[gentoo-project] What should the default acceptable licenses be?

[gentoo-project] What should the default acceptable licenses be?

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 1000 bytes --]

I would like to point the community at the following bug
https://bugs.gentoo.org/676248:
Bug 676248 - non-free licenses are accepted without user prompt

In summary the question is whether non-free licenses should be accepted
by default in Gentoo. today only licenses requiring EULA are not
accepted by default. So this is a good opportunity to discuss whether we
should deviate substantially from other distros like Debian.

My personal opinion is we should have a default accepting FSF and OSI
approved free/libre licenses and require acceptance for anything else
though package.license / ACCEPT_LICENSE. Since we have this model
already we don't need a separate repository like debian does for its
binary packages, so any change has relatively minor impact on our users
as long as it is presented properly and with a proper timeline.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[gentoo-project] Re: What should the default acceptable licenses be?

[Chí-Thanh Christopher Nguyễn]

Kristian Fiskerstrand schrieb:
> In summary the question is whether non-free licenses should be accepted
> by default in Gentoo. today only licenses requiring EULA are not
> accepted by default. So this is a good opportunity to discuss whether we
> should deviate substantially from other distros like Debian.

Which ones are the "other distros" besides Debian? 
Fedora/openSUSE/Ubuntu/etc. all ship proprietary parts in default repositories.

> My personal opinion is we should have a default accepting FSF and OSI
> approved free/libre licenses and require acceptance for anything else
> though package.license / ACCEPT_LICENSE. Since we have this model
> already we don't need a separate repository like debian does for its
> binary packages, so any change has relatively minor impact on our users
> as long as it is presented properly and with a proper timeline.

No, the impact is considerable. As I pointed out in the previous 
discussion[1], it will require a deblobbed kernel among other things, a 
different approach to handling sourceless binaries under a free license (ulm 
suggested a no-source-code tag), and no small effort in educating users.

That said, I'm all for it. Gentoo should make users acknowledge when they 
install proprietary software.



Best regards,
Chí-Thanh Christopher Nguyễn


[1] 
https://archives.gentoo.org/gentoo-project/message/d2196de6a6c8285bfa9c1b789ef88dae

Re: [gentoo-project] Re: What should the default acceptable licenses be?

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 748 bytes --]

>>>>> On Sat, 26 Jan 2019, Chí-Thanh Christopher Nguyễn wrote:

> No, the impact is considerable. As I pointed out in the previous
> discussion[1], it will require a deblobbed kernel among other things,
> a different approach to handling sourceless binaries under a free
> license (ulm suggested a no-source-code tag), and no small effort in
> educating users.

This particular point has been addressed in the meantime. We have a
"no-source-code" license label which can be used alongside (e.g.) BSD
for binary-only packages.

> That said, I'm all for it. Gentoo should make users acknowledge when
> they install proprietary software.

> [1]
> https://archives.gentoo.org/gentoo-project/message/d2196de6a6c8285bfa9c1b789ef88dae

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

[gentoo-project] Re: What should the default acceptable licenses be?

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 627 bytes --]

Hi,

a shorter summary might be:

Don't accept non-free licenses by default -- prompt user instead.

I.e. you can still keep using non-free licenses. This is not about
banning non-free stuff. It is just a discussion about the
package.license mechanism which only prompts for EULA at the moment but
should also prompt for non-free licenses in future.

So if you are using a non-free license on purpose, adding it to your
package.license file is all you would have to do. Nothing else would change.


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] What should the default acceptable licenses be?

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 1959 bytes --]

On Sat, 2019-01-26 at 22:04 +0100, Kristian Fiskerstrand wrote:
> I would like to point the community at the following bug
> https://bugs.gentoo.org/676248:
> Bug 676248 - non-free licenses are accepted without user prompt
> 
> In summary the question is whether non-free licenses should be accepted
> by default in Gentoo. today only licenses requiring EULA are not
> accepted by default. So this is a good opportunity to discuss whether we
> should deviate substantially from other distros like Debian.
> 

I think the key point in this discussion is: what is the reason for this
change?  Is it ideological ("because RMS tells us it's bad")?  Is it
copycat rationale ("because Debian does it")?  Or do you have any
specific practical implications to support this?  (They should really be
listed in this thread!  Otherwise this really feels like it's a change
requested to suit somebody's fancy).

