Legal Team/only-operator-proposal - Revision history

Jlovejoy at 01:25, 30 September 2017

2017-09-30T01:25:16Z

Jlovejoy at 01:24, 30 September 2017

2017-09-30T01:24:52Z

Jlovejoy at 14:49, 8 September 2017

2017-09-08T14:49:16Z

Bkuhn: /* Proposed Solution: add only operator */ FSF was not on most of the calls; Conservancy was not represented: I appeared in my own capacity and made that clear

2017-09-07T22:39:44Z

‎Proposed Solution: add only operator: FSF was not on most of the calls; Conservancy was not represented: I appeared in my own capacity and made that clear

Wking: Mention version-operator-compatiblity metadata as a way to automatically detect ambiguous license expressions

2017-09-07T19:38:28Z

Mention version-operator-compatiblity metadata as a way to automatically detect ambiguous license expressions

Wking: Mention John Sullivan checking with the FSF for the license version implied by a copy of the license text (although I don't know what he found)

2017-09-07T19:31:07Z

Mention John Sullivan checking with the FSF for the license version implied by a copy of the license text (although I don't know what he found)

Wking: Fix “do” → “does” typos for CDDL examples

2017-09-07T19:04:25Z

Fix “do” → “does” typos for CDDL examples

Wking: Link back to Legal_Team/or-later-vs-unclear-disambiguation

2017-09-07T19:01:59Z

Link back to Legal_Team/or-later-vs-unclear-disambiguation

Jlovejoy: /* Proposed Solution */

2017-09-07T04:41:01Z

‎Proposed Solution

Jlovejoy: /* Issue */

2017-09-07T04:31:40Z

‎Issue

@@ Line 41: / Line 41: @@
 ## 4.5 Concluded License at file level - same as for package level due to notices
 ## Note: in the current reality, <code>GPL-2.0</code> for the license text file would mean "only", yet one cannot determine from that file alone if the copyright holder intends to use the version only or the or later option (see example 4).  Also note, that a machine can positively identify the "or later" option via the use of recommended standard license header. This would be the same scenario, but with GPL-2.0 if the license header did not evoke the "any later version" language.
 # '''you find: no license file; 4 source files with the statement, “This is licensed under GPL" '''
 ## 4.6 License Information in File: 4 source files = <code>NOASSERTION</code> - because the information doesn't match anything on the SPDX License List or standard headers.
@@ Line 48: / Line 47: @@
 ## 3.13 Concluded License package = <code>GPL-1.0+</code>
 ## Note: The determination of <code>GPL-1.0+</code> would be made by a human. But given the language of the GPL stating, "If the Program does not specify a version number of the license, you may choose any version ever published by the Free Software Foundation." and the short identifier <code>GPL-1.0+</code> covers any version.
 # '''you find: 1 license file with GPLv2 license text; 4 source files with no license information whatsoever (aka, the Github example)'''
 ##  4.6 License Information in File:

@@ Line 33: / Line 33: @@
 The scenarios below map out various examples and how one would identify the [https://spdx.org/spdx-specification-21-web-version#h.111kx3o License Information in File] and then the [https://spdx.org/spdx-specification-21-web-version#h.ihv636 Concluded License for the package] using SPDX short identifiers and bearing in mind machine reading for this task.  Some of these scenarios have been discussed on the various calls on this topic as to how one would identify the license short identifier for each file currently:
-# '''you find: 1 text file with the license text of GPL-2.0; and 4 source files with the standard header for GPL-2.0, which include the language "any later version" '''
+# '''you find: 1 text file with the license text of GPLv2; and 4 source files with the standard header for GPLv2, which include the language "any later version" '''
-##  1 text file with license text of GPL-2.0 = <code>GPL-2.0</code>
+##  4.6 License Information in File:
-##  4 source files with standard header for GPL-2.0, which include the language "any later version" = <code>GPL-2.0+</code>
+### 1 text file with license text of GPLv2 = as <code>GPL-2.0</code> means "only" - this is hard to determine, and different tools may handle this in different ways, including <code>NOASSERTION</code>
-## Concluded package license = <code>GPL-2.0+</code>
+###  4 source files with standard header for GPLv2, which include the language "any later version" = <code>GPL-2.0+</code>
-## Note: in the current reality, <code>GPL-2.0</code> for the license text file would mean "only", yet one cannot determine from that file alone if the copyright holder intends to use the version only or the or later option (see example 4).  Also note, that a machine can positively identify the "or later" option via the use of recommended standard license header.
+## 3.15 Declared License: same issue as for determining identifier for text file with license text of GPLv2 as above
-# '''you find: 1 file with the license text of GPL-2.0; and 4 source files with the standard header for GPL-2.0, which omits the language "any later version" '''
+## 3.13 Concluded License at package level = <code>GPL-2.0+</code>
-## 1 text file with license text of GPL-2.0 = <code>GPL-2.0</code>
+## 4.5 Concluded License at file level - same as for package level due to notices
-## 4 source files with standard header for GPL-2.0, which omits the language "any later version" = <code>GPL-2.0</code>
+## Note: in the current reality, <code>GPL-2.0</code> for the license text file would mean "only", yet one cannot determine from that file alone if the copyright holder intends to use the version only or the or later option (see example 4).  Also note, that a machine can positively identify the "or later" option via the use of recommended standard license header. This would be the same scenario, but with GPL-2.0 if the license header did not evoke the "any later version" language.
-## Concluded package license = <code>GPL-2.0</code>
-## Note: Same comment as #1 re: license text file.  Also note, that a machine can positively identify the "only" option via the use of recommended standard license header which omits the "any later version" text.
 # '''you find: no license file; 4 source files with the statement, “This is licensed under GPL" '''
-## 4 source files = <code>GPL-1.0+</code>
+## 4.6 License Information in File: 4 source files = <code>NOASSERTION</code> - because the information doesn't match anything on the SPDX License List or standard headers.
-## Concluded package = <code>GPL-1.0+</code>
+## 3.15 Declared License (for package) = NONE (because no license file was found); NOASSERTION would also be an option
-## Note: The determination of <code>GPL-1.0+</code> would most likely need to be made by a human. But given the language of the GPL stating, "If the Program does not specify a version number of the license, you may choose any version ever published by the Free Software Foundation." and that no version indicated in any manner whatsoever, we can feel reasonably confidant that any version can be applied and the short identifier <code>GPL-1.0+</code> covers any version.
+## 4.5 Concluded License at file level = <code>GPL-1.0+</code>
-# '''you find: 1 license file with GPL-2.0 license text; 4 source files with no license information whatsoever (aka, the Github example)'''
+## 3.13 Concluded License package = <code>GPL-1.0+</code>
-## 1 text file with license text of GPL-2.0 = <code>GPL-2.0</code>
+## Note: The determination of <code>GPL-1.0+</code> would be made by a human. But given the language of the GPL stating, "If the Program does not specify a version number of the license, you may choose any version ever published by the Free Software Foundation." and the short identifier <code>GPL-1.0+</code> covers any version.
 ## 4 source files with no license information whatsoever = NONE (as per SPDX specification)
-## Concluded license = ??
+# '''you find: 1 license file with GPLv2 license text; 4 source files with no license information whatsoever (aka, the Github example)'''
-## Question: Is including a copy of a particular version of the license "the Program specif[ying] a version number of the license which applies to it" and thus we can confidently conclude the package is GPL-2.0?  Is the "or later" option triggered due to the language or would that be too far of a step to take? See [https://lists.spdx.org/pipermail/spdx-legal/2017-September/002162.html one interpretation from mailing list here].
+##  4.6 License Information in File:
 ## Answer: John Sullivan from the FSF was [[Legal_Team/or-later-vs-unclear-disambiguation#Alternative_Solution_-_Do_Not_Deprecated_GPL-2.0|going to check for a FSF position on this]].

@@ Line 31: / Line 31: @@
 ===Examples / Challenges===
-The scenarios below map out various examples and how one would identify the [https://spdx.org/spdx-specification-21-web-version#h.111kx3o License Information in File] using SPDX short identifiers and bearing in mind machine reading for this task.  Some of these scenarios have been discussed on the various calls on this topic as to how one would identify the license short identifier for each file currently (and under the proposal, see below).  In any case, these scenarios need to have clear indication as to appropriate interpretation:
+The scenarios below map out various examples and how one would identify the [https://spdx.org/spdx-specification-21-web-version#h.111kx3o License Information in File] and then the [https://spdx.org/spdx-specification-21-web-version#h.ihv636 Concluded License for the package] using SPDX short identifiers and bearing in mind machine reading for this task.  Some of these scenarios have been discussed on the various calls on this topic as to how one would identify the license short identifier for each file currently:
 # '''you find: 1 text file with the license text of GPL-2.0; and 4 source files with the standard header for GPL-2.0, which include the language "any later version" '''
@@ Line 37: / Line 37: @@
 ##  4 source files with standard header for GPL-2.0, which include the language "any later version" = <code>GPL-2.0+</code>
 ## Concluded package license = <code>GPL-2.0+</code>
-## Note: in the current reality, <code>GPL-2.0</code> for the license text file would mean "only", yet one cannot determine from that file alone if the copyright holder intends to use the version only or the or later option.  Also note, that a machine can positively identify the "or later" option via the use of recommended standard license header.
+## Note: in the current reality, <code>GPL-2.0</code> for the license text file would mean "only", yet one cannot determine from that file alone if the copyright holder intends to use the version only or the or later option (see example 4).  Also note, that a machine can positively identify the "or later" option via the use of recommended standard license header.
 # '''you find: 1 file with the license text of GPL-2.0; and 4 source files with the standard header for GPL-2.0, which omits the language "any later version" '''
 ## 1 text file with license text of GPL-2.0 = <code>GPL-2.0</code>
@@ Line 43: / Line 43: @@
 ## Concluded package license = <code>GPL-2.0</code>
 ## Note: Same comment as #1 re: license text file.  Also note, that a machine can positively identify the "only" option via the use of recommended standard license header which omits the "any later version" text.
-# '''you find: no license file; 4 source files with the statement, “this is licensed under GPL" '''
+# '''you find: no license file; 4 source files with the statement, “This is licensed under GPL" '''
 ## 4 source files = <code>GPL-1.0+</code>
 ## Concluded package = <code>GPL-1.0+</code>
-## Note: The determination of <code>GPL-1.0+</code> would most likely need to be made by a human. But given the language of the GPL stating, "If the Program does not specify a version number of the license, you may choose any version ever published by the Free Software Foundation." and no version indicated in any manner whatsoever, we can feel reasonably confidant that any version can be applied and the short identifier <code>GPL-1.0+</code> covers any version.
+## Note: The determination of <code>GPL-1.0+</code> would most likely need to be made by a human. But given the language of the GPL stating, "If the Program does not specify a version number of the license, you may choose any version ever published by the Free Software Foundation." and that no version indicated in any manner whatsoever, we can feel reasonably confidant that any version can be applied and the short identifier <code>GPL-1.0+</code> covers any version.
-# '''you find: 1 license file with GPL-2.0 license text; 4 source files with no license information whatsoever'''
+# '''you find: 1 license file with GPL-2.0 license text; 4 source files with no license information whatsoever (aka, the Github example)'''
 ## 1 text file with license text of GPL-2.0 = <code>GPL-2.0</code>
 ## 4 source files with no license information whatsoever = NONE (as per SPDX specification)
 ## Concluded license = ??
-## Question: Is including a copy of a particular version of the license "the Program specif[ying] a version number of the license which applies to it" and thus we can confidantly conclude the package is GPL-2.0+?
+## Question: Is including a copy of a particular version of the license "the Program specif[ying] a version number of the license which applies to it" and thus we can confidently conclude the package is GPL-2.0?  Is the "or later" option triggered due to the language or would that be too far of a step to take? See [https://lists.spdx.org/pipermail/spdx-legal/2017-September/002162.html one interpretation from mailing list here].
-## Answer: John Sullivan was [[Legal_Team/or-later-vs-unclear-disambiguation#Alternative_Solution_-_Do_Not_Deprecated_GPL-2.0|going to check for a FSF position on this]].  I'm not clear on what his reported findings were, but I expect they decided not to take a formal position on it.
+## Answer: John Sullivan from the FSF was [[Legal_Team/or-later-vs-unclear-disambiguation#Alternative_Solution_-_Do_Not_Deprecated_GPL-2.0|going to check for a FSF position on this]].
 ==Goals==

@@ Line 60: / Line 60: @@
 ==Proposed Solution: add <code>only</code> operator==
-Based on the various legal and tech calls and including representatives from the FSF, SFC, and LF (some notes in [[Legal Team/or-later-vs-unclear-disambiguation]]), we coalesced around the following proposal:
+Based on the various legal and tech calls and including representatives from the LF (some notes in [[Legal Team/or-later-vs-unclear-disambiguation]]), we coalesced around the following proposal:
 '''Create an "only" operator defined as to be used to indicate 'only the version of the license is intended for use' '''

