clarification on -only and -or-later

clarification on -only and -or-later

[J Lovejoy]

Hi all,

We discussed some example of “interpreting” GPL non-standard notices in terms of when -only or -or-later. I wanted to  make sure we all agree.  Here are some examples for illustration and rationale:

1) where no version is indicated, the license text of GPL (all versions) tells us what to do, " If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation.” 
- thus, use: SPDX-License-Identifier: GPL-1.0-or-later

example:

*  May be copied or modified under the terms of the GNU General Public License

2) where a version is indicated, but no language to the effect of “or any later version” is included. The license text of GPL (all versions) arguably speaks to this with, "If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation.”
Also, the standard header either includes "or (at your option) any later version” or simply removes that to indicate ‘only this version’
- thus, use: SPDX-License-Identifier: GPL-2.0-only

examples: 

 * This driver is released to the public under the terms of the
 *  GNU GENERAL PUBLIC LICENSE version 2
 * See the file COPYING for details.

* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 as published by
* the Free Software Foundation.

3) where the license notice in the file simply points to the COPYING file or some other license file that contains the full text of GPL-2.0
This is a tougher call, as there isn’t really any arguably clear call, but my thinking is that we’d use:
SPDX-License-Identifier: GPL-2.0-or-later
I guess I’d justify that (loosely) because the default license - in this case, GPL-2.0 - contains the default standard header which has the “or any later version” language and no one did anything to remove that or otherwise indicate a limitation, but at least did provide a version of the license, so I’d feel comfortable saying it’s GPL-2.0-or-later.
Note: we had long discussions on this kind of example on SPDX and there were some good arguments made to say it could just be GPL-2.0 - so I could be swayed here. At the end of the day, we are stuck with someone who didn’t take the care enough to tell us or use the standard header. And while we could go back to the copyright holder, that may not always be feasible.

examples:

 * This file is subject to the terms and conditions of the GNU General Public
 * License.  See the file "COPYING" in the main directory of this archive
 * for more details.

 * See LICENSE.qla2xxx for copyright and licensing details.
(where that file is a copy of GPL-2.0) 


Thanks,
Jilayne

Re: clarification on -only and -or-later

[Greg KH]

On Mon, May 20, 2019 at 12:40:45PM -0600, J Lovejoy wrote:
> Hi all,
> 
> We discussed some example of “interpreting” GPL non-standard notices
> in terms of when -only or -or-later. I wanted to  make sure we all
> agree.  Here are some examples for illustration and rationale:

This all pertains to the kernel, correct?  Other projects may have
different viewpoints.

> 1) where no version is indicated, the license text of GPL (all
> versions) tells us what to do, " If the Program does not specify a
> version number of this License, you may choose any version ever
> published by the Free Software Foundation.” 
> - thus, use: SPDX-License-Identifier: GPL-1.0-or-later
> 
> example:
> 
> *  May be copied or modified under the terms of the GNU General Public License
> 
> 2) where a version is indicated, but no language to the effect of “or
> any later version” is included. The license text of GPL (all versions)
> arguably speaks to this with, "If the Program specifies a version
> number of this License which applies to it and "any later version",
> you have the option of following the terms and conditions either of
> that version or of any later version published by the Free Software
> Foundation.”
> Also, the standard header either includes "or (at your option) any later version” or simply removes that to indicate ‘only this version’
> - thus, use: SPDX-License-Identifier: GPL-2.0-only

Or the older format:
	GPL-2.0

> examples: 
> 
>  * This driver is released to the public under the terms of the
>  *  GNU GENERAL PUBLIC LICENSE version 2
>  * See the file COPYING for details.
> 
> * This program is free software; you can redistribute it and/or modify it
> * under the terms of the GNU General Public License version 2 as published by
> * the Free Software Foundation.
> 
> 3) where the license notice in the file simply points to the COPYING file or some other license file that contains the full text of GPL-2.0
> This is a tougher call, as there isn’t really any arguably clear call, but my thinking is that we’d use:
> SPDX-License-Identifier: GPL-2.0-or-later

No, not at all, because the COPYING file is 2.0, why would we assume
that any new version would be acceptable?

When files have said "see the COPYING file" or text like that, we are
marking them:
	GPL-2.0

> I guess I’d justify that (loosely) because the default license - in
> this case, GPL-2.0 - contains the default standard header which has
> the “or any later version” language

No, there is no such "standard header here".

> and no one did anything to remove that or otherwise indicate a
> limitation, but at least did provide a version of the license, so I’d
> feel comfortable saying it’s GPL-2.0-or-later.

Nope, if it does not say "or later" in the text in the file, we will not
mark it "or later".

That is how we have been operating with these tags for over a year now,
we can not change this at this late date, sorry, this has already been
decided.

