GPL only issue raised by kernel maintainers on LKML

[pombredanne]

I wanted to bring this to your attention as there is may be some issue with the new -only license texts:

See https://lkml.org/lkml/2018/2/8/469

Subject	Re: [PATCH v6] checkpatch.pl: Add SPDX license tag check
From	Joe Perches <>
Date	Thu, 08 Feb 2018 09:24:13 -0800
	

On Thu, 2018-02-08 at 15:35 +0100, Philippe Ombredanne wrote:
> However checking that licenses ids are known and listed in the kernel
> doc is essential IMHO to avoid drift and insulate the kernel from SPDX
> updates. Case in point  the new SPDX "GPL-2.0-only" is NOT what was
> documented by tglx and therefore should not be used and banned until
> we update the doc accordingly. and until we update ALL the GPL-2.0 to
> GPL-2.0-only eventually which is best done at once.

Agree and I've attached what I believe to be a
reasonable script for that conversion only after
LICENSE directories are updated with the
appropriate and license files and after
Documentation/process/license-rules.rst is modified.

> Otherwise, this is
> going to be a total mess on top of a complicated topic that requires
> quite a bit of maintainer energy!

There will always be some energy requirement and
no doubt some legal advice involvement too.

In another vein:

The existing license files in spdx.org seem
somewhat sloppily edited and perhaps have less
clarity and precision than desired.

For instance:

If the newer SPDX descriptor "GPL-2.0-only" is to
be used, why does this license URL:

https://spdx.org/licenses/GPL-2.0-only.html

still contain the phrase ", or (at your option) any later version".

The current diff between GPL-2.0-only and GPL-2.0-or-later:

$ wget -q https://spdx.org/licenses/GPL-2.0-only.html
$ wget -q https://spdx.org/licenses/GPL-2.0-or-later.html
$ diff -U0 GPL-2.0-only.html GPL-2.0-or-later.html 
--- GPL-2.0-only.html	2017-12-28 12:17:20.000000000 -0800
+++ GPL-2.0-or-later.html	2017-12-28 12:17:22.000000000 -0800
@@ -15 +15 @@
-    <title>GNU General Public License v2.0 only | Software Package Data Exchange (SPDX)</title>
+    <title>GNU General Public License v2.0 or later | Software Package Data Exchange (SPDX)</title>
@@ -141 +141 @@
-      <h1 property="dc:title">GNU General Public License v2.0 only</h1>
+      <h1 property="dc:title">GNU General Public License v2.0 or later</h1>
@@ -144 +144 @@
-          <p style="margin-left: 20px;"><code property="spdx:name">GNU General Public License v2.0 only</code></p>
+          <p style="margin-left: 20px;"><code property="spdx:name">GNU General Public License v2.0 or later</code></p>
@@ -147 +147 @@
-          <p style="margin-left: 20px;"><code property="spdx:licenseId">GPL-2.0-only</code></p>
+          <p style="margin-left: 20px;"><code property="spdx:licenseId">GPL-2.0-or-later</code></p>
@@ -160 +160 @@
-          <p style="margin-left: 20px;">This license was released: June 1991 This refers to when this GPL 2.0 only is being used (as opposed to GPLv2 or later).</p>
+          <p style="margin-left: 20px;">This license was released: June 1991</p>
@@ -679 +679,2 @@
-        as published by the Free Software Foundation; version 2.
+	as published by the Free Software Foundation; version 2
+	or any later version.


I am not a lawyer, this is not legal advice, etc... but:

The "1991 This" use in the -only file seems be missing
a period.

In any case it is awkwardly phrased as "or later" perhaps
should not be referenced at all.

The GPL 2.0 license as published by the Free Software
Foundation includes the option for using later versions.

Perhaps the SPDX -only licenses should be more specific
when it uses the phrase "as published by the Free
Software Foundation; version <n>." to specifically
exclude the option of any later version.

[wking]

If the newer SPDX descriptor "GPL-2.0-only" is to be used, why does this license URL:

https://spdx.org/licenses/GPL-2.0-only.html

still contain the phrase ", or (at your option) any later version".

Since GPL-2.0-only landed in a5d240c (#553), its <standardLicenseHeader> has contained the “; version 2” text, and that is reflected on the website. There were some typos in the 3.0 license list of other GPL licenses (see here), but I think GPL-2.0-only's <standardLicenseHeader> was clean in the 3.0 license list.

[jlovejoy]

I think this is a similar issue/question as to #617 - the reality is that the full license text from the FSF has the "or (at your option) any later version" wording in the header example in the "How to Apply These Terms to Your New Programs". SPDX has reflected the different wording as would be used in the Standard License Header tag/section. I don't think we can reflect that change in the actual license text, unless the FSF agreed. But even so, the reality is that when people provide a copy of the license text, that is how it appears. I understand how this can be a bit confusing for someone just coming to the SPDX License List pages, but... it's not a confusion we created.

[hraban]

since the FSF text is for a -or-later version, and you already adapted it by introducing the wording for what a -only should look like (in the ), why not just adapt that block of sample license text in the original text? It's not part of the "actual" license (it's after "end of Terms and Conditions"), it just advises people what to use. You could safely align that bit with your proposed text.

[wking]

… why not just adapt that block of sample license text in the original text?

Because the SPDX doesn't like changing upstream's wording. It's up to the upstream license stewards to change the wording. As @jlovejoy pointed out:

I don't think we can reflect that change in the actual license text, unless the FSF agreed.

And (also as @jlovejoy pointed out), even GPL-2.0-only projects will include the stock GPL-2.0 text with the appendix including the FSF's or-later wording (e.g. here's the Linux kernel doing that, even though the Linux-specific addition at the start of that file says the default for Linux code is GPL-2.0-only).

So I don't think clobbering the FSF-supplied appendix is a useful solution to this issue. I do think updating LicenseListPublisher to make our recommended grant more prominent would be a good idea, but that's not a license-list-XML issue.

[jlovejoy]

discussed on April 5 legal call: decided to "solve" this by adding a note to all the -only versions explaining why you see the "or later version" text in the license addendum (How to apply licnese section). This will need some wordsmithing, so we will accomplish this for 3.2 release.

[bradleeedmondson]

Like #617, needs further discussion (that this solves the issue and is OK in light of cooperation with FSF to make the -only/-or-later change in the first place) and then needs someone to write the note.

[jlovejoy]

closing this as seems to be same thing as #617 and now have PR #797 to address