@@ Line 77: / Line 77: @@
 Potential issues:
 * Backwards compatibility for GPL-2.0 meaning 'only' to now meaning 'whatever the license says' creates some inconsistency as the default position of the license text with no other info is "or later" or "any version", not "only".  However, it was pointed out on the call that those people conscientious enough to be using GPL-2.0 correctly, will be more likely to be conscientious enough to add the <code>only</code> operator as needed once it's available. All seemed to agree that use of GPL-2.0 is probably not thought through as to "or later" or "only", and thus in these situations, there is no different meaning.
-* Does not make clear indication of "ambiguous" situation to push people towards using 'only' and '+' operators to be explicit (preferred).  However, we don't have a clear indication of ambiguity now either (is ambiguity ever clear?).
+* Does not make clear indication of "ambiguous" situation to push people towards using 'only' and '+' operators to be explicit (preferred).  However, we don't have a clear indication of ambiguity now either (is ambiguity ever clear?).  You can clearly detect the ambiguous situations in tooling if you add metadata to license definitions recording whether they are compatible with the various version-related operators (as discussed [[Legal Team/or-later-vs-unclear-disambiguation#Alternative_Solution_-_create_-only_and_PROXY_.7BTEXT.7D_operators_for_licenses_that_explicitly_declare_their_compatibility|here]] and [https://lists.spdx.org/pipermail/spdx-legal/2017-August/002126.html here]).
 * GPL language is clear that it is one or the other, so this could create more confusion and not reflect the intention of the license. However, all agreed that when you have a machine scanning code with no other license info other than a file with the license text of GPL-2.0, this is not entirely clear situation.

@@ Line 23: / Line 23: @@
 Notably, most licenses that reference the possibility of later versions can be read to say you can take and redistribute the work under the license you found it with or any other later version with no explicit option of 'this version only.'
-The CDDL family is slightly different in that the CDDL is “or later” by default and “only” with [https://github.com/spdx/license-list-XML/blob/7ecb7363bc82aedd0e293ca8825e348181619e6a/src/CDDL-1.1.xml#L279-L289 an explicit notice prohibiting later versions].  There's currently no <code>only</code> operator for the CDDL, although some code (e.g. [https://github.com/freebsd/freebsd/blob/2c31a4b74c2e41b0c7407c9830e22bfd07150af0/uts/common/fs/zfs/abd.c#L2-L5 parts of FreeBSD's ZFS implementation]) do declare that prohibition while other code (e.g. [https://github.com/illumos/illumos-gate/blob/a9bfd41d542f15c474711abb8b0ca66a4cef9918/usr/src/common/acl/acl_common.h#L2-L19 some illumos userspace tools]) do not (and are therefore presumably CDDL-1.0+).
+The CDDL family is slightly different in that the CDDL is “or later” by default and “only” with [https://github.com/spdx/license-list-XML/blob/7ecb7363bc82aedd0e293ca8825e348181619e6a/src/CDDL-1.1.xml#L279-L289 an explicit notice prohibiting later versions].  There's currently no <code>only</code> operator for the CDDL, although some code (e.g. [https://github.com/freebsd/freebsd/blob/2c31a4b74c2e41b0c7407c9830e22bfd07150af0/uts/common/fs/zfs/abd.c#L2-L5 parts of FreeBSD's ZFS implementation]) does declare that prohibition while other code (e.g. [https://github.com/illumos/illumos-gate/blob/a9bfd41d542f15c474711abb8b0ca66a4cef9918/usr/src/common/acl/acl_common.h#L2-L19 some illumos userspace tools]) does not (and is therefore presumably CDDL-1.0+).
 ===Issue===

