable
symlinks -- License: distributable
t1utils -- License: Distributable
tcp_wrappers -- License: Distributable
tcsh -- License: distributable
tetex -- License: distributable
tetex-font-kerkis -- License: Distributable
tin -- License: Distributable
torque -- License: Freely redistributable (See PBS_License.txt)
transfig -- License: distributable
ttf2pt1 -- License: Distributable
udunits -- License: Freely distributable (BSD-like)
ufsparse -- License: Distributable
unix2dos -- License: distributable
uqm-content -- License: Distributable
util-linux -- License: distributable
vixie-cron -- License: distributable
wings -- License: Distributable
xinetd -- License: Distributable (BSD-like)
zasx -- License: GPL and freely distributable content
zip -- License: distributable
zoo -- License: Distributable


>  ~spot
>  --
>  Tom "spot" Callaway: Red Hat Senior Sales Engineer || GPG ID: 93054260
>  Fedora Extras Steering Committee Member (RPM Standards and Practices)
>  Aurora Linux Project Leader: http://auroralinux.org
>  Lemurs, llamas, and sparcs, oh my!
>
>  --
>  Fedora-packaging mailing list
>  Fedora-packaging(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-packaging
>  

-- 
Stephen J Smoogen.
CSIRT/Linux System Administrator

[José Abílio Matos]

On Wednesday 14 June 2006 22:46, Stephen John Smoogen wrote:
>  python-imaging -- License: Distributable 
--------------------------------------------------------------------
Software License
--------------------------------------------------------------------

The Python Imaging Library is

Copyright (c) 1997-2005 by Secret Labs AB
Copyright (c) 1995-2005 by Fredrik Lundh

By obtaining, using, and/or copying this software and/or its
associated documentation, you agree that you have read, understood,
and will comply with the following terms and conditions:

Permission to use, copy, modify, and distribute this software and its
associated documentation for any purpose and without fee is hereby
granted, provided that the above copyright notice appears in all
copies, and that both that copyright notice and this permission notice
appear in supporting documentation, and that the name of Secret Labs
AB or the author not be used in advertising or publicity pertaining to
distribution of the software without specific, written prior
permission.

SECRET LABS AB AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO
THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS.  IN NO EVENT SHALL SECRET LABS AB OR THE AUTHOR BE LIABLE FOR
ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.


--------------------------------------------------------------------

  I guess that this fits into 
http://www.opensource.org/licenses/bsd-license.php

  since it has the no-endorsement clause. OTOH IANAL (a nice use of 
acronyms ;-).

-- 
José Abílio

[Nicolas Mailhot]

Le mercredi 14 juin 2006 à 15:18 -0600, Stephen John Smoogen a écrit :

>  Something like
>  
>  GNU GPL version 2 or higher [see /usr/share/fedora-licenses/GPL_v2]
>  GNU LGPL version 2 or higher [see /usr/share/fedora-license/LGPL_v2]
>  GNU GPL version 2 ONLY [see /usr/share/fedora-licenses/GPL_v2]
>  Mozilla Public License (MPL) version 2.0 [see
>  /usr/share/fedora-licenses/MPL_2.0] 
I think Mandriva packages common licenses in separate packages, and have
packages which use those licenses depend on those packages. But last
time this was brought on the table people felt this was dangerous
legally and each package should have its own license payload.

Now what hasn't been tried yet is to have this payload install in
standard places, which if my understanding of rpm is correct will work,
as long as each  GPL version 2 package (for example) uses the same file
with no indenting changes

And come to think of it, if rpm barfs because two files install the same
license text, but the md5sum of the license files differ, well there is
some risk one of the projects is not using the original license anymore,
but some "improved" (and probably no longer OSI-compliant) version.

However since some licensing templates put the author/project name in
the license text, all licenses may not fit in this scheme.

Gwaaaa, why do you put this on the table, head is hurting, need to go to
sleep ;)

Regards,

-- 
Nicolas Mailhot

[Rex Dieter]

Stephen John Smoogen wrote:
>   Some of the names are useful, and others are odd: 
>  cmucl -- License: Public Domain/MIT 
Origin of that is:
http://bugzilla.redhat.com/bugzilla/166796#c13
and
http://bugzilla.redhat.com/bugzilla/166796#c14

Please correct me if my interpretation of the license text was erroneous.

-- Rex