> Note: we had long discussions on this kind of example on SPDX and
> there were some good arguments made to say it could just be GPL-2.0 -
> so I could be swayed here. At the end of the day, we are stuck with
> someone who didn’t take the care enough to tell us or use the standard
> header. And while we could go back to the copyright holder, that may
> not always be feasible.
> 
> examples:
> 
>  * This file is subject to the terms and conditions of the GNU General Public
>  * License.  See the file "COPYING" in the main directory of this archive
>  * for more details.
> 
>  * See LICENSE.qla2xxx for copyright and licensing details.
> (where that file is a copy of GPL-2.0) 

Again, "GPL-2.0".  Pretty simple :)

thanks,

greg k-h

Re: clarification on -only and -or-later

[J Lovejoy]

> On May 20, 2019, at 12:52 PM, Greg KH <gregkh@linuxfoundation.org> wrote:
> 
> On Mon, May 20, 2019 at 12:40:45PM -0600, J Lovejoy wrote:
>> Hi all,
>> 
>> We discussed some example of “interpreting” GPL non-standard notices
>> in terms of when -only or -or-later. I wanted to  make sure we all
>> agree.  Here are some examples for illustration and rationale:
> 
> This all pertains to the kernel, correct?  Other projects may have
> different viewpoints.

yes, that’s why I was posting on this list :)
should have mentioned above this was me trying to remember the discussion from a session at the FSFE event in Barcelona where we discussed some of the “non-standard” license headers.
> 
>> 1) where no version is indicated, the license text of GPL (all
>> versions) tells us what to do, " If the Program does not specify a
>> version number of this License, you may choose any version ever
>> published by the Free Software Foundation.” 
>> - thus, use: SPDX-License-Identifier: GPL-1.0-or-later
>> 
>> example:
>> 
>> *  May be copied or modified under the terms of the GNU General Public License

so, I’m assuming you agree with scenario 1?

>> 
>> 2) where a version is indicated, but no language to the effect of “or
>> any later version” is included. The license text of GPL (all versions)
>> arguably speaks to this with, "If the Program specifies a version
>> number of this License which applies to it and "any later version",
>> you have the option of following the terms and conditions either of
>> that version or of any later version published by the Free Software
>> Foundation.”
>> Also, the standard header either includes "or (at your option) any later version” or simply removes that to indicate ‘only this version’
>> - thus, use: SPDX-License-Identifier: GPL-2.0-only
> 
> Or the older format:
> 	GPL-2.0
> 
>> examples: 
>> 
>> * This driver is released to the public under the terms of the
>> *  GNU GENERAL PUBLIC LICENSE version 2
>> * See the file COPYING for details.
>> 
>> * This program is free software; you can redistribute it and/or modify it
>> * under the terms of the GNU General Public License version 2 as published by
>> * the Free Software Foundation.
>> 
>> 3) where the license notice in the file simply points to the COPYING file or some other license file that contains the full text of GPL-2.0
>> This is a tougher call, as there isn’t really any arguably clear call, but my thinking is that we’d use:
>> SPDX-License-Identifier: GPL-2.0-or-later
> 
> No, not at all, because the COPYING file is 2.0, why would we assume
> that any new version would be acceptable?
> 
> When files have said "see the COPYING file" or text like that, we are
> marking them:
> 	GPL-2.0
> 
>> I guess I’d justify that (loosely) because the default license - in
>> this case, GPL-2.0 - contains the default standard header which has
>> the “or any later version” language
> 
> No, there is no such "standard header here".
> 
>> and no one did anything to remove that or otherwise indicate a
>> limitation, but at least did provide a version of the license, so I’d
>> feel comfortable saying it’s GPL-2.0-or-later.
> 
> Nope, if it does not say "or later" in the text in the file, we will not
> mark it "or later”.

well, the standard license text includes the exhibit on how to apply the license terms, which includes the recommended standard license notice and that does include "or (at your option) any later version.” - sorry, I wasn’t clear on what I meant above. 
> 
> That is how we have been operating with these tags for over a year now,
> we can not change this at this late date, sorry, this has already been
> decided.

This is the one I couldn’t remember how it came out as it can be argued either way, so thanks for clarifying.
So, direct reference to a license text file that contains GPL-2.0 will thus be marked as:
GPL-2.0-only (or old SPDX identifier, SPDX-2.0)

> 
>> Note: we had long discussions on this kind of example on SPDX and
>> there were some good arguments made to say it could just be GPL-2.0 -
>> so I could be swayed here.

I should have added that I think you can make a viable argument either way. During the discussions with FSF regarding changing the SPDX identifiers for greater clarity, we didn’t get a “default position” of intention from the FSF on what this means. 

Given the kernel is generally GPL-2.0-only, the position here that reference to the license file is for ’that version only’ makes sense.

