Hi Juan,
Am 30.10.26 um 06:18 schrieb Juan Manuel Méndez Rey:
Follow-up to the csaf thread [1], where Bastian set licence texts apart
from standards texts [2].
github.com/google/licenseclassifier/v2 (ITP #1152499, needed by trivy)
embeds 266 licence texts as the corpus it matches against. Some are texts
of non-free licences whose own wording allows verbatim copying, for example
JSON ("shall be used for Good, not Evil"), CC-BY-NC/ND and SSPL.
Can those texts stay in main as the detector's data, the way licence texts
are shipped in common-licenses, or do they belong in non-free?
Texts that give no permission to copy them at all (SDK EULAs such as
Xcode, Android SDK, Windows SDK) are removed from the tarball either way.
[1] https://lists.debian.org/debian-legal/2026/09/msg00019.html
[2] https://lists.debian.org/debian-legal/2026/10/msg00004.html
There is not need to castrate the package at all. I was very surprised
somebody would remove the EULAs you cited from a license scanning
software, so I dug deep(er):
Tl;dr:
I would have no concern to distribute the EULAs and also non-free
license texts at all as part of a license scanner application.
For those who enjoy walls of text, read on...:
There's a generic rationale (1), below and I double checked on the EULAs
you mentioned casually in your mail above in (2), below.
(1) Fair use. Reproducing a EULA text verbatim in a license-detection
corpus is a use that the US Copyright Act (17 U.S.C. §107) very
plausibly covers. The purpose is functional and non-expressive: the text
serves as a reference pattern for recognizing that a given file or
package is covered by that agreement. There is no need for a EULA text
to be offering in itself a permission to copy it. It is not republished
to be read in place of the vendor’s own copy, so it neither competes
with nor harms any market for the original. To the contrary, it eases
detection and therefore compliance with the EULA text, so it benefits
§107 (4). The EULAs - as much as they can be considered potentially
copyrightable works at all - are largely factual and legal in nature.
Established tools such as ScanCode’s LicenseDB already publish the texts
of proprietary licenses and EULAs for this purpose, including the
Android SDK License and several Microsoft SDK license texts. The do not
have the Xcode example you gave in your list but I am sure that's more
because they didn't need it / missed it than for legal reasons.
Which leads to:
(2) The EULA agreements themselves do not prohibit it. None of the three
you mentioned restricts reproducing the agreement text. Each restricts
what you do with the software only, that is their application and intent:
(2.1) The Android SDK License Agreement (version dated April 28, 2026),
section 3.4 says you may not copy (except for backup purposes), modify,
adapt, redistribute or create derivative works of "the SDK or any part
of the SDK." That is aimed at the software, and the agreement text is
not naturally read as a part of the SDK being used.
(2.2) Xcode and Apple SDKs Agreement (revision dated 06/08/2026).
Section 2.7 bars copying (except as expressly permitted), reverse
engineering, modifying or creating derivative works of the Apple
Software or Services, and bars uploading, hosting or redistributing
them. Section 2.5 governs the copies of the Apple Software you may make.
Section 1 defines “Apple Software” as the Xcode Developer Tools and the
Apple SDKs, and defines the Agreement separately, so these clauses
concern the software, not the legal terms. Apple also publishes the
agreement openly at apple.com/legal/sla/docs/xcode.pdf. Taking the text
from that public PDF, not from the copy bundled inside Xcode.app voids
any argument that the agreement copied could be constructed as "part of"
the software.
(2.3) Windows SDK for Windows 10 license terms (marked as
WIN10SDK.RTM.AUG_2018). The copying limits in section 7 (extra copies of
the software, publishing the software for others to copy, renting,
leasing, lending, hosting) and the requirement in section 1 that each
copy be complete, including all copyright and trademark notices, concern
the software. Section 7 also yields to applicable law: extra copies are
barred except as "allowed by applicable law," and the limits apply
"unless applicable law gives you more rights." The same section bars
transferring "the software or this agreement" to a third party. In
context, next to renting, leasing and lending, that reads as a
restriction on _assigning_ the license, not on _quoting_ its text. This
is probably the phrase that confused somebody not well versed with legal
texts. But the intent is - in my mind - clear and I am positive we could
get expert witnesses in a court case to state so on record.
So, in summary, I would not have any issues distributing these texts as
part of a license scanning software for Debian and ... neither should
you. I made the analysis above on the US legal system, because usually
that's the one that applies when to evaluate risks of being sued. There
are other legal systems and nobody but a court in each could state
things with absolute certainty. But in my view - the remaining risk is
miniscule.
To be precise: I am not saying the agreements grant an explicit license
to copy their own text. They don’t, and each reserves rights not
expressly granted. I am saying that
(cf. 2) nothing in them forbids reproducing that text, and
(cf. 1) the use in a license scanner application is one the Copyright
Act already allows regardless of any specific grant.
A contract (~EULA) can in some circumstances restrict conduct that
copyright law would otherwise permit, which is why it matters that these
clauses are directed at the subject matter (software) and not at the
agreement text itself.
Hope this helps, this was two hours of my life. Please note I will not
let myself get dragged into discussions. But I felt somebody needed to
formulate a straighter position than what Juan cited casually. Today
that was me. Friday morning mistakes. Note that SPI has access to pro
bono and paid legal consulting, if there was reasonable doubt. I don't
have any, see above. IANAL, IANYL, if in doubt, ask YOUR legal counsel.
Kind regards,
Daniel