My personal opinion is that our default ACCEPT_LICENSE should be a safe
default for our users.  Not because they could get impure with non-free
software but because we don't want them to fall into pitfalls created by
restrictive licenses.

Most notably, we don't want to require users to verify whether they are
allowed to use the program they've just installed, or whether they can
build it with custom patches.  If this change intends to help with this,
I'm for it.

However, I really do think you should clearly define the goals.  For
example, are you going 'free' to the point of defaulting to USE=bindist?

Also, what about restrictive 'free' licenses that can actually get
people into trouble, like AGPL?  I personally don't think it should be
allowed by default.  Given the recent example, we don't want people
getting into trouble by upgrading berkdb on their systems, if they just
happen to use it and don't know the upgrade requires them to change
their online applications.

-- 
Best regards,
Michał Górny

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 963 bytes --]

Re: [gentoo-project] What should the default acceptable licenses be?

[Rich Freeman]

On Sat, Jan 26, 2019 at 4:04 PM Kristian Fiskerstrand <k_f@gentoo.org> wrote:
>
> My personal opinion is we should have a default accepting FSF and OSI
> approved free/libre licenses and require acceptance for anything else
> though package.license / ACCEPT_LICENSE.

From a practical standpoint is this going to block anything used on
our stage3s or boot CDs needed for hardware support, such as firmware
blobs/etc?  I imagine most packages like this would not have
FSF/OSI-approved licenses.  That includes linux-firmware.

I'm not sure if those are installed by default or how essential they
are to actually boot/use any common hardware.

Aside from this, Gentoo has always been more about pragmatism when it
comes to licensing.  We certainly make it easy to restrict licenses
and have a pure-free system, but I'm not sure how painful it would be
for users to have this be a default.

In particular how likely is this to cause users to end up doing a
substantial rebuild 5 minutes after booting their stage3 just to get
the system back to a more "practical" state?  Granted, bindist
probably already causes these sorts of issues but we have no choice
there.

-- 
Rich

Re: [gentoo-project] What should the default acceptable licenses be?

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 2394 bytes --]

On Sat, Jan 26, 2019 at 5:52 PM Rich Freeman <rich0@gentoo.org> wrote:

> On Sat, Jan 26, 2019 at 4:04 PM Kristian Fiskerstrand <k_f@gentoo.org>
> wrote:
> >
> > My personal opinion is we should have a default accepting FSF and OSI
> > approved free/libre licenses and require acceptance for anything else
> > though package.license / ACCEPT_LICENSE.
>
> From a practical standpoint is this going to block anything used on
> our stage3s or boot CDs needed for hardware support, such as firmware
> blobs/etc?  I imagine most packages like this would not have
> FSF/OSI-approved licenses.  That includes linux-firmware.
>

I think the stage3 is already pretty minimal anyway, I'd be curious about
what it would lose if we did this.


>
> I'm not sure if those are installed by default or how essential they
> are to actually boot/use any common hardware.
>

I want to avoid having a singular product here. I think ::gentoo is the
repo that is the metadistribution and we can basically have defaults there.
Consumers of ::gentoo are expected to tweak it. I think this is different
than say, a liveDVD image. The latter we don't expect users to tweak before
using and we should be trying to support normal use cases. If we need to
use non-free firmware to do it, I expect us to do that so that users who
boot the media actually get a working Gentoo install.

So I don't buy an argument that "Gentoo" as a whole has to do a particular
thing. I expect this discussion is actually more about "the Gentoo repo"
than about any particular shipped media. Maybe I'm misunderstanding things
though.