Just wanted to make sure I remembered and it is all consistent. (I did not meant to imply I wanted to re-open the debate, had enough of that one on the SPDX discussions! ;)

>> At the end of the day, we are stuck with
>> someone who didn’t take the care enough to tell us or use the standard
>> header. And while we could go back to the copyright holder, that may
>> not always be feasible.
>> 
>> examples:
>> 
>> * This file is subject to the terms and conditions of the GNU General Public
>> * License.  See the file "COPYING" in the main directory of this archive
>> * for more details.
>> 
>> * See LICENSE.qla2xxx for copyright and licensing details.
>> (where that file is a copy of GPL-2.0) 
> 
> Again, "GPL-2.0".  Pretty simple :)
> 
> thanks,
> 
> greg k-h

Re: clarification on -only and -or-later

[Allison Randal]

On 5/20/19 8:26 PM, J Lovejoy wrote:
> 
> Given the kernel is generally GPL-2.0-only, the position here that reference to the license file is for ’that version only’ makes sense.
> 
> Just wanted to make sure I remembered and it is all consistent. (I did not meant to imply I wanted to re-open the debate, had enough of that one on the SPDX discussions! ;)

Nod, what I recall from the session in Barcelona was:

- If the notice gives a specific license version number, we only use
-or-later in the SPDX identifier if the notice explicitly says "or
later". The default is "-only" (or just the version number).

- If the notice gives no version number, the standard interpretation is
that the user can take that as any version of the GPL, which technically
would be 1.0-or-later. But, it would also be fine to take the file as
2.0-or-later, which was generally legally preferred. It was not
preferred to use 2.0-only in the case of no version number, because it's
very possible that existing users are already using the standard
interpretation to take those files as GPLv3, and we don't want to cause
them problems. (On the flip side, it's massively unlikely that anyone is
using the standard interpretation to take those files as GPLv1, so we
can safely drop it.)

Allison

Re: clarification on -only and -or-later

[J Lovejoy]

> On May 20, 2019, at 3:35 PM, Allison Randal <allison@lohutok.net> wrote:
> 
> On 5/20/19 8:26 PM, J Lovejoy wrote:
>> 
>> Given the kernel is generally GPL-2.0-only, the position here that reference to the license file is for ’that version only’ makes sense.
>> 
>> Just wanted to make sure I remembered and it is all consistent. (I did not meant to imply I wanted to re-open the debate, had enough of that one on the SPDX discussions! ;)
> 
> Nod, what I recall from the session in Barcelona was:
> 
> - If the notice gives a specific license version number, we only use
> -or-later in the SPDX identifier if the notice explicitly says "or
> later". The default is "-only" (or just the version number).
> 
> - If the notice gives no version number, the standard interpretation is
> that the user can take that as any version of the GPL, which technically
> would be 1.0-or-later. But, it would also be fine to take the file as
> 2.0-or-later, which was generally legally preferred. It was not
> preferred to use 2.0-only in the case of no version number, because it's
> very possible that existing users are already using the standard
> interpretation to take those files as GPLv3, and we don't want to cause
> them problems. (On the flip side, it's massively unlikely that anyone is
> using the standard interpretation to take those files as GPLv1, so we
> can safely drop it.)

Considering we have no caselaw on what is “legally preferred” (which is otherwise a vague term we probably ought to avoid :) - and that the GPL text itself states:

"If the Program does not specify a version number of this License, you may choose any version ever 	published by the Free Software Foundation.” 

Then, where you have a license notice in file such as, 

"May be copied or modified under the terms of the GNU General Public License"

—> SPDX-License-Identifier: GPL-1.0-or-later

While I agree that practically speaking, most people are probably not going to go back to GPL-1.0 - I don’t think we should deviate from what the license explicitly says, i.e., “you may choose any version ever published…” that clearly includes GPL-1.0.  

From the lengthy conversations about this kind of thing on SPDX legal team calls, this conclusion was pretty non-controversial/everyone agreed.

So, I don’t think we should do something different here for any reason. It only muddles things. 

:)
Jilayne

Re: clarification on -only and -or-later

[Allison Randal]

On 5/20/19 11:09 PM, J Lovejoy wrote:
>> On May 20, 2019, at 3:35 PM, Allison Randal <allison@lohutok.net> wrote:
>>
>> - If the notice gives no version number, the standard interpretation is
>> that the user can take that as any version of the GPL, which technically
>> would be 1.0-or-later. But, it would also be fine to take the file as
>> 2.0-or-later, which was generally legally preferred. It was not
>> preferred to use 2.0-only in the case of no version number, because it's
>> very possible that existing users are already using the standard
>> interpretation to take those files as GPLv3, and we don't want to cause
>> them problems. (On the flip side, it's massively unlikely that anyone is
>> using the standard interpretation to take those files as GPLv1, so we
>> can safely drop it.)
> 
> Considering we have no caselaw on what is “legally preferred” (which is otherwise a vague term we probably ought to avoid :) - and that the GPL text itself states:

Sorry for the vagueness, I was dancing around Chatham House Rule. What I
meant was that specific people in the room (no names, but ask me
off-list if you don't remember and want to know) said that we should
drop GPL 1.0, because "choose any version ever published" allows us to
choose to include 1.0 or not, and because there are certain ambiguities
in the text of 1.0 that make it worthwhile to drop it.


