Re: [patch 16/25] treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 16

[Richard Fontana <rfontana@redhat.com>]

On Mon, May 20, 2019 at 12:39 PM Philippe Ombredanne
<pombredanne@nexb.com> wrote:
>
> Richard, Steve:
>
> On Mon, May 20, 2019 at 2:42 AM Richard Fontana <rfontana@redhat.com> wrote:
> >
> > On Sun, May 19, 2019 at 8:27 PM Steve Winslow
> > <swinslow@linuxfoundation.org> wrote:
> > >
> > > For this one, the additional disclaimer paragraph at the bottom
> > > (beginning with "THIS SOFTWARE IS PROVIDED BY...") appears to come
> > > from a BSD-style license, not GPL. I'm not sure this disclaimer should
> > > be deleted and replaced by just a standard GPL-2.0-or-later tag.
> >
> > I am inclined to agree with Steve. It's materially different from the
> > disclaimers in GPLv2 itself and could also indicate the remnants of an
> > otherwise vanished BSD license notice.
>
> The commit log [1] shows this was clearly always this way and is
> original code [2]
> People do funky stuff at times and mix and match notices and
> disclaimers from various origins.
> So this is IMHO a GPL alright and there is no BSD in play.

Hi Philippe, I am not sure it is necessarily so simple.

First, from an SPDX conformance perspective (I assume this whole
exercise aims to be SPDX conformant, although I'm not really clear on
that), it is not legitimately describable as merely "GPL-2.0-or-later"
because the disclaimer text is text not found in, and which does not
match the SPDX license template for, GPLv2. To argue otherwise is to
assert that any existing SPDX identifier is validly applied even where
arbitrary warranty disclaimer or liability-limitation language is
added to a license document or llicense notice -- the SPDX
specification should be amended if this is the desired policy, but
that would seem to require making some potentially significant legal
judgments which I had thought SPDX was designed to avoid.

Second, from a legal (and open source licensing folk-understanding)
perspective, it is something other than merely "GPL-2.0-or-later",
because the added disclaimer has different legally-significant content
from otherwise corresponding language in GPLv2.

GPLv3 says: "for material you add to a covered work, you may (if
authorized by the copyright holders of that material) supplement the
terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License;" , which is treated as an
allowable additional restriction. And this codified an occasional
practice under GPLv2 which I believe the FSF had authorized. So if one
copyright holder decided to tack on the BSD disclaimer language to an
otherwise standard GPLv2 notice, that presumably should be treated
like an additional restriction, which needs to be left in place, and
perhaps even the appropriate thing is to define an SPDX identifier to
account for the additional language. (Given the way "exception" is
sort of defined at https://spdx.org/licenses/exceptions-index.html it
might not be appropriate to use the "WITH" syntax.)

Richard