>
> Aside from this, Gentoo has always been more about pragmatism when it
> comes to licensing.  We certainly make it easy to restrict licenses
> and have a pure-free system, but I'm not sure how painful it would be
> for users to have this be a default.
>
> In particular how likely is this to cause users to end up doing a
> substantial rebuild 5 minutes after booting their stage3 just to get
> the system back to a more "practical" state?  Granted, bindist
> probably already causes these sorts of issues but we have no choice
> there.
>

I take the Bezos approach here. There are 2 types of decisions: reversible
and irreversible. This is a reversible decision pretty much, so its low
risk. If we change the default and the world starts to hate us, we can just
change it back.

-A


>
> --
> Rich
>
>

[-- Attachment #2: Type: text/html, Size: 3461 bytes --]

Re: [gentoo-project] What should the default acceptable licenses be?

[Matt Turner]

On Sat, Jan 26, 2019 at 2:52 PM Rich Freeman <rich0@gentoo.org> wrote:
>
> On Sat, Jan 26, 2019 at 4:04 PM Kristian Fiskerstrand <k_f@gentoo.org> wrote:
> >
> > My personal opinion is we should have a default accepting FSF and OSI
> > approved free/libre licenses and require acceptance for anything else
> > though package.license / ACCEPT_LICENSE.
>
> From a practical standpoint is this going to block anything used on
> our stage3s or boot CDs needed for hardware support, such as firmware
> blobs/etc?  I imagine most packages like this would not have
> FSF/OSI-approved licenses.  That includes linux-firmware.
>
> I'm not sure if those are installed by default or how essential they
> are to actually boot/use any common hardware.

It's very common to need firmware to use wired or wireless networking.
I would not want to ship installation media without requisite
firmware.

Re: [gentoo-project] What should the default acceptable licenses be?

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 695 bytes --]

On 2019-01-28 23:27, Matt Turner wrote:
> It's very common to need firmware to use wired or wireless networking.
> I would not want to ship installation media without requisite
> firmware.

I don't think that sys-kernel/linux-firmware would be affected.

But if it would be affected, where's the problem? Just create
/etc/portage/package.license for that media.

Again, the main motion is for users starting with a fresh stage3 image.
Gentoo is about choices. So the only thing which will actually change is
an additional prompt because we are raising awareness...


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] What should the default acceptable licenses be?

[Brian Evans]

[-- Attachment #1.1: Type: text/plain, Size: 1573 bytes --]

On 1/29/2019 11:54 AM, Thomas Deutschmann wrote:
> On 2019-01-28 23:27, Matt Turner wrote:
>> It's very common to need firmware to use wired or wireless networking.
>> I would not want to ship installation media without requisite
>> firmware.
> 
> I don't think that sys-kernel/linux-firmware would be affected.
> 
> But if it would be affected, where's the problem? Just create
> /etc/portage/package.license for that media.
> 
> Again, the main motion is for users starting with a fresh stage3 image.
> Gentoo is about choices. So the only thing which will actually change is
> an additional prompt because we are raising awareness...
> 
> 

This is a barrier for new users.  As seen in #gentoo, new users are
often quite confused over the prompt to add static-libs to
sys-apps/util-linux when installing genkernel.  They think it is an
error and rush for support to solve it.

Now the chance that more user issues will occur with licenses will only
increase.

sys-kernel/gentoo-sources, or any sources for that matter, would have to
be exempted on each and every install (larger barrier and confusion).

75-90% of all users will need to be add sys-firmware/linux-firmware to
package.license so what's the point? Yes, specific configurations can
exist without it, but those are becoming increasingly rare.

I say instead of changing the default, have more clear documentation on
how to have users change things to what they want if they choose this
"free as in freedom" mantra.  I'd rather have less barriers and more users.

Brian


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 834 bytes --]

Re: [gentoo-project] What should the default acceptable licenses be?

