[gentoo-dev] Ranged licenses

[gentoo-dev] Ranged licenses

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 714 bytes --]

CRAN (like CPAN, Gems etc for GNU R) has a rather interesting way of
specifying licenses:

    License: GPL-2
    License: GPL (>= 2) | BSD
    License: LGPL (>= 2.0, < 3) | Eclipse Public License

Is this something worth pinching for a future EAPI? If we go with the
postfix [] form for ranged deps, it'd translate into:

    LICENSE="=GPL-2" (or equivalently, LICENSE="GPL[=2]")
    LICENSE="|| ( GPL[>=2] BSD )" (or equivalently, ">=GPL-2")
    LICENSE="|| ( LGPL[>=2&<3] Eclipse )"

One thing that would need to be decided:

    LICENSE="GPL-2"

Would that require an = prefix? To simplify things, we could say that
*only* the postfix [] form counts for licenses...

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[gentoo-dev] Re: Ranged licenses

[Christian Faulhammer]

[-- Attachment #1: Type: text/plain, Size: 946 bytes --]

Ciaran McCreesh <ciaran.mccreesh@blueyonder.co.uk>:

> Is this something worth pinching for a future EAPI? If we go with the
> postfix [] form for ranged deps, it'd translate into:
>     LICENSE="=GPL-2" (or equivalently, LICENSE="GPL[=2]")
>     LICENSE="|| ( GPL[>=2] BSD )" (or equivalently, ">=GPL-2")
>     LICENSE="|| ( LGPL[>=2&<3] Eclipse )"

 This is hardly readable, in my eyes at least but I am older than 25
now.  I think it is not really necessary (overkill), but I haven't
heard anything from other people yet.
 
> One thing that would need to be decided:
> 
>     LICENSE="GPL-2"
> 
> Would that require an = prefix? To simplify things, we could say that
> *only* the postfix [] form counts for licenses...

 To have backwards compatability...yes.

V-Li

-- 
Christian Faulhammer, Gentoo Lisp project
<URL:http://www.gentoo.org/proj/en/lisp/>, #gentoo-lisp on FreeNode

<URL:http://www.faulhammer.org/>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Ranged licenses

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 567 bytes --]

On Wed, 28 Nov 2007 20:06:46 +0100
Christian Faulhammer <opfer@gentoo.org> wrote:
> > One thing that would need to be decided:
> > 
> >     LICENSE="GPL-2"
> > 
> > Would that require an = prefix? To simplify things, we could say
> > that *only* the postfix [] form counts for licenses...
> 
>  To have backwards compatability...yes.

Backwards compatibility isn't necessary over an EAPI bump. The question
is whether it's sufficiently useful that having inconsistent parsing
rules for dep specs and license specs is acceptable.

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Ranged licenses

[Thilo Bangert]

[-- Attachment #1: Type: text/plain, Size: 1168 bytes --]

Ciaran McCreesh <ciaran.mccreesh@blueyonder.co.uk> said:
> On Wed, 28 Nov 2007 20:06:46 +0100
>
> Christian Faulhammer <opfer@gentoo.org> wrote:
> > > One thing that would need to be decided:
> > >
> > >     LICENSE="GPL-2"
> > >
> > > Would that require an = prefix? To simplify things, we could say
> > > that *only* the postfix [] form counts for licenses...
> >
> >  To have backwards compatability...yes.
>
> Backwards compatibility isn't necessary over an EAPI bump. The question
> is whether it's sufficiently useful that having inconsistent parsing
> rules for dep specs and license specs is acceptable.

perhaps its really a matter of how often this would be used. for a span of 
three license versions, i'd prefer unranged notation as it's more easily 
read (opfer's argument).

/usr/portage/licenses seems to carry but a handfull of licenses with more 
than three version numbers. 

ranged version numbers OTOH are used much more often...

there is also the legal argument. it's better to state explicitly which 
versions apply and not have to cleanup the mess, when somebody decides to 
release GPL-2.5.

kind regards
Thilo

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Ranged licenses

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 682 bytes --]

On Wed, 28 Nov 2007 23:54:57 +0100
Thilo Bangert <bangert@gentoo.org> wrote:
> there is also the legal argument. it's better to state explicitly
> which versions apply and not have to cleanup the mess, when somebody
> decides to release GPL-2.5.

That's an argument strongly in favour of ranged specs. A huge number of
packages are licensed under "GPL 2 or later", and currently most ebuilds
incorrectly use LICENSE="GPL-2" for these. Even changing these to
LICENSE="|| ( GPL-2 GPL-3 )" just shifts the problem around a bit. With
CRAN "GPL 2 or later" translates to "GPL (>= 2)", which is a much more
accurate description of a package's license.