> "If the Program does not specify a version number of this License, you may choose any version ever 	published by the Free Software Foundation.” 
> 
> Then, where you have a license notice in file such as, 
> 
> "May be copied or modified under the terms of the GNU General Public License"
> 
> —> SPDX-License-Identifier: GPL-1.0-or-later
> 
> While I agree that practically speaking, most people are probably not going to go back to GPL-1.0 - I don’t think we should deviate from what the license explicitly says, i.e., “you may choose any version ever published…” that clearly includes GPL-1.0.  
> 
> From the lengthy conversations about this kind of thing on SPDX legal team calls, this conclusion was pretty non-controversial/everyone agreed.
> 
> So, I don’t think we should do something different here for any reason. It only muddles things. 

No one was claiming that an unversioned GPL universally means
2.0-or-later, only that it means we have the option to choose versions.
And since we have the option to choose, we should choose 2.0-or-later.

Allison

Re: clarification on -only and -or-later

[J Lovejoy]

> On May 20, 2019, at 4:19 PM, Allison Randal <allison@lohutok.net> wrote:
> 
> On 5/20/19 11:09 PM, J Lovejoy wrote:
>>> On May 20, 2019, at 3:35 PM, Allison Randal <allison@lohutok.net> wrote:
>>> 
>>> - If the notice gives no version number, the standard interpretation is
>>> that the user can take that as any version of the GPL, which technically
>>> would be 1.0-or-later. But, it would also be fine to take the file as
>>> 2.0-or-later, which was generally legally preferred. It was not
>>> preferred to use 2.0-only in the case of no version number, because it's
>>> very possible that existing users are already using the standard
>>> interpretation to take those files as GPLv3, and we don't want to cause
>>> them problems. (On the flip side, it's massively unlikely that anyone is
>>> using the standard interpretation to take those files as GPLv1, so we
>>> can safely drop it.)
>> 
>> Considering we have no caselaw on what is “legally preferred” (which is otherwise a vague term we probably ought to avoid :) - and that the GPL text itself states:
> 
> Sorry for the vagueness, I was dancing around Chatham House Rule. What I
> meant was that specific people in the room (no names, but ask me
> off-list if you don't remember and want to know) said that we should
> drop GPL 1.0, because "choose any version ever published" allows us to
> choose to include 1.0 or not, and because there are certain ambiguities
> in the text of 1.0 that make it worthwhile to drop it.

ah, right - that was a preference that was expressed. 
> 
> 
>> "If the Program does not specify a version number of this License, you may choose any version ever 	published by the Free Software Foundation.” 
>> 
>> Then, where you have a license notice in file such as, 
>> 
>> "May be copied or modified under the terms of the GNU General Public License"
>> 
>> —> SPDX-License-Identifier: GPL-1.0-or-later
>> 
>> While I agree that practically speaking, most people are probably not going to go back to GPL-1.0 - I don’t think we should deviate from what the license explicitly says, i.e., “you may choose any version ever published…” that clearly includes GPL-1.0.  
>> 
>> From the lengthy conversations about this kind of thing on SPDX legal team calls, this conclusion was pretty non-controversial/everyone agreed.
>> 
>> So, I don’t think we should do something different here for any reason. It only muddles things. 
> 
> No one was claiming that an unversioned GPL universally means
> 2.0-or-later, only that it means we have the option to choose versions.
> And since we have the option to choose, we should choose 2.0-or-later.

yeah, one can make that viable argument, I guess I’d just prefer that we don’t put ourselves in a position to need to explain too much. Preferably the SPDX identifier is an obvious expression of what the license notice stated or the copyright holders cleaned up any ambiguities.

> 
> Allison

Re: clarification on -only and -or-later

[Allison Randal]

On 5/20/19 11:52 PM, J Lovejoy wrote:
>> On May 20, 2019, at 4:19 PM, Allison Randal <allison@lohutok.net> wrote:
>>
>> No one was claiming that an unversioned GPL universally means
>> 2.0-or-later, only that it means we have the option to choose versions.
>> And since we have the option to choose, we should choose 2.0-or-later.
> 
> yeah, one can make that viable argument, I guess I’d just prefer that we don’t put ourselves in a position to need to explain too much. Preferably the SPDX identifier is an obvious expression of what the license notice stated or the copyright holders cleaned up any ambiguities.

I don't personally have a strong opinion either way. I appreciate the
legal consistency of choosing 2.0 where we can (consistent with 2.0 in
LICENSES/preferred, and 1.0 in LICENSES/deprecated), and I respect the
people who were arguing for dropping 1.0. So, if I had to make the call,
I'd probably go with 2.0-or-later. But, I'm fine with whatever is chosen.

