Re: compatibility matrix for /usr/share/common-licenses

Francesco Poli <[email protected]> Tue, 2 Jul 2024 19:58:13 +0200
Newsgroups	gmane.linux.debian.devel.legal
Message-ID	<[email protected]>
On Tue, 02 Jul 2024 00:01:54 +0200 Serafeim Zanikolas wrote:

[...]
> On Sun Jun 30, 2024 at 11:50 PM CEST, Francesco Poli wrote:
> > On Sun, 30 Jun 2024 22:37:22 +0200 Serafeim Zanikolas wrote:
[...]
> > I think some incompatibilities are missing.
> > At least the following ones:
> >
> >   Apache-2.0: GPL-2
> 
> the image I've originally linked to in wikipedia suggests that apache-2 is
> compatible with MPL-2 which in turn is compatible with all GPL licenses.
> what am I missing?
[...]

GPL-2 is compatible with BSD-3-clause
BSD-3-clause is compatible with a proprietary license

however, GPL-2 is incompatible with a proprietary license

I would say that the missing detail is that license compatibility is
not a transitive relation!

> 
> > [*] Please note that the compatibility status of MPL-2.0 is more
> > complicated than a simple yes or no: it is compatible with "Secondary
> > Licenses", unless it is explicitly made incompatible with the notice
> > described in Exhibit B or the covered software was previously available
> > under MPL-1.1 or earlier, but not also dual-licensed under a "Secondary
> > License".
> > "Secondary Licenses" are: GPL-2+, LGPL-2.1+, AfferoGPL-3.0+
> 
> right, I guess that's why the wikipedia diagram distinguishes between MPL-2 and
> MPL-2-no-copyleft-exception. I think that we don't have to worry about that
> because spdx.org/licenses defines a distinct license identifier for the
> -no-copyleft-exception variant, and dep5 requires the use of spdx identifiers.
> (which is to say that we can assume that MPL-2 is in fact MPL-2 without the
> copyleft exception and therefore GPL compatible)

OK, so by "MPL-2.0" we are only referring to the MPL version 2.0
license applied in such a way to be compatible with "Secondary
Licenses".

> 
> anyway, I do expect that we might have to iterate a bit on this, and I don't
> trust myself to accurate copy things manually from one place to another, so I've put the
> revised matrix with all the context over at:
> 
> 	https://salsa.debian.org/debian/adequate/-/blob/tech-notes/license-incompatibility.md
> 
> please do feel free to include patches in any follow ups here (e.g with
> git format-patch)

Well, before I start sending patches (for instance to reintroduce GPL-2
in the Apache-2.0 row), some questions:

 * are you going to completely ignore GPL-1 (assuming it's no longer so
   widely adopted)? I am asking because I see that you included it in
   the Artistic row, but not in other rows (such as GPL-3 or MPL-2.0
   or ...)

 * why did you drop LGPL-3 from the GPL-2 row? they are incompatible...

 * why did you introduce LGPL-2+, LGPL-2.1, and LGPL-3 in the MPL-1.1
   row? as far as I know, the LGPL licenses are (linking-)compatible
   with MPL-1.1 ...


-- 
 http://www.inventati.org/frx/
 There's not a second to spare! To the laboratory!
..................................................... Francesco Poli .
 GnuPG key fpr == CA01 1147 9CD2 EFDF FB82  3925 3E1C 27E1 1F69 BFFE
signature.asc (application/pgp-signature, 833 B)