Re: [gentoo-dev] Re: [RFC] Adding 'GPL-2-only', 'GPL-3-only' etc. license variants for better auditing

[Matt Turner <mattst88@gentoo.org>]

On Sat, Sep 21, 2019 at 1:58 PM Ulrich Mueller <ulm@gentoo.org> wrote:
>
> >>>>> On Sat, 21 Sep 2019, Michał Górny wrote:
>
> > I'd like to propose to employ a more systematic method of resolving this
> > problem.  I would like to add additional explicit 'GPL-n-only' licenses,
> > and discourage using short 'GPL-n' in favor of them.  The end result
> > would be three licenses per every version/variant, e.g.:
>
> >   GPL-2-only -- version 2 only
> >   GPL-2+     -- version 2 or newer
> >   GPL-2      -- might be either, audit necessary
>
> To elaborate a bit more on this: "GPL-2" already has that well defined
> meaning that your proposed "GPL-2-only" has, namely that the package is
> licensed under the GNU General Public License, version 2.

We are all aware. But the point is to explicitly put "-only" in the
LICENSE metadata so that ebuild authors are less likely to confuse
GPL-2 vs GPL-2+.

> Presumably, your change would cause a long transition time, in which we
> would have *three* variants for every GPL version (as well as LGPL,
> AGPL, FDL), two of them with identical meaning. And after the transition
> time, we would have "GPL-2-only" instead of "GPL-2", which is not only
> longer but also not accurate.

Sure, but who cares about a long transition time? We still have EAPI=0
ebuilds in tree -- and that's okay since we can quickly and easily
tell what hasn't been transitioned!

> Plus, it would result in paradoxical entries like "|| ( GPL-2-only
> GPL-3-only )" for a package that can be distributed under GPL versions 2
> or 3 but no later version.

That paradoxical entry is pretty clear to me.

> If the goal of this exercise is to do an audit of ebuilds labelled as
> "GPL-2", then a less intrusive approach (which I had already suggested
> when this issue had last been discussed) would be to add a comment to
> the LICENSE line, either saying "# GPL-2 only" for packages that have
> been verified. Or the other way aroung, starting with a comment saying
> that it is undecided, which would be removed after an audit. This would

It's not a one-time audit. Michał has a history of fixing things in
ways that does not allow the issue to return. I imagine that's what
he's doing here, and it would not surprise me at all if something
could be wired into CI to help ensure this.

> have the advantage not to confuse users, and have no impact on their
> ACCEPT_LICENSE settings. (For example, some people exclude AGPL and
> would have to add entries for AGPL-3-only.)

Trivial concern solved with a news item.