Allison

Re: clarification on -only and -or-later

[Bradley M. Kuhn]

J Lovejoy wrote:
> 3) where the license notice in the file simply points to the COPYING file or some other license file that contains the full text of GPL-2.0

> This is a tougher call, as there isn’t really any arguably clear call, but
> my thinking is that we’d use:

> SPDX-License-Identifier: GPL-2.0-or-later

I agree that one can use GPL-1.0-or-later in this case well (which was
discussed down thread), but I also agree with the argument (also downthread)
that there is no *requirement* to include GPL-1.0 in the mix.  The text of
the COPYING file (i.e., GPLv2) is clear on this point, if we have code that
does "not specify a version number of this License, you may choose any
version ever published by the Free Software Foundation."

Jilayne and I did a pretty deep dive on this question of the 'no version
number specified' and I think our discussions made us sure that it does
*not* mean GPL-2.0-only, because of the text above.  I checked with
Fontana too and he agrees with this as well.

Meta note: I've got a hectic week so I am not available to look at
any Thomas' patch sets (and the threads they're generating) until this weekend,
but I've set aside time on this Sunday morning for it.  Looking forward to it!

--
Bradley M. Kuhn

Pls. support the charity where I work, Software Freedom Conservancy:
https://sfconservancy.org/supporter/

Re: clarification on -only and -or-later

[J Lovejoy]

HI Bradley,

Thanks for weighing in there. I think my original examples got a but lost in the various back and forth. So, let me reproduce and re-match:

	1) where no version is indicated, the license text of GPL (all versions) tells us what to do, " If the Program does not specify a 
	version number of this License, you may choose any version ever published by the Free Software Foundation.” 
	- thus, use: SPDX-License-Identifier: GPL-1.0-or-later

	example:

	*  May be copied or modified under the terms of the GNU General Public License

This is what Allison and I were going back and forth on.  Net sum being: I was pointing out that under a literal reading of the license, such a unclear reference to just “GPL” would be GPL-1.0-or-later 

I think this is where your point is spot on and confirms my memory of the various discussions:

> I agree that one can use GPL-1.0-or-later in this case well (which was
> discussed down thread), but I also agree with the argument (also downthread)
> that there is no *requirement* to include GPL-1.0 in the mix.  The text of
> the COPYING file (i.e., GPLv2) is clear on this point, if we have code that
> does "not specify a version number of this License, you may choose any
> version ever published by the Free Software Foundation."
> 
> Jilayne and I did a pretty deep dive on this question of the 'no version
> number specified' and I think our discussions made us sure that it does
> *not* mean GPL-2.0-only, because of the text above.  I checked with
> Fontana too and he agrees with this as well.

I think what I was looking for here, was confirmation as to whether we want to do the “literal” GPL-1.0-or-later option that the license provides for, or trigger the option to “choose any version” and go with GPL-2.0-or-later for consistency of v2 across the kernel and for other reasons I believe you raised regarding GPL-1.0

Thoughts?


thanks,
Jilayne

> On May 21, 2019, at 11:24 AM, Bradley M. Kuhn <bkuhn@ebb.org> wrote:
> 
> J Lovejoy wrote:
>> 3) where the license notice in the file simply points to the COPYING file or some other license file that contains the full text of GPL-2.0
> 
>> This is a tougher call, as there isn’t really any arguably clear call, but
>> my thinking is that we’d use:
> 
>> SPDX-License-Identifier: GPL-2.0-or-later
> 
> I agree that one can use GPL-1.0-or-later in this case well (which was
> discussed down thread), but I also agree with the argument (also downthread)
> that there is no *requirement* to include GPL-1.0 in the mix.  The text of
> the COPYING file (i.e., GPLv2) is clear on this point, if we have code that
> does "not specify a version number of this License, you may choose any
> version ever published by the Free Software Foundation."
> 
> Jilayne and I did a pretty deep dive on this question of the 'no version
> number specified' and I think our discussions made us sure that it does
> *not* mean GPL-2.0-only, because of the text above.  I checked with
> Fontana too and he agrees with this as well.
> 
> Meta note: I've got a hectic week so I am not available to look at
> any Thomas' patch sets (and the threads they're generating) until this weekend,
> but I've set aside time on this Sunday morning for it.  Looking forward to it!
> 
> --
> Bradley M. Kuhn
> 
> Pls. support the charity where I work, Software Freedom Conservancy:
> https://sfconservancy.org/supporter/

Re: clarification on -only and -or-later

[Greg KH]