[Roy Bamford]

[-- Attachment #1: Type: text/plain, Size: 2381 bytes --]

On 2019.01.29 17:28, Brian Evans wrote:
> On 1/29/2019 11:54 AM, Thomas Deutschmann wrote:
> > On 2019-01-28 23:27, Matt Turner wrote:
> >> It's very common to need firmware to use wired or wireless
> networking.
> >> I would not want to ship installation media without requisite
> >> firmware.
> > 
> > I don't think that sys-kernel/linux-firmware would be affected.
> > 
> > But if it would be affected, where's the problem? Just create
> > /etc/portage/package.license for that media.
> > 
> > Again, the main motion is for users starting with a fresh stage3
> image.
> > Gentoo is about choices. So the only thing which will actually
> change is
> > an additional prompt because we are raising awareness...
> > 
> > 
> 
> This is a barrier for new users.  As seen in #gentoo, new users are
> often quite confused over the prompt to add static-libs to
> sys-apps/util-linux when installing genkernel.  They think it is an
> error and rush for support to solve it.
> 
> Now the chance that more user issues will occur with licenses will
> only
> increase.
> 
> sys-kernel/gentoo-sources, or any sources for that matter, would have
> to
> be exempted on each and every install (larger barrier and confusion).
> 
> 75-90% of all users will need to be add sys-firmware/linux-firmware to
> package.license so what's the point? Yes, specific configurations can
> exist without it, but those are becoming increasingly rare.
> 
> I say instead of changing the default, have more clear documentation
> on
> how to have users change things to what they want if they choose this
> "free as in freedom" mantra.  I'd rather have less barriers and more
> users.
> 
> Brian
> 
> 

After being nagged about ACCEPT_LICENSE a few times, most users 
will set  ACCEPT_LICENSE="*" just for an easy life. They already have 
a lot to learn and this is the easy answer to this new learning opportunity.

The few users that actually care about politically correct free software
can be educated in the handbook as to what to set in  ACCEPT_LICENSE

Leave the default ACCEPT_LICENSE= as is but update the handbook to
explain have to set ACCEPT_LICENSE together with a health warning
about potential problems.

That keeps the majority of users happy.

-- 
Regards,

Roy Bamford
(Neddyseagoon) a member of
elections
gentoo-ops
forum-mods

[-- Attachment #2: Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] What should the default acceptable licenses be?

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 2935 bytes --]

On Tue, Jan 29, 2019 at 11:54 AM Thomas Deutschmann <whissi@gentoo.org>
wrote:

> On 2019-01-28 23:27, Matt Turner wrote:
> > It's very common to need firmware to use wired or wireless networking.
> > I would not want to ship installation media without requisite
> > firmware.
>
> I don't think that sys-kernel/linux-firmware would be affected.
>
> But if it would be affected, where's the problem? Just create
> /etc/portage/package.license for that media.
>
> Again, the main motion is for users starting with a fresh stage3 image.
> Gentoo is about choices. So the only thing which will actually change is
> an additional prompt because we are raising awareness...
>

A few questions here:

1) Do the users not currently have a choice today? (e.g. do we need to
populate the @nonfree license set?)
2) Are the users aware of the choice? I suspect this feels closer to your
intent. While its perhaps technically possible to make an informed
decisions on licensing we do not force users to make a choice, and so many
accept the default.
3) Some Gentoo community members find the existing default problematic
because it does includes nonfree software, and think Gentoo should ship
with only free software by default.

I think if there isn't a @free-only (or -@nonfree) item we should do the
work to make that possible (so ensure 1 is implemented.)

I think if we wanted to inform users about choices[0], we could set the
default to "-*" and give users a set of choices with descriptions about
each. This would require users to make an informed licensing choice by
default; because the lack of a choice would prevent an install. It would do
what you wrote though, and raise awareness about licensing in Gentoo (and
OSS in general.)

I personally am against making the default @free-only (or FSF or OSI
approved, or whatever moniker you want to assign) but I'm obviously one of
many and I'm sure there are developers who support this idea (see more
below.)

-A

[0] I assert that users have a choice today (because they can change the
variable) and if we made it default to @free-software users would still
have a choice, and the awareness benefit is actually quite limited. I don't
think having a default 'enables choice' at all, it just pushes a different
ideology (whatever ideology is the default, because most users accept and
use that.) Pushing an ideology is fine, but I would rather be up front
about such things, vs trying to write a narrative that somehow making the
default be "@free-software" somehow gives users more choices; because
assuming the license group exists today, we are not adding choices at all.
I think a @free default fits right into the Gentoo Social Contract and
while I oppose it on a personal basis (because I think the result harms
users) I do support it on an organizational basis.


>
> --
> Regards,
> Thomas Deutschmann / Gentoo Linux Developer
> C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5
>
>

[-- Attachment #2: Type: text/html, Size: 3707 bytes --]

Re: [gentoo-project] What should the default acceptable licenses be?

[Rich Freeman]

On Tue, Jan 29, 2019 at 12:53 PM Alec Warner <antarus@gentoo.org> wrote:
>
> 1) Do the users not currently have a choice today? (e.g. do we need to populate the @nonfree license set?)

Since licenses are excluded by default I'm not sure if a non-free
explicit set helps much, but there is an EULA license group.

> I think if there isn't a @free-only (or -@nonfree) item we should do the work to make that possible (so ensure 1 is implemented.)

We have plenty of options here:
FREE-SOFTWARE
FREE
BINARY-REDISTRIBUTABLE
GPL-COMPATIBLE
FSF-APPROVED
OSI-APPROVED
MISC-FREE

(Just a selection.)

Everything is in profiles/license_groups

>  I think a @free default fits right into the Gentoo Social Contract and while I oppose it on a personal basis (because I think the result harms users) I do support it on an organizational basis.

Not depending on non-free software sounds nice in principle until you
start talking about all those little things that make physical
hardware actually work.  If it were a practical option I'd be all for
it.  Otherwise this is a choice that really only exists on paper.

For seasoned users it isn't that big a deal since we mostly have our
own make.conf files and so on.  I just am concerned it will be hard
for users.

What will we put in the handbook?  Will we want to encourage them to
use a config that we know will often not work, or will we be up-front
that our defaults break most of the time in the real world?  If we
have a default that often causes problems we should probably be pretty
up-front about that in the handbook so that users don't have to go to
#gentoo when their system breaks to find out that nobody actually
follows the official docs/defaults.

Honestly, though, Gentoo has for its entire history been about
practical defaults, and not about FSF/OSI purity.  We certainly try
not to depend on non-free software as we say in our social contract,
but these issues are all way upstream of Gentoo.  IMO we ought to be
finding a practical balance here and not be driven entirely by
ideology.  Personally I'm a pretty big FSF fan in general, but I think
a distro needs to be practical first, with the option for purity, but
of course complying with redistribution restrictions.

-- 
Rich

Re: [gentoo-project] What should the default acceptable licenses be?

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 1173 bytes --]

On 1/29/19 7:27 PM, Rich Freeman wrote:
> Not depending on non-free software sounds nice in principle until you
> start talking about all those little things that make physical
> hardware actually work.  If it were a practical option I'd be all for
> it.  Otherwise this is a choice that really only exists on paper.

This is a matter of documentation in the handbook, though.

e.g on my laptop (all of my systems have similar setups already) which
has ACCEPT_LICENSE="-* @FREE -AGPL-3 -AGPL-3+ freedist ", the exception
list still only are has
# cat /etc/portage/package.license/*|wc -l
21
... of which 4 entries are related to AGPL and as such wouldn't really
be relevant for the proposed change. and that is a full desktop (laptop)
system, most systems have far less. In terms of linux-firmware, it
requires a simple two entries
sys-kernel/linux-firmware linux-firmware no-source-code
sys-kernel/gentoo-sources linux-firmware


.. but at least that gives specific knowledge of the non-free installs.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] What should the default acceptable licenses be?

