Re: update on only/or later etc.

Brad Edmondson

Hi David, 

I think your points are good ones, but it seems to me they go to the separate issues of "file:detected license" and "package:concluded license." 

The clarity of the spec argument is aimed at making the "file:detected license" case more explicit, and if it leaves tools with NOASSERTION for "package:concluded license," then I think that's OK, no?


Brad Edmondson, Esq.
512-673-8782 | brad.edmondson@...

On Fri, Nov 17, 2017 at 10:35 AM, Wheeler, David A <dwheeler@...> wrote:
J Lovejoy:

> Do NOT add a identifier or operator, etc. for the found-license-text-only scenario where you don’t know if the intent of the copyright holder was “only or “or later” and are thus left to interpret clause

I disagree, sorry.

> - we don’t need to solve this right now and we can always add this option later
> - without adding a third option, we are in the same position we have been in since the birth of the SPDX License List. incremental changes have always been our go-to strategy; let’s take a first step to clarify the current identifiers in a way that the FSF can get behind. If, for a later release, we think we need this third option, then we can discuss that further once we have some time under our belts with this change. 

No, this is the *reason* that there's a problem.  The *reason* that "GPL-2.0" isn't working is, in part, because it overloads two notions.  "GPL-2.0" is supposed to mean "Only 2.0" (per the spec) .  But tools only know "I saw a GPL-2.0 license", so how can they represent that information?  The obvious way is "GPL-2.0", so that same identifier can mean "2.0 at least, and I don't know if there are other versions allowed".  That's not good.

If we wait to "add this option later", "GPL-2.0-only" will probably have morphed in *practice* into "GPL-2.0 at least, and I don't know if it's the only version".  So while everyone can congratulate themselves about the clarity of the spec, very soon it will predictably be *unclear* in practice.  If we want to be able to express "exactly this version", we also need to be able to represent "at least this version".

--- David A. Wheeler

Spdx-legal mailing list

Join to automatically receive all group messages.