On Tue, May 21, 2019 at 12:05:37PM -0600, J Lovejoy wrote:
> > I agree that one can use GPL-1.0-or-later in this case well (which was
> > discussed down thread), but I also agree with the argument (also downthread)
> > that there is no *requirement* to include GPL-1.0 in the mix.  The text of
> > the COPYING file (i.e., GPLv2) is clear on this point, if we have code that
> > does "not specify a version number of this License, you may choose any
> > version ever published by the Free Software Foundation."
> > 
> > Jilayne and I did a pretty deep dive on this question of the 'no version
> > number specified' and I think our discussions made us sure that it does
> > *not* mean GPL-2.0-only, because of the text above.  I checked with
> > Fontana too and he agrees with this as well.
> 
> I think what I was looking for here, was confirmation as to whether we
> want to do the “literal” GPL-1.0-or-later option that the license
> provides for, or trigger the option to “choose any version” and go
> with GPL-2.0-or-later for consistency of v2 across the kernel and for
> other reasons I believe you raised regarding GPL-1.0

I don't understand.  Can you point to any files in the kernel where we
have used the "GPL-1.0+" marking incorrectly?

thanks,

greg k-h

Re: clarification on -only and -or-later

[Allison Randal]

On 5/22/19 2:23 PM, Greg KH wrote:
> On Tue, May 21, 2019 at 12:05:37PM -0600, J Lovejoy wrote:
>>
>> I think what I was looking for here, was confirmation as to whether we
>> want to do the “literal” GPL-1.0-or-later option that the license
>> provides for, or trigger the option to “choose any version” and go
>> with GPL-2.0-or-later for consistency of v2 across the kernel and for
>> other reasons I believe you raised regarding GPL-1.0
> 
> I don't understand.  Can you point to any files in the kernel where we
> have used the "GPL-1.0+" marking incorrectly?

Jilayne's question wasn't about current usage in the kernel, it was
about what we should do in this cleanup process when we get to files
where the license notice doesn't have an explicit GPL version number or
include the "or later" text. Thomas hasn't gotten to those patterns yet
in his batch processing.

Allison

Re: clarification on -only and -or-later

[Greg KH]

On Wed, May 22, 2019 at 09:53:48AM -0400, Allison Randal wrote:
> On 5/22/19 2:23 PM, Greg KH wrote:
> > On Tue, May 21, 2019 at 12:05:37PM -0600, J Lovejoy wrote:
> >>
> >> I think what I was looking for here, was confirmation as to whether we
> >> want to do the “literal” GPL-1.0-or-later option that the license
> >> provides for, or trigger the option to “choose any version” and go
> >> with GPL-2.0-or-later for consistency of v2 across the kernel and for
> >> other reasons I believe you raised regarding GPL-1.0
> > 
> > I don't understand.  Can you point to any files in the kernel where we
> > have used the "GPL-1.0+" marking incorrectly?
> 
> Jilayne's question wasn't about current usage in the kernel, it was
> about what we should do in this cleanup process when we get to files
> where the license notice doesn't have an explicit GPL version number or
> include the "or later" text. Thomas hasn't gotten to those patterns yet
> in his batch processing.

Ah, ok.

But note, we have already marked such files as "GPL-1.0+" in the past,
so any change in that behavior would require us go back and change what
we did, showing the justification for that.

I would stick to the rule of what we have already done in these cases,
it's simpler and seems to make sense of a crazy situation.

thanks,

greg k-h

Re: clarification on -only and -or-later

[Thomas Gleixner]

[-- Attachment #1: Type: text/plain, Size: 1727 bytes --]

On Wed, 22 May 2019, Greg KH wrote:
> On Wed, May 22, 2019 at 09:53:48AM -0400, Allison Randal wrote:
> > On 5/22/19 2:23 PM, Greg KH wrote:
> > > On Tue, May 21, 2019 at 12:05:37PM -0600, J Lovejoy wrote:
> > >>
> > >> I think what I was looking for here, was confirmation as to whether we
> > >> want to do the “literal” GPL-1.0-or-later option that the license
> > >> provides for, or trigger the option to “choose any version” and go
> > >> with GPL-2.0-or-later for consistency of v2 across the kernel and for
> > >> other reasons I believe you raised regarding GPL-1.0
> > > 
> > > I don't understand.  Can you point to any files in the kernel where we
> > > have used the "GPL-1.0+" marking incorrectly?
> > 
> > Jilayne's question wasn't about current usage in the kernel, it was
> > about what we should do in this cleanup process when we get to files
> > where the license notice doesn't have an explicit GPL version number or
> > include the "or later" text. Thomas hasn't gotten to those patterns yet
> > in his batch processing.
> 
> Ah, ok.
> 
> But note, we have already marked such files as "GPL-1.0+" in the past,
> so any change in that behavior would require us go back and change what
> we did, showing the justification for that.
> 
> I would stick to the rule of what we have already done in these cases,
> it's simpler and seems to make sense of a crazy situation.

Yes and no. There is a good reason to remove the GPL1+ crap completely and
I already got permission from Redhat to change their GPL/GPL'ed notices to
GPL-2.0-or-later. So once we get to that pile we might at least try to talk
with the copyright holders and clarify it. Each odd license which gets
removed is a win.

