In the scope of REUSE we've noticed [^1] that just providing LPGL-3.0* –
as downloaded from SPDX – in a repo does not suffice as it requires its
mother license, GPL-3.0*. LGPL could be seen as an exception to GPL, but
it's not treated as such by the FSF.

Matija and I discussed that with FSF and the different options we have
to suit SPDX, REUSE and other downstreams. We found a compromise: there
is now an officially acknowledged license text that contains both
LGPL-3.0 and GPL-3.0:

https://www.gnu.org/licenses/lgpl+gpl.txt

Now my request: can we get this combined version into SPDX' license list
data, e.g. [^2]?
[^1]: https://github.com/fsfe/reuse-tool/issues/86
[^2]: https://github.com/spdx/license-list-data/blob/master/text/LGPL-3.0-or-later.txt

On Wed, Jul 28, 2021 at 11:01 AM Max Mehl <max.mehl@...> wrote:

In the scope of REUSE we've noticed [^1] that just providing LPGL-3.0* –
as downloaded from SPDX – in a repo does not suffice as it requires its
mother license, GPL-3.0*. LGPL could be seen as an exception to GPL, but
it's not treated as such by the FSF.

Matija and I discussed that with FSF and the different options we have
to suit SPDX, REUSE and other downstreams. We found a compromise: there
is now an officially acknowledged license text that contains both
LGPL-3.0 and GPL-3.0:

https://www.gnu.org/licenses/lgpl+gpl.txt

Has this been discussed publicly?

Now my request: can we get this combined version into SPDX' license list
data, e.g. [^2]?
[^1]: https://github.com/fsfe/reuse-tool/issues/86
[^2]: https://github.com/spdx/license-list-data/blob/master/text/LGPL-3.0-or-later.txt

I think that you stated explicitly this is not a new license, just a
clarification (optional one?) that providing both texts when
referencing LGPL-3* is better.
How could one ever handle this sanely in practice? If this is not a
new license, why would you need a new license identifier? If this is a
new license, or a new previsously unstated requirement of the LGPL 3
it would need some wide open and public discussion IMHO.

Some examples of the new and updated clarity issues this brings:

Say I stumbled on the text at
https://www.gnu.org/licenses/lgpl+gpl.txt in some project... is this
project using the LGPL only or the LGPL and the GPL that apply? It is
impossible to disambiguate which one applies short of a statement by
the authors that they mean the GPL not to apply but that only the LGPL
should be considered there and that the GPL text is there only for
reference.

What if a project contains both GPL3 and LGPL 3-licensed code? They
could use the exact same text as above and I would still not be able
to disambiguate short of extra statements.

Now say the author added a license identifier in the code saying that
this is "LGPL-3.0-only"... did they forget to reference the GPL text
in the combined text above? Or is this really just LGPL? Or is some
part of the code GPL-licensed but not marked as such? I cannot say for
sure either and I would not trust that. I still need some more
explicit statements to get clarity.

IMHO the status of the LGPL as a self standing text or whether it
needs to be accompanied by the GPL text has been a jolly mess of
ambiguity since the release of the L/GPL3*.

I cannot see how the FSF releasing a text that combines two texts
makes it any better, to the contrary: it just adds even more ambiguity
and confusion. Even more so if there has been no public discussion on
the topic.

I cannot fathom how this kind of confusion, uncertainty and doubt is
helpful to anyone producing or consuming LGPL-licensed code.

Hi Philippe,

(I mistyped the spdx-tech address, fixed here)

~ Philippe Ombredanne [2021-07-28 12:04 +0200]:

On Wed, Jul 28, 2021 at 11:01 AM Max Mehl <max.mehl@...> wrote:

In the scope of REUSE we've noticed [^1] that just providing LPGL-3.0* –
as downloaded from SPDX – in a repo does not suffice as it requires its
mother license, GPL-3.0*. LGPL could be seen as an exception to GPL, but
it's not treated as such by the FSF.

Matija and I discussed that with FSF and the different options we have
to suit SPDX, REUSE and other downstreams. We found a compromise: there
is now an officially acknowledged license text that contains both
LGPL-3.0 and GPL-3.0:

https://www.gnu.org/licenses/lgpl+gpl.txt

Has this been discussed publicly?

The ticket in the reuse-tool is public, the discussions with FSF were
private with John Sullivan and Donald Robertson.

Do I understand correctly that FSF still doesn't think of LGPL-3.0 as an
exception to GPL-3.0 (even though functionally and structurally it is)
and thus wants us all now to identify LGPL-3.0 as a conjunctive license
expression, using and?

What is the implication of just LGPL-3.0 at this point, then? What
happens in terms of backward compatibility for everyone already using
that identifier?

I appreciate you looking into this, but it really would have helped to
be involved.

As had been discussed here before, LGPL more aptly belongs on the
exceptions list to be used with the WITH operator.

In any case, any change like this is not inconsequential for existing
users of SPDX and all scenarios need to be fully discussed (as we
learned last time we made a major change in our identifiers for the
FSF). Is this change initiated by REUSE or FSF?

Do I understand correctly that FSF still doesn't think of LGPL-3.0 as an

exception to GPL-3.0 (even though functionally and structurally it is) 
and thus wants us all now to identify LGPL-3.0 as a conjunctive license 
expression, using and?

Yes, that was a suggestion made by Matija in the discussion we've had.
It was turned down by FSF.

What is the implication of just LGPL-3.0 at this point, then? What 
happens in terms of backward compatibility for everyone already using 
that identifier?

I appreciate you looking into this, but it really would have helped to 
be involved.

We didn't think this was so controversial to be honest.

Again, my point of view is that this improves the situation for users,
especially those of REUSE: so far, when adding the LGPL-3.0 license from
SPDX to their repo for LGPL-3.0 licensed code, the license text was
incomplete as it required the GPL-3.0 license to be present as well.
That's unintuitive and would have required special clauses in tooling
like REUSE.

Now, we have a concatenated version. The license effectively did not
change from my perspective, now it's just complete and intuitive. But
IANAL.

Please note that the official LGPL text by FSF has not been altered. The
concatenated version is an alternative format.

As had been discussed here before, LGPL more aptly belongs on the 
exceptions list to be used with the WITH operator.

Again, full ack. But my understanding was that SPDX did not want to go
this route as the license steward (FSF) does not consider it an
exception but a separate license.

In any case, any change like this is not inconsequential for existing 
users of SPDX and all scenarios need to be fully discussed (as we 
learned last time we made a major change in our identifiers for the 
FSF). Is this change initiated by REUSE or FSF?

I cannot speak for FSF, just REUSE and the FSFE, REUSE's coordinator.

REUSE obviously does not intent to change SPDX identifiers or cause
compliance issues. I, too, dislike the -only/-or-later special cases,
which is also why my motivation was to get rid of this special case that
two license texts for one license have to be shipped. 

I am afraid that compliance issues have been caused *before* this change
as the downloaded LGPL-3.0 license was not complete.

Best,
Max

On 7/28/21 9:08 AM, Max Mehl wrote:

Do I understand correctly that FSF still doesn't think of LGPL-3.0 as an

exception to GPL-3.0 (even though functionally and structurally it is)
and thus wants us all now to identify LGPL-3.0 as a conjunctive license
expression, using and?

Yes, that was a suggestion made by Matija in the discussion we've had.
It was turned down by FSF.

to clarify: the FSF turned down GPL-3.0* WITH LGPL-3.0* or
GPL-3.0* AND LGPL-3.0*
(as you understand it, not asking you to speak for the FSF)

Now, we have a concatenated version. The license effectively did not
change from my perspective, now it's just complete and intuitive. But
IANAL.

From a practical perspective: the LGPL-3.0 clearly states at the top,
"This version of the GNU Lesser General Public License incorporates the
terms and conditions of version 3 of the GNU General Public License,
supplemented by the additional permissions listed below."
It is not uncommon for legal agreements to reference, by title or URL,
another document that is incorporated by such reference. Thus, not
actually including the text of GPL-3.0 does not make the LGPL-3.0
incomplete.

I have seen, in practice, people include the text of both in the COPYING
and COPYING.LGPL files - which has made me take pause wondering - are
some files under one and some under another or is it really just
LGPL-3.0? Having an SPDX identifier in the actual files denoting
"LGPL-3.0*" takes care of any confusion there.

I am afraid that compliance issues have been caused *before* this change
as the downloaded LGPL-3.0 license was not complete.

By compliance issues, do you mean compliance with the REUSE spec?

I guess the other point here is that - in my mind, using REUSE, as a
spec to provide license info, etc., should require SPDX and FSF to make
some kind of change. That seems a bit backwards.

In any case, I think it's good to have the discussion with all
interested parties, even if we got to it in a 'round about way. ;)

~ J Lovejoy [2021-07-28 17:34 +0200]:

From a practical perspective: the LGPL-3.0 clearly states at the
top, "This version of the GNU Lesser General Public License
incorporates the terms and conditions of version 3 of the GNU
General Public License, supplemented by the additional permissions
listed below." It is not uncommon for legal agreements to reference,
by title or URL, another document that is incorporated by such
reference. Thus, not actually including the text of GPL-3.0 does not
make the LGPL-3.0 incomplete.

That's interesting. If this was the case, the whole problem would not
exist. However, in the issue I've shared this was identified as a
problem by multiple persons.

- Users of REUSE would simply need to download LGPL-3.0 via the REUSE
tool. The tool fetches the SPDX License List's text, including with
the optional sections. As a result, no further action would be needed
to comply with the LGPL's condition that the GPL be included.

- License scanning tools following the SPDX License Matching Guidelines
would not be affected: as the entire GPL section is surrounded by
<optional> tags, existing occurrences of the LGPL text would still be
matched as LGPL, as has been the case thus far.