linux-kernel - Re: [PATCH v9 1/6] LICENSES: Add the copyleft-next-0.3.1 license

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yo6twJ5rqrB/J/rJ@ebb.org>
Date:   Wed, 25 May 2022 15:29:20 -0700
From:   "Bradley M. Kuhn" <bkuhn@....org>
To:     linux-spdx@...r.kernel.org, J Lovejoy <opensource@...ayne.com>,
        copyleft-next@...ts.fedorahosted.org
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Luis Chamberlain <mcgrof@...nel.org>, tj@...nel.org,
        gregkh@...uxfoundation.org, akpm@...ux-foundation.org,
        jeyu@...nel.org, shuah@...nel.org, bvanassche@....org,
        dan.j.williams@...el.com, joe@...ches.com, keescook@...omium.org,
        rostedt@...dmis.org, minchan@...nel.org, linux-doc@...r.kernel.org,
        linux-block@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        linux-kselftest@...r.kernel.org, linux-kernel@...r.kernel.org,
        Goldwyn Rodrigues <rgoldwyn@...e.com>,
        Kuno Woudt <kuno@...b.nl>,
        Richard Fontana <fontana@...rpeleven.org>,
        Ciaran Farrell <Ciaran.Farrell@...e.com>,
        Christopher De Nicolo <Christopher.DeNicolo@...e.com>,
        Christoph Hellwig <hch@....de>,
        Jonathan Corbet <corbet@....net>,
        Thorsten Leemhuis <linux@...mhuis.info>
Subject: Re: [PATCH v9 1/6] LICENSES: Add the copyleft-next-0.3.1 license

J Lovejoy wrote:
> (And to give credit where credit is due, Bradley's input during that
> challenging "negotiation" was very helpful. :)

😊 … thank you!

I'd written today:
>> So, this problem that Thomas notes above is definitely an error by the
>> SPDX project, *just like* the one that exists for the deprecated “GPL-2.0”

J Lovejoy replied:
> To be clear, the GPL-2.0 identifier was never an error by the SPDX team - we
> were always very clear as to what it meant/means.

… but notwithstanding a clear definition of a moniker (which I agree indeed
you've made for most SPDX identifiers), if that definition fails to
adequately match historically understanding (and/or fails to take into
account nuances in the document it represents), confusion ensues for users.
Users *were* confused about “GPL-2.0” (remember, we did a small (admittedly
non-scientific) survey at a session at a conference — FOSDEM I think it was?)

Most SPDX *users* won't speak its defined terms fluently; I suspect most of
Linux's licensors (and even most licensees) don't speak SPDX fluently, so
presumably you want SPDX identifiers to have some intuitiveness —
particularly for the use case of linux-spdx, which requires the identifiers
to be *both* human-readable and machine-readable.

This is relevant to the copyleft-next-0.3.1 identifier.  SPDX could define
“copyleft-next-0.3.1” to mean for SPDX purposes: “the text of copyleft-next
without any options in its terms exercised/removed” (— although I note
https://spdx.org/licenses/copyleft-next-0.3.1.html seems to be wholly silent
regarding options exercising/removing).  However, there is currently
confusion — shown in the fact that Thomas still asked:
>>>> If I want to remove this option, then how do I express this with a SPDX
>>>> license identifier?  Sigh!
… upon noticing this part of copyleft-next:
>>> +    Unless I explicitly remove the option of Distributing Covered Works
>>> +    under Later Versions, You may Distribute Covered Works under any Later
>>> +    Version.

Anyway, I'm pointing out SPDX's shortcomings on this point *not* to
captiously admonish SPDX, but rather to point out that any issues with SPDX
identifiers and their formal definitions shouldn't influence a decision about
what licenses are acceptable for inclusion as dual-license options in Linux.

Plus, I remain hopeful that over the long-term, the SPDX project will take
feedback from efforts like linux-spdx to solve the kinds of problems that
have come up in this thread and others.

Finally, I've already started a sub-thread on the copyleft-next list to start
discussing maybe the license (in future versions) shouldn't have this option
anyway (for unrelated policy reasons).  That might yield a side-benefit of
making the problem evaporate entirely for SPDX.  (Anyway, after 25 years of
living with GPL's “-or-later vs. -only” mess — I, for one, am convinced new
licenses like copyleft-next should try very hard to not repeat that mistake.)

 -- bkuhn