Thanks,

	tglx

Re: clarification on -only and -or-later

[Allison Randal]

On 5/22/19 3:20 PM, Thomas Gleixner wrote:
> Yes and no. There is a good reason to remove the GPL1+ crap completely and
> I already got permission from Redhat to change their GPL/GPL'ed notices to
> GPL-2.0-or-later. So once we get to that pile we might at least try to talk
> with the copyright holders and clarify it. Each odd license which gets
> removed is a win.

We don't necessarily have to do everything in one pass. We could keep
this round of cleanup strictly to an exact substitution of
GPL-1.0-or-later, and do a separate pass at some point in the future to
deprecate and remove GPL-1.0 where possible.

I'm not sure whether it would be easier to do it all now or save the
deprecation for later. I guess we can see how many files match the
patterns with no version numbers. (With 5 files it's easy to contact the
copyright holders, hundreds would be difficult.)

Allison

Re: clarification on -only and -or-later

[Greg KH]

On Wed, May 22, 2019 at 10:30:07AM -0400, Allison Randal wrote:
> On 5/22/19 3:20 PM, Thomas Gleixner wrote:
> > Yes and no. There is a good reason to remove the GPL1+ crap completely and
> > I already got permission from Redhat to change their GPL/GPL'ed notices to
> > GPL-2.0-or-later. So once we get to that pile we might at least try to talk
> > with the copyright holders and clarify it. Each odd license which gets
> > removed is a win.

If we get permission, that's great!  But given that we already have 53
files with that tag today, the odds of someone contacting all of those
owners is going to be hard :(

> We don't necessarily have to do everything in one pass. We could keep
> this round of cleanup strictly to an exact substitution of
> GPL-1.0-or-later, and do a separate pass at some point in the future to
> deprecate and remove GPL-1.0 where possible.

I would be amazed if anyone ever does a "follow-on" pass of the tree
after we finish with these, other than to add tags to files that sneak
in without them :)

thanks,

greg k-h

Re: clarification on -only and -or-later

[Bradley M. Kuhn]

We should take care not to conflate changes made because: (a) all
relevant copyright holders consented, vs. (b) consent not available from the
copyright holders.  (a) and (b) differ greatly, both politically and legally.

With (a), we can certainly ask copyright holders for any notice changes that
seem useful, expedient, and would help Linux as a project.  (e.g., if, as
Thomas says, Red Hat is sole copyright holder of some code and agrees to
relicense it from GPL-1.0-or-later to GPL-2.0-or-later, I see no reason not
to gleefully accept that and make the change (copyright holders assent
well-documented in the commit log with relevant Signed-Off-By: , of course).
Similarly, (to "cross" the two active threads a bit), that we really have no
worries about old-notice-preservation if all relevant copyright holders
assents to replace their old notice with an SPDX Identifier.

However, with (b), judgment and risk analysis, both of legal and political
nature, will always be required.

During the "Great SPDX GPL Identifier Change" last year, Jilayne and I dug
deep on the legal judgment/risk-analysis about some of these notices -- in
collaboration with FSF (as license steward) and many others in the FOSS
licensing community -- to come to conclusions about the two ambiguous cases
Jilayne listed as (1) and (3) initially in this thread.  Jilayne's
suggestions for these cases were presumably informed by that, and I suspect
that's why she's recommending them as -or-later conclusions.

Nevertheless, if there is political risk (or even, as Greg points out,
annoying work not worth doing) involved with moving GPL-1.0-or-later code to
(say) GPL-2.0-or-later instead, then there is no reason to do so.
Furthermore, such a change also relates to this point:

There is danger of taking things that legal analysis concludes are
'-or-later' and turning them into '-only'.  Narrowing from '-or-later' to
'-only' is always permitted by downstream (and also the effective license of
the whole work of Linux will undoubtedly remain GPL-2.0-only).  However, so
many people have expressed a desire for accurate, complete, and
as-broad-as-legally-possible file-by-file licensing inventory.  This project
exists, presumably, to serve those requests.  We should strive to make sure
that, on a "file-by-file level", this project doesn't inadvertently narrow
permissions unduly.  Furthermore, combining the work of notice-replacement
with license *changing* adds undue risk; the two activities should be fully
separated by both time and workflow.

If the upshot of this *also* means we live with more GPL-1.0-or-later
notices floating around, I don't think it's that big of a deal.  Better
that than annoyed contributors, and, more importantly, downstream users
who wish to take a the more liberal license for some code in the Linux tree,
etc.

As always, IANAL and TINLA,
--
Bradley M. Kuhn

Pls. support the charity where I work, Software Freedom Conservancy:
https://sfconservancy.org/supporter/

Re: clarification on -only and -or-later

[Allison Randal]

On 5/22/19 3:00 PM, Greg KH wrote:
> 
> But note, we have already marked such files as "GPL-1.0+" in the past,
> so any change in that behavior would require us go back and change what
> we did, showing the justification for that.
> 
> I would stick to the rule of what we have already done in these cases,
> it's simpler and seems to make sense of a crazy situation.