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[gentoo-dev] Re: Ranged licenses

[Ryan Hill]

[-- Attachment #1: Type: text/plain, Size: 1231 bytes --]

Ciaran McCreesh wrote:
> On Wed, 28 Nov 2007 23:54:57 +0100
> Thilo Bangert <bangert@gentoo.org> wrote:
>> there is also the legal argument. it's better to state explicitly
>> which versions apply and not have to cleanup the mess, when somebody
>> decides to release GPL-2.5.
> 
> That's an argument strongly in favour of ranged specs. A huge number of
> packages are licensed under "GPL 2 or later", and currently most ebuilds
> incorrectly use LICENSE="GPL-2" for these. Even changing these to
> LICENSE="|| ( GPL-2 GPL-3 )" just shifts the problem around a bit. With
> CRAN "GPL 2 or later" translates to "GPL (>= 2)", which is a much more
> accurate description of a package's license.

Either requires the same amount of work; auditing a package and correcting
the LICENSE variable.  I think we could take a previous idea of Flameeyes'
and add a GPL-2+ or GPL-2_or_later licence.

As for other licences, i have no real opinion.  It seems like a complex
solution for a small problem though.


-- 
                        looks like christmas at fifty-five degrees
                                    this latitude weakens my knees
    EFFD 380E 047A 4B51 D2BD  C64F 8AA8 8346 F9A4 0662 (0xF9A40662)


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Ranged licenses

[Robin H. Johnson]

[-- Attachment #1: Type: text/plain, Size: 1661 bytes --]

On Wed, Nov 28, 2007 at 11:02:25PM +0000, Ciaran McCreesh wrote:
> On Wed, 28 Nov 2007 23:54:57 +0100
> Thilo Bangert <bangert@gentoo.org> wrote:
> > there is also the legal argument. it's better to state explicitly
> > which versions apply and not have to cleanup the mess, when somebody
> > decides to release GPL-2.5.
> That's an argument strongly in favour of ranged specs. A huge number of
> packages are licensed under "GPL 2 or later", and currently most ebuilds
> incorrectly use LICENSE="GPL-2" for these. Even changing these to
> LICENSE="|| ( GPL-2 GPL-3 )" just shifts the problem around a bit. With
> CRAN "GPL 2 or later" translates to "GPL (>= 2)", which is a much more
> accurate description of a package's license.
Going beyond the GPL, there are a number of other license statements
that use an 'or later' clause, but there is only one version of the
license present so far. Doing the _or_later suffix hack is a bit nasty,
because then you expect to find that as a file in licenses/, or need to
have special handling for it.

I'm for ranged licenses, but I think attention needs to be paid to the
syntax. The postfix [] form does nicely separate the version information
from the actual license name (moreso than the traditional CPV atom), but
the LGPL[>=2&<3] example looks to be overloading it, when we already
have AND/OR at the higher level.
LICENSE="|| ( Eclipse ( LGPL[>=2] LGPL[<3] ) )"
Which is, Eclipse OR (LGPL v2 up to, but not including LGPLv3).

-- 
Robin Hugh Johnson
Gentoo Linux Developer & Infra Guy
E-Mail     : robbat2@gentoo.org
GnuPG FP   : 11AC BA4F 4778 E3F6 E4ED  F38E B27B 944E 3488 4E85

[-- Attachment #2: Type: application/pgp-signature, Size: 321 bytes --]

Re: [gentoo-dev] Ranged licenses

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 829 bytes --]

On Wed, 28 Nov 2007 18:40:27 -0800
"Robin H. Johnson" <robbat2@gentoo.org> wrote:
> I'm for ranged licenses, but I think attention needs to be paid to the
> syntax. The postfix [] form does nicely separate the version
> information from the actual license name (moreso than the traditional
> CPV atom), but the LGPL[>=2&<3] example looks to be overloading it,
> when we already have AND/OR at the higher level.
> LICENSE="|| ( Eclipse ( LGPL[>=2] LGPL[<3] ) )"
> Which is, Eclipse OR (LGPL v2 up to, but not including LGPLv3).

The ( ) form means something else for package dependencies, and so can't
be used for ranged dependencies. In particular:

    ( >=foo/bar-3 <foo-bar/4 )

will (correctly) be matched if both foo/bar-5 and foo/bar-1 are
installed, which can happen due to slots.

