On Tue, Nov 3, 2015 at 3:45 AM, Wheeler, David A <dwhee...@ida.org> wrote: > Philippe Ombredanne wrote: [...] >> You say: >> GPL-2.0 ==> implies GPL 2.0 only >> GPL-2.0+ ==> implies GPL 2.0 or later > That's not just what I say. That's what the spec says, and has > clearly stated since circa 2010. > This would have been a useful argument to raise in 2010 (when SPDX was > drafted). But this group doesn't exist to create a new spec where > none has existed. For more than 5 years SPDX has consistently stated > that "GPL-2.0" means ONLY GPL-2.0 and nothing else. This builds on > previous history of Fedora and Debian, who also use "+" this way, > e.g., see: https://fedoraproject.org/wiki/Licensing:Main?rd=Licensing
David: I know this as I was part of it and that does not make it more right ... FWIW, I have been around SPDX for quite a while ;). See "A Short History of SPDX": https://spdx.org/about-spdx/what-is-spdx > While I know you're focusing on the GPL, there are many other > licenses, and most licenses do NOT have a "this or later version" > clause; The focus is not only on the GPL: well over 25% of the SPDX licenses DO HAVE a "this or later version" clause. Here are some examples: - Most of the FSF licenses: The GPL and LGPL and all their versions. But also the AGPL, the GFDL, etc. - all the Mozilla-like license: NPLs, MPLs and all the MPL derivatives such as SPL, CPAL, Erlang, RPL, APSL, Gsoap, ZIMBRA, SISL, etc. - most of the Creative Common licenses, - The Eclipse licenses and the CPLs, - the CDDLs, - the PHP license, - OpenLDAP, Latex/LPPL, LPL, Condor, CATOSL, RPSL, CECILL, etc. For all SPDX licenses allowing other versions, the bare identifier means "or later version", except for the L/GPL where this means "only the current version" unless you create an expression with a "+". So the decision procedure to use a plus or not is roughly like this: If licensing allows to use "other license versions": - If and only if GPL or LGPL, add a + to the license identifier. "other license versions" is NOT implied. - Otherwise, if this not GPL or LGPL, do NOT add a +. "other license versions" is implied if the license allows such thing. Do this ONLY for any versions of these two licenses. Do not apply this approach to other FSF licenses such AGPL, GFDL and others. - Except if you are a Linux packager for Debian or Fedora and their derivatives, because then you may use the + for other FSF licenses beyond the L/GPL. The + is already used with GFDL, AGPL, etc. Do not use a plus for non-FSF licenses that have an "or later" clause. If licensing does NOT allow to use "other license versions": - If and only if LGPL or LGPL, use the bare license identifier. "no other license version" is implied by a bare id. - Except if you are a Linux packager because you apply the same approach for other FSF licenses. - If this is another license, then? "other license version" IS implied in a bare id here. SPDX does not help you there, and you could create an exception.This is a rare case anyway. > having the default be what's common in MOST licenses is > actually sensible. This is exactly my point. The common sense and default usage for L/GPL is ". And Linux distros and SPDX have made the default "or later" exceptional and the less common "only" exception the default. So how to resolve this situation? In the grand scheme of things, "only" and "or later" are minute technicalities that the large majority of software users do not care for. The licenses requirements are essentially the same and "later or not later" is not the question. Only a few licensing mavens care about this and they know how to deal with it. But SPDX is likely stuck with this inconsistent legacy and yes this is hard to escape without creating more mess. It does not mean that we cannot try to clarify and improve things. First we need to distinguish two types of licenses allowing "other versions": a. FSF licenses such as the A/L/GPL. These are the only licenses were a plus + convention has been used by Linux distros and SPDX with some consistency. b. Non-FSF licenses. I cannot find cases where the plus + convention has been used in the wild or with SPDX for these. Some ways out could include: Option 1. Do mostly nothing. --------- Keep the status quo and clarify the current ambiguities: We document the procedure I described above and move on. We accept this is a mess and make it a documented mess. This is an OK option. And requires little or no work. Option 2. Change the meaning of every bare license id that allow "or later" to mean "this version only". FSF or not FSF. -------- No change of license ids is needed, only the SPDX full names and notes need to be updated the same way the full name of the GPL-2.0 is: "GNU General Public License v2.0 only" And we explain that to express the default case of "or later" you always need to create an expression with a +. This would provide a consistent and homogeneous treatment of all SPDX licenses. This is not the way Linux distros have used non-FSF licenses. And this would change the meaning of any non-FSF licenses that have been used without a plus until now. This is not really an OK option. And requires quite some work. Option 3. Reinstate/un-deprecate the "+" to use it as part of the identifier when needed only for FSF licenses and deprecate the usage of the + in license expressions. -------- Here and ONLY for FSF licenses, we deprecate GPL-2.0 and related identifiers and replace them with new ids such as GPL-2.0-only and AGPL-3.0-only. We reinstate the GPL-2.0+ or create similar identifiers (e.g. AGPL-3.0+) that become the default. Note that we could also consider keeping multiple ids as "aliases" for FSF licenses instead of deprecating the GPL-2.0 bare ids. And we deprecate the use of the plus in license expressions now no longer needed. For the cases of non-FSF licenses supporting "or later" and if you want to restrict usage to "only this version", we add a new exception such as "No other version" or "only this version", rarely needed. This approach would be compatible with the past and the present and consistent with the ways the plus is used in Debian and Fedora distros for FSF licenses beyond the L/GPL: - GPL-2.0+ always means/meant "or later". - GPL-2.0 and GPL-2.0-only always means/meant "only". And tools that parse SPDX expressions can look up the license ids with + first or handle the deprecated + without ambiguities. It is still inconsistent with the general default meaning of "GPL 2.0". So when you migrate to SPDX, any places where you used "GPL 2.0" with the general default meaning of "or later" you need to map this to GPL-2.0+. This is an OK option. And requires some work. -- Cordially Philippe Ombredanne _______________________________________________ Spdx-tech mailing list Spdx-tech@lists.spdx.org https://lists.spdx.org/mailman/listinfo/spdx-tech