Fair. If we have a precedent of keeping GPL-1.0 in the SPDX license
notices, then we should be consistent and follow that rule in this
cleanup process.

Allison

Re: clarification on -only and -or-later

[J Lovejoy]

> On May 22, 2019, at 8:00 AM, Greg KH <gregkh@linuxfoundation.org> wrote:
> 
> On Wed, May 22, 2019 at 09:53:48AM -0400, Allison Randal wrote:
>> On 5/22/19 2:23 PM, Greg KH wrote:
>>> On Tue, May 21, 2019 at 12:05:37PM -0600, J Lovejoy wrote:
>>>> 
>>>> I think what I was looking for here, was confirmation as to whether we
>>>> want to do the “literal” GPL-1.0-or-later option that the license
>>>> provides for, or trigger the option to “choose any version” and go
>>>> with GPL-2.0-or-later for consistency of v2 across the kernel and for
>>>> other reasons I believe you raised regarding GPL-1.0
>>> 
>>> I don't understand.  Can you point to any files in the kernel where we
>>> have used the "GPL-1.0+" marking incorrectly?
>> 
>> Jilayne's question wasn't about current usage in the kernel, it was
>> about what we should do in this cleanup process when we get to files
>> where the license notice doesn't have an explicit GPL version number or
>> include the "or later" text. Thomas hasn't gotten to those patterns yet
>> in his batch processing.
> 
> Ah, ok.
> 
> But note, we have already marked such files as "GPL-1.0+" in the past,
> so any change in that behavior would require us go back and change what
> we did, showing the justification for that.
> 
> I would stick to the rule of what we have already done in these cases,
> it's simpler and seems to make sense of a crazy situation.
> 

Thanks Allison for helping to clarify and yes, if there is a pattern already, it’d be really helpful for someone to send me a few examples.
The examples you’ve seen already may not match some of the “messy files” I’m looking at, but it’d still be helpful.

thanks,
Jilayne

Re: clarification on -only and -or-later

[Bradley M. Kuhn]

Jilayne, thanks for noting that discussion about (1) and (3) got mixed up
downthread.  OTOH, the situations are quite similar anyway.

To clarify, I was indeed commenting on your original item (3), not (1):

Jilayne wrote at the start of the thread:
> 3) where the license notice in the file simply points to the COPYING file or
> some other license file that contains the full text of GPL-2.0
> his is a tougher call, as there isn’t really any arguably clear call, but my
> thinking is that we’d use:
> SPDX-License-Identifier: GPL-2.0-or-later

I think that solution you propose above is correct on item (3), as discussed
in my previous email.

Since you asked me in your follow up to also comment on your original item
(1), that's below:

J Lovejoy wrote:
>      1) where no version is indicated, the license text of GPL (all versions)
>      tells us what to do, " If the Program does not specify a version number
>      of this License, you may choose any version ever published by the Free
>      Software Foundation.” 
>      - thus, use: SPDX-License-Identifier: GPL-1.0-or-later
>      example:
>      * May be copied or modified under the terms of the GNU General Public
>      License

The situation doesn't differ much from (3).  In both cases, a reference is
made to "GPL" without specifying a version number.  GPL (all versions) say
that if it "does not specify a version number of this License, you may choose
any version ever published by the Free Software Foundation.".  This is the
very issue that you and I discussed at length when FSF was lobbying for
identifier changes, and we sorted out that indeed that, in any situation
where a version number isn't specified, the quoted text causes maximal
options.

So, in both cases (1) and (3), downstream licensors (which the Linux project
is in this scenario, since it received the contribution 'from someone') can
chose the whole spectrum they want, including GPL-1.0-or-later.

I think choosing the "-only" versions -- while permissible as downstream
licensor (i.e., you can always opt yourself to narrow an -or-later into an
-only) -- unnecessarily limits possibility for code sharing.  Linux is
clearly committed to keeping file-by-file inventory of licensing information,
and given that commitment, the project should strive to keep the most
permissive version of the license it can.  (This situation is akin to the
dual-licensed: "BSD-3-Clause OR GPL-2.0-or-later" -- while BSD-3-Clause can
easily be dropped, it's not recommended for various reasons.)

However, as we discussed in Barcelona, the code sharing argument for GPL-1.0
inclusion is minimal.  No one could think of *any* project that still
*intentionally* includes GPL-1.0-only and/or GPL-1.0-or-later in its license
choices.  If we have an example of that, particular of a program written in
C, that would be a good counter example and would lean me toward thinking
staying with GPL-1.0-or-later in these cases makes sense.  Absent any example
like that, GPL-2.0-or-later is the way to go for examples (1) and (3).

--
Bradley M. Kuhn

Pls. support the charity where I work, Software Freedom Conservancy:
https://sfconservancy.org/supporter/