@@ Line 58: / Line 58: @@
 * Ensure that there is some amount of consistency with what the short identifiers mean / Don't completely break the meaning for current users
-==Proposed Solution==
+==Proposed Solution: add <code>only</code> operator==
-Based on the joint legal/tech call on 17  August 2017, we coalesced around a solution similar to "alternative option" from 8 Aug joint call:
+Based on the various legal and tech calls and including representatives from the FSF, SFC, and LF, we coalesced around the following proposal:
-For licenses that may include “only” or “or later” (or both) clauses in the license text, having an explicit <code>+</code> and an explicit <code>only</code>, to use in SPDX identifiers reduces the chance that an unfamiliar user misinterprets the identifier and provides a way to be explicit and accurate that was arguably not available before.  This leaves teh ability to use the "plain" license identifier (without an operator) to indicate the existence of the license text itself or other scenarios where it is not clear whether the "or later" or "only" options are articulated by the copyright holder.
+'''Create an "only" operator defined as to be used to indicate 'only the version of the license is intended for use' '''
-* Create an "only" operator defined as to be used to indicate 'only the version of the license is intended for use'.
+For licenses that may include “only” or “or later” (or both) clauses in the license text, having explicit <code>+</code> and <code>only</code> operators to use in SPDX identifiers reduces the chance that an unfamiliar user mis-uses or misinterprets the identifier and provides a way to be explicit and accurate that was arguably not available before.  This solution allows the license text to speak for itself (via the "plain" license identifier) and uses the <code>only</code> and <code>+</code> operators to be explicit in intent.
-** add new "only" operator to Appendix IV: SPDX License Expressions of spec and explanatory language
-* The + operator would remain with the same definition.
+This leaves the ability to use the "plain" license identifier (without an operator) to indicate the existence of the license text itself or other scenarios where it is not clear whether the "or later" or "only" options are articulated by the copyright holder. This avoids SPDX having to make an interpretation as to what the licenses mean or intend. This would also bring into consistency the use of "plain" identifiers for all other licenses that have "or later" clauses.
-* In the spec, clarify that the license ID used by itself would indicate that the license text itself should be used to determine if later versions of the license could be used.
-** This avoids SPDX having to make an interpretation as to what the licenses mean/intend.
+The + operator would remain with the same definition.
-** Allows for use of GPL-2.0 when you find just the license file with the text of GPL-2.0 and still provides option for Concluded License to be GPL-1.0+ if no other info is found
-* Remove "only" from full name of GPL family.
+Necessary/associated changes:
-* This solution allows the license text to speak for itself and uses the 'only' and '+' operators to be explicit in intent. It also avoids conflicting operators by retaining the "plain" license identifier.
+*  add new "only" operator to Appendix IV: SPDX License Expressions of spec and explanatory language as to how/when to use it.
 Potential issues:
-* Backwards compatibility for GPL-2.0 meaning 'v2-only' to now meaning 'whatever the license says' creates some inconsistency as the default position of the license text with no other info is "or later" or "any version", not "only".  However, it was pointed out on the call that those people conscientious enough to be using GPL-2.0 correctly, will be more likely to be conscientious enough to add the "-only" operator as needed/once it's available. All seemed to agree that use of GPL-2.0 is probably not thought through as to "or later" or "only", and thus in these situations, there is no different meaning.
+* Backwards compatibility for GPL-2.0 meaning 'only' to now meaning 'whatever the license says' creates some inconsistency as the default position of the license text with no other info is "or later" or "any version", not "only".  However, it was pointed out on the call that those people conscientious enough to be using GPL-2.0 correctly, will be more likely to be conscientious enough to add the <code>only</code> operator as needed once it's available. All seemed to agree that use of GPL-2.0 is probably not thought through as to "or later" or "only", and thus in these situations, there is no different meaning.
 * Does not make clear indication of "ambiguous" situation to push people towards using 'only' and '+' operators to be explicit (preferred).  However, we don't have a clear indication of ambiguity now either (is ambiguity ever clear?).
-* L/GPL language is clear that it is one or the other, so this could create more confusion and not reflect the intention of the license. However, all agreed that when you have a machine scanning code with no other license info other than a file with the license text of GPL-2.0, this is not entirely clear situation.
+* GPL language is clear that it is one or the other, so this could create more confusion and not reflect the intention of the license. However, all agreed that when you have a machine scanning code with no other license info other than a file with the license text of GPL-2.0, this is not entirely clear situation.

@@ Line 26: / Line 26: @@
 ===Issue===
-In practice, practitioners are not always explicit about whether a license is a version only or or later option.  Also, because the "only" or "or later" distinction often is found outside the actual license text (e.g., in a license notice or header in the source files), machines (and humans) need a way to identify the license file itself without determining (yet) if the package is "only" or "or later".
+In practice, practitioners are not always explicit about whether a license is a version only or or later option.  Also, because the "only" or "or later" distinction often is found outside the actual license text (e.g., in a license notice or header in the source files), machines (and humans) need a way to identify the license file itself without determining (yet) if the package is "only" or "or later".  In other words, there is currently no way to express 'I just found this license text and am not sure what the package license is' using only license expressions.
 The SPDX specification provides a way to distinguish between what is [https://spdx.org/spdx-specification-21-web-version#h.111kx3o detected license files] and the [https://spdx.org/spdx-specification-21-web-version#h.2lwamvv concluded file license] as well as similar fields at the package level when creating an SPDX document.  But before getting to that point, tools must have ways to correctly identify what is precisely found in the files without having to draw a conclusion.  Also, as discussed in the 2017-08-08 meeting, some ecosystems restrict themselves to license expressions (e.g. [https://docs.npmjs.com/files/package.json#license npm allows SPDX 2.0 license expressions]), and some tools attempt to detect package licenses by looking only at the license files and not at license-grant blurbs (e.g. [https://github.com/benbalter/licensee/blob/v9.2.0/docs/what-we-look-at.md Licensee], which is [https://developer.github.com/v3/licenses/ used by the GitHub license API]).