Re: Names of licenses we currently support / where should license text live?
|
Jeff Luszcz
Hi Kate et al,
toggle quoted message
Show quoted text
As we discussed on the call a few times, I think having this amazing list of license in one place is a great asset to the community and I believe will help reduce license proliferation (esp. if spdx.org, Linux foundation, OSI, etc... continue to work on anointing certain license as preferred.) One of my concerns in having the SPDX document only contain links to these reference licenses instead of the actual full text is that we have the chance of drift and incompleteness a few years down the road, especially if the list of licenses we anointed as "reference license" becomes as large as it looks like it is becoming. We see analogies to this in our day to day license analysis in these current cases: Files that say "see License.txt file for more info" and the License.txt is missing "See http://www.gnu.org/licenses/lgpl.html" in a file where this used to mean lgpl 2.1 in 2006, it now means lgpl 3.0 since the link target text was changed by the FSF "Download from my university page http://www.ccsf.edu/~someStudent" which is now gone and no longer alive "This is under a BSD license" when in fact they've added Copyleft style terms or other strange things to the actual license text. My thoughts: A SPDX doc should be completely self contained for long term validity, but can reference out to the spdx.org web site as a hook for optional data that may appear down the road Some organizations have serious confidential concerns about outside web links/dependencies in Intellectual Property reports such as SPDX By this I mean, if to render or validate the text of a license for a spdx report an organization has to hit the spdx.org website, this may cause leakage of confidential info Having a large list of references licenses is great, especially if common names can be created for them Template licenses / references are great for scanning tool verification / spec compliance etc but the SPDX doc should contain the actual text of the license in effect Regards, Jeff -----Original Message----- |
|
|