Hi Wolfgang, I applaud the your efforts in the u-boot project to clean up the licensing and make a clear choice using the spdx license tag; however I'm not convinced that all projects would be willing or even able to do that and therefore I stand pretty firm in my opinion that it shouldn't be a requirement to do so -- perhaps a recommendation or best practice. IMO, there's still a lot of value in adding the tags because they will enable automated production of SPDX and required notices. I do wonder however if the tag should contain some link or reference to the actual license text as discussed in some of the other replies to this post. I actually don't like the idea of a link because there's really no guarantee it survives the lifespan of the code. This suggests to me that centralizing the license text (e.g in the root directory or license subdirectory) and some sort of reference to the file level tagging needs to be part of our recommendation or best practice.
Thanks for your feedback and helping us "blaze the trail" on this initiative. Regards, Scott -----Original Message----- From: Wolfgang Denk [mailto:w...@denx.de] Sent: Sunday, October 06, 2013 12:23 PM To: Lamons, Scott (Open Source Program Office) Cc: Manbeck, Jack; Jilayne Lovejoy; spdx-tech@lists.spdx.org; SPDX-biz; SPDX-legal Subject: Re: meta-tag page Dear Scott, On Oct 3, 2013, at 12:33 PM, "Lamons, Scott (Open Source Program Office)" <scott.lam...@hp.com<mailto:scott.lam...@hp.com> wrote: > > Thanks for updating this page. In particular for adding the rationale > for why tagging is important in the Introduction section. For me, the > main impetus of adding the license tag is to automate the production > of accurate SPDX data. To the extent that licensing headers are > already included in the file I'm not a fan of replacing that with the > tag - rather, I think our (the SPDX workgroup that is) recommendation > or best practice should be that the tag should supplement the other > licensing information. But, in the end, it is the ultimate choice of > the copyright holder of the software because they will be the party > implementing this should they choose to adopt. First of all I would like to point out that I am not an expert in this field, and even more so, I am not a lawyer... The base of my comment is the practical experience I gathered when introducing license tags to the U-Boot project; as far as I understand this is one of the first (the first?) where this has been doene in a real software project of some size. I disagree with keeping the full license header text when adding license tags; this means duplicating information, which means the risk of divergence. For us in the U-Boot project it has been one of the major goals when introducing license tags to clean up with redundant and all too often inconsistent information, and I think the same should be attempted by other projects, too. Switching from license headers to license tags requires some careful work, but this effrot should be invested only once, and then everybody should be able to rely on the recorded (and easily parsable) information of the license tags. If you keep the full license tags duplicated in the source files, you in each review have to make sure that this is still what it (probably) was then the license tag was added. In the end, you add to the efforts instead of reducing it. I also disagree on the part that such a modification is "ultimate choice of the copyright holder". Actually it is only a formal change, not different from other modifications of the code. We are in no way changing the actual license terms that apply to that code. As far as I understand, such per-file license headers or license tags are not even legally needed at all (see statement of Daniel B. Ravicher, Legal Director of SLFC as referenced here [1]) if "the project as a whole is licensed under clear terms". In the interest of reducing the efforts for any kind of license clearing audits I strongly vote to drop the then redundant license header text when switching to license tags. Thanks. [1] git.denx.de/?p=u-boot.git;a=commit;h=eca3aeb352c964bdb28b8e191d6326370245e03f Wolfgang Denk -- DENX Software Engineering GmbH, MD: Wolfgang Denk & Detlev Zundel HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: w...@denx.de Computers are not intelligent. They only think they are. _______________________________________________ Spdx-tech mailing list Spdx-tech@lists.spdx.org https://lists.spdx.org/mailman/listinfo/spdx-tech