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Ranged licenses

[Robin H. Johnson]

[-- Attachment #1: Type: text/plain, Size: 1294 bytes --]

On Thu, Nov 29, 2007 at 02:48:52AM +0000, Ciaran McCreesh wrote:
> On Wed, 28 Nov 2007 18:40:27 -0800
> "Robin H. Johnson" <robbat2@gentoo.org> wrote:
> > I'm for ranged licenses, but I think attention needs to be paid to the
> > syntax. The postfix [] form does nicely separate the version
> > information from the actual license name (moreso than the traditional
> > CPV atom), but the LGPL[>=2&<3] example looks to be overloading it,
> > when we already have AND/OR at the higher level.
> > LICENSE="|| ( Eclipse ( LGPL[>=2] LGPL[<3] ) )"
> > Which is, Eclipse OR (LGPL v2 up to, but not including LGPLv3).
> The ( ) form means something else for package dependencies, and so can't
> be used for ranged dependencies. In particular:
>     ( >=foo/bar-3 <foo-bar/4 )
> will (correctly) be matched if both foo/bar-5 and foo/bar-1 are
> installed, which can happen due to slots.

Ok, I revise that for slots then:
LICENSE="|| ( Eclipse ( LGPL[>=2] !LGPL[>=3] ) )"
(which is more in line with my description of the license string).
The !/NEGATION might be inside the [] blocks, since the AND and OR
operators are.

-- 
Robin Hugh Johnson
Gentoo Linux Developer & Infra Guy
E-Mail     : robbat2@gentoo.org
GnuPG FP   : 11AC BA4F 4778 E3F6 E4ED  F38E B27B 944E 3488 4E85

[-- Attachment #2: Type: application/pgp-signature, Size: 321 bytes --]

Re: [gentoo-dev] Ranged licenses

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 1210 bytes --]

On Wed, 28 Nov 2007 18:58:07 -0800
"Robin H. Johnson" <robbat2@gentoo.org> wrote:
> > The ( ) form means something else for package dependencies, and so
> > can't be used for ranged dependencies. In particular:
> >     ( >=foo/bar-3 <foo-bar/4 )
> > will (correctly) be matched if both foo/bar-5 and foo/bar-1 are
> > installed, which can happen due to slots.
> 
> Ok, I revise that for slots then:
> LICENSE="|| ( Eclipse ( LGPL[>=2] !LGPL[>=3] ) )"
> (which is more in line with my description of the license string).
> The !/NEGATION might be inside the [] blocks, since the AND and OR
> operators are.

This gets really messy and hard to define sanely when you consider
things like slot and use dependencies. It also involves a lot of
duplication of package names. You're also breaking the package form

    ( >=foo/bar-2 !>=foo/bar-3 )

which has a different existing meaning (as do all other forms based
around repeating the cat/pkg part inside a block).

Really, the sanest way to do ranged dependencies is by extending the
syntax of individual package / license dep specs, and the postfix
[opver&opver] / [opver|opver] form is the least icky proposal.

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[gentoo-dev] Re: Ranged licenses

[Steve Long]

Christian Faulhammer wrote:
> Ciaran McCreesh <ciaran.mccreesh@blueyonder.co.uk>:
> 
>> Is this something worth pinching for a future EAPI? If we go with the
>> postfix [] form for ranged deps, it'd translate into:
>>     LICENSE="=GPL-2" (or equivalently, LICENSE="GPL[=2]")
>>     LICENSE="|| ( GPL[>=2] BSD )" (or equivalently, ">=GPL-2")
>>     LICENSE="|| ( LGPL[>=2&<3] Eclipse )"
> 
>  This is hardly readable, in my eyes at least but I am older than 25
> now.  I think it is not really necessary (overkill), but I haven't
> heard anything from other people yet.
>
>> One thing that would need to be decided:
>> 
>>     LICENSE="GPL-2"
>> 
>> Would that require an = prefix? To simplify things, we could say that
>> *only* the postfix [] form counts for licenses...
> 
>  To have backwards compatability...yes.
> 
Could this not simplify to <license><version-spec> where version spec is
either a simple -ver prefix as with GPL-2 (meaning only GPL-2) or a postfix
range specifier? IOW allow the existing usage since its meaning is clear
and it's easy to parse.

I'd also be in favour of an implicit = so that GPL[>2] would cover the most
common usage. After all, in the realm of licensing it makes no sense to
have eg GPL[>3] mean anything after, but not including 3, since the new
version must be specified before usage for it to mean anything legally.
(Otherwise how is a user to know the terms of the license being referred
to?)

Overall though I like it; GPL[2|3] (from other post) vs '|| ( GPL-2 GPL-3 )'
sounds nice as well.


-- 
gentoo-dev@gentoo.org mailing list