Licensing Problem #271
Comments
|
@arch1t3cht is there any reason we'd care about the dmg? Even for code signing, we're fine with the pkg, right? If it's not useful, we should probably just remove it. Regarding the license explanation in the installer, that's still accurate afaik since we link against gpl'd ffmpeg. |
|
there’s some more discrepancies, i’ve brought up before as a side note in the last bullet point of this comment Notably the vendored iconv and csri code is LGPL and partly GPL2 respectively. The former could just be dropped at the cost of slightly more hassle for MSVC builds, but the latter cannot and according to the copyright attribution was originally written by equinox (David Lampert) from libasa (which is long since defunct) (the interface itself is not GPL (and likely legally couldn't be enforeced as such anyway) but some implementations are) But also as mentioned above, any binary Aegisub build requires GPL libs anyway and Aegisub itself is not a library; tbh I don’t expect there to be any practical implications even if the entire Aegisub C++ code base was suddenly relicenced to GPL. |
|
I am very uninterested in auditing each individual file, or worrying about
licensing in general, so if I can make some general comment in the README
and forget about it that sounds great.
…On Sat, Jan 4, 2025, 20:37 Oneric ***@***.***> wrote:
there’s some more discrepancies, i’ve brought up before as a side note in
the last bullet point of this comment
<Aegisub/aegisite#13 (comment)>
Notably the vendored iconv and csri code is LGPL and partly GPL2
respectively. The former could just be dropped at the cost of slightly more
hassle for MSVC builds, but the latter cannot and according to the
copyright attribution was originally written by equinox (David Lampert)
from libasa (which is long since defunct) *(the interface itself is not
GPL (and likely legally couldn't be enforeced as such anyway) but some
implementations are)*
In practice these CSRI implementations only exists and is developed in
Aegisub nowadays and it really isn’t a vendored subproject, but part of
Aegisub’s own source. *(I’m also not aware of any other still-existing
users of the CSRI interface)*
But also as mentioned above, any binary Aegisub build requires GPL libs
anyway and Aegisub itself is not a library; tbh I don’t expect there to be
any practical implications even if the entire Aegisub C++ code base was
suddenly relicenced to GPL.
Just the remark in the README should reflect the actual state with
something like “All files not declared otherwise are licenced under
BSD-3clause which also the majority of files are licenced under, but
several other BSD and a few GPL bits are used.”
—
Reply to this email directly, view it on GitHub
<#271 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAYIODRD5F3LTQOUJOPWKND2JCZIXAVCNFSM6AAAAABUTQTSCCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNZRGQ4TQNBXHA>
.
You are receiving this because you commented.Message ID:
***@***.***>
|
|
I'm also uninterested in auditing each file, so I think it can be quickly processed with automating tool by
I think using SPDX-Identifer for all files should be more clear, including the old file with licensing attribution. But if you want to make it extra clear the automation could be configured to supplement a full license claim. ISC is functionally the same as BSD-2-Clause (I assume it's just BSD being scanned as ISC), so relicensing to BSD-3-Clause shouldn't be a hassle. And BSD-3-Clause is compatible with GPL, so after much cleaning, we can just say in the License file: "Unless otherwise noticed, Aegisub is distributed under BSD-3-Clause license, but the binary release is distributed under GNU General Public License (GPL) version 2 or later." I'll do the necessary work in a PR before 3.5.0 ships. |
Why do you want to relicence the files at all? It’s not all that uncommon to have multiple licences in the source code of a single work provided they’re all compatible. E.g. some individual files or modules in the Linux kernel use permissive BSD licences etc and the combined work is then considered effectively GPL2 (since the conditions of all other licences are but a subset of GPL2 — though conventional/safe interpretation may still require distributions to reproduce the original licence notices and/or full text). In libass, besides the main ISC, Unlicense/public-domain (whyhash), NTP (float parsing; basically the same as BSD-2) and BSD-2 (aarch64 assembly utilities/helpers) are used. Since you’re not just distributing the source which meets all requirements by defaults, but compiled binaries as well, the latter should indeed be accompanied by a copyright notice with all authors and licences. This includes compiled-in external dependencies. I don't think any relicencing is required or real-world beneficial here. Just the note in the README and website needs updating and binaries should start to bundle the copyright and licence notices of everything which went into them. For Aegisub itself, the copyright+licence notice likely only needs to be generated and cleaned up once (if listing source paths: with a wildcard match for BSD-3) assuming no new non-BSD-3 files are added.
If an author didn’t leave a copyright notice, you don’t need to create one for them; all (sane) licence only require reproducing existing notices. Their copyright exists regardless though, so if you really want to go through with relicencing to something more permissive, yes you’ll need to track all authors. Git history helps here, but considering some stuff got bulk-imported from other projects won't be complete.
Depending on the licence, the final distribution may be required to reproduce the full text. As long as it exists and there’s a clear link where it applies, using only SPDX identifiers + author copyright notices in source file is probably fine (for most licences) though |
|
Relicensing is a bad idea, got it. Without relicensing, generating copyright notice is still beneficial for the automatic aggregation of README credit in About window. Even if it's still incomplete (could be taking a hack with et, al.), it's still better than the current staled claim.
Sounds good to you? I'm no expert in licensing either, so if there are concerns I'm happy for the feedback. Also needs to add some checking to Windows and macOS binary build, and unify claims on the website and in the document. |
|
For the Debian package I had to check the license on all files. This is what I got: |
The "Aegisub is distributed inder BSD-3-Clause" wording is a bit ambiguous wrt to whether the whole project or individual files are meant. How about:
Thanks! This omits some vendored subprojects though. With all subprojects vendored in the repo and omitting source file paths This could perhaps be further compacted by merging entries of the same licence and author but different dates. For luajit which isn’t part of the repo but atm most likely statically built into the final binary, after compacting dates it’s: |
This comment was marked as off-topic.
This comment was marked as off-topic.
TODO:
LICENCEfile:Current status:
LICENCEfile: BSD-3-Clause for the project, and indicates:src/gl/: "MIT license. See src/gl/glext.h"src/MatroskaParser.(c|h): "Licensed to BSDL with permission from the author."universalchardet/: "MPL 1.1", in subprojectThe text was updated successfully, but these errors were encountered: