Re: compatibility matrix for /usr/share/common-licenses

"Serafeim Zanikolas" <[email protected]> Tue, 02 Jul 2024 00:01:54 +0200
Newsgroups	gmane.linux.debian.devel.legal
Message-ID	<[email protected]>
hello Francesco! nice to read you too and thanks for the feedback :)

On Sun Jun 30, 2024 at 11:50 PM CEST, Francesco Poli wrote:
> On Sun, 30 Jun 2024 22:37:22 +0200 Serafeim Zanikolas wrote:
[..]
> If I understand correctly, we are talking about linking-compatibility
> here.

that's right

I guess I should have specified that for the purposes of adequate, we need to
err on the side of false negatives (otherwise, I imagine that there'd be so many
false positives that people would stop paying attention).

> I think some incompatibilities are missing.
> At least the following ones:
>
>   Apache-2.0: GPL-2

the image I've originally linked to in wikipedia suggests that apache-2 is
compatible with MPL-2 which in turn is compatible with all GPL licenses. what am
I missing? (of course, it's possible that an apache-2 lib depends on
MPL-2-no-copyleft-exception, but we only need to enumerate direct binary/lib
relations here)

> [*] Please note that the compatibility status of MPL-2.0 is more
> complicated than a simple yes or no: it is compatible with "Secondary
> Licenses", unless it is explicitly made incompatible with the notice
> described in Exhibit B or the covered software was previously available
> under MPL-1.1 or earlier, but not also dual-licensed under a "Secondary
> License".
> "Secondary Licenses" are: GPL-2+, LGPL-2.1+, AfferoGPL-3.0+

right, I guess that's why the wikipedia diagram distinguishes between MPL-2 and
MPL-2-no-copyleft-exception. I think that we don't have to worry about that
because spdx.org/licenses defines a distinct license identifier for the
-no-copyleft-exception variant, and dep5 requires the use of spdx identifiers.
(which is to say that we can assume that MPL-2 is in fact MPL-2 without the
copyleft exception and therefore GPL compatible)

anyway, I do expect that we might have to iterate a bit on this, and I don't
trust myself to accurate copy things manually from one place to another, so I've put the
revised matrix with all the context over at:

	https://salsa.debian.org/debian/adequate/-/blob/tech-notes/license-incompatibility.md

please do feel free to include patches in any follow ups here (e.g with
git format-patch)

thanks again,
Serafeim
signature.asc (application/pgp-signature, 833 B)