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 1103 bytes --]

On 1/29/19 7:41 PM, Kristian Fiskerstrand wrote:
> On 1/29/19 7:27 PM, Rich Freeman wrote:
>> Not depending on non-free software sounds nice in principle until you
>> start talking about all those little things that make physical
>> hardware actually work.  If it were a practical option I'd be all for
>> it.  Otherwise this is a choice that really only exists on paper.
> 
> This is a matter of documentation in the handbook, though.
> 
> e.g on my laptop (all of my systems have similar setups already) which
> has ACCEPT_LICENSE="-* @FREE -AGPL-3 -AGPL-3+ freedist ", the exception
> list still only are has
> # cat /etc/portage/package.license/*|wc -l
> 21
> ... of which 4 entries are related to AGPL and as such wouldn't really
> be relevant for the proposed change. and that is a full desktop (laptop)

...and actually has a bit of cruft due to experimenting with
hardware/drivers and apps I didn't ultimately end up using...


-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] What should the default acceptable licenses be?

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 2250 bytes --]

On 2019-01-29 18:53, Alec Warner wrote:
> 1) Do the users not currently have a choice today? (e.g. do we need 
> to populate the @nonfree license set?)

Yes and no :-)

In theory, users currently have a choice. However we set

> ACCEPT_LICENSE="* -@EULA"

by default. This means:

The package manager will accept _any_ license except licenses within
EULA license group.


> 2) Are the users aware of the choice? I suspect this feels closer to 
> your intent. While its perhaps technically possible to make an 
> informed decisions on licensing we do not force users to make a 
> choice, and so many accept the default.

Nobody can answer that question for sure. We can only take Brian's mail
as data point that at least new users aren't aware.

Most users will notice once they have to install a package which is
using an EULA. Famous package was www-plugins/adobe-flash or drivers.


> 3) Some Gentoo community members find the existing default
> problematic because it does includes nonfree software, and think
> Gentoo should ship with only free software by default.
> 
> I think if there isn't a @free-only (or -@nonfree) item we should do 
> the work to make that possible (so ensure 1 is implemented.)
Stop. Maybe we need to split this discussion:

SSPL is something new from my P.O.V. I am not aware of any other license
which has special requirements when you decide to run the licensed
software for someone else (or like you call it nowadays, "as a service").

So even if SSPL will get OSI approval (and MonogDB upstream expects
approval according to their FAQ) I am not sure if package manager should
merge such a software without further prompts.


My understanding is that some other developers want to go one step
further and change

> ACCEPT_LICENSE="* -@EULA"

into

> ACCEPT_LICENSE="@FREE"

I am not (yet) part of this motion.

But keep in mind: If this motion will end up with

> ACCEPT_LICENSE="@FREE"

we will get back to this topic in case OSI will approve SSPL in which
case we would have to add SSPL to OSI-APPROVED which is part of FREE
group...


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] What should the default acceptable licenses be?

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 3174 bytes --]

On Tue, Jan 29, 2019 at 7:12 PM Thomas Deutschmann <whissi@gentoo.org>
wrote:

> On 2019-01-29 18:53, Alec Warner wrote:
> > 1) Do the users not currently have a choice today? (e.g. do we need
> > to populate the @nonfree license set?)
>
> Yes and no :-)
>
> In theory, users currently have a choice. However we set
>
> > ACCEPT_LICENSE="* -@EULA"
>
> by default. This means:
>
> The package manager will accept _any_ license except licenses within
> EULA license group.
>

>
> > 2) Are the users aware of the choice? I suspect this feels closer to
> > your intent. While its perhaps technically possible to make an
> > informed decisions on licensing we do not force users to make a
> > choice, and so many accept the default.
>
> Nobody can answer that question for sure. We can only take Brian's mail
> as data point that at least new users aren't aware.
>
> Most users will notice once they have to install a package which is
> using an EULA. Famous package was www-plugins/adobe-flash or drivers.
>
>
I'm trying to ascertain if this is something we should push for. We could
make the default "-*" and force users to make a choice, for example.


>
> > 3) Some Gentoo community members find the existing default
> > problematic because it does includes nonfree software, and think
> > Gentoo should ship with only free software by default.
> >
> > I think if there isn't a @free-only (or -@nonfree) item we should do
> > the work to make that possible (so ensure 1 is implemented.)
> Stop. Maybe we need to split this discussion:
>
> SSPL is something new from my P.O.V. I am not aware of any other license
> which has special requirements when you decide to run the licensed
> software for someone else (or like you call it nowadays, "as a service").


> So even if SSPL will get OSI approval (and MonogDB upstream expects
> approval according to their FAQ) I am not sure if package manager should
> merge such a software without further prompts.
>

>
> My understanding is that some other developers want to go one step
> further and change
>
> > ACCEPT_LICENSE="* -@EULA"
>
> into
>
> > ACCEPT_LICENSE="@FREE"
>
> I am not (yet) part of this motion.
>
> But keep in mind: If this motion will end up with
>
> > ACCEPT_LICENSE="@FREE"
>
> we will get back to this topic in case OSI will approve SSPL in which
> case we would have to add SSPL to OSI-APPROVED which is part of FREE
> group...
>
>
So this is the first time SSPL has come up in the thread, but I see its the
original point of the bug. My bad, I fail at reading. When K_F opened the
thread, SSPL itself (and AGPL) were not raised, so I ended up parsing the
thread as free / non-free. Again my apologies.

I think the challenge here is always is publishing why decisions were made,
and then applying them evenly. For example:
https://wiki.gentoo.org/wiki/License_groups/Non-free lists many licenses in
the "non-free" category that are likely also not in the EULA category, that
we allow by default.

So I'm trying to understand why we would exclude SSPL, but not 'arj' for
example.

-A


>
> --
> Regards,
> Thomas Deutschmann / Gentoo Linux Developer
> C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5
>
>

[-- Attachment #2: Type: text/html, Size: 4794 bytes --]

Re: [gentoo-project] What should the default acceptable licenses be?

[Rich Freeman]

On Tue, Jan 29, 2019 at 11:54 AM Thomas Deutschmann <whissi@gentoo.org> wrote:
>
> On 2019-01-28 23:27, Matt Turner wrote:
> > It's very common to need firmware to use wired or wireless networking.
> > I would not want to ship installation media without requisite
> > firmware.
>
> I don't think that sys-kernel/linux-firmware would be affected.
>

Uh, this is just an algorithm:
# grep LICENSE /usr/portage/sys-kernel/linux-firmware/linux-firmware-20190118.ebuild
LICENSE="linux-firmware ( BSD ISC MIT no-source-code ) GPL-2 GPL-2+ freedist"

I won't reproduce here, but you can:
# grep OSI /usr/portage/profiles/license_groups
# grep FSF/usr/portage/profiles/license_groups

If anything in the ebuild license isn't in those groups, then this
policy change would block them by default, on stage3s and minimal CDs.

-- 
Rich

Re: [gentoo-project] What should the default acceptable licenses be?

[Matt Turner]

On Tue, Jan 29, 2019 at 8:54 AM Thomas Deutschmann <whissi@gentoo.org> wrote:
>
> On 2019-01-28 23:27, Matt Turner wrote:
> > It's very common to need firmware to use wired or wireless networking.
> > I would not want to ship installation media without requisite
> > firmware.
>
> I don't think that sys-kernel/linux-firmware would be affected.
>
> But if it would be affected, where's the problem? Just create
> /etc/portage/package.license for that media.
>
> Again, the main motion is for users starting with a fresh stage3 image.
> Gentoo is about choices. So the only thing which will actually change is
> an additional prompt because we are raising awareness...

I wasn't expressing an opinion on the issue of $topic. Just answering
Rich's question about whether it's important to ship non-free firmware
on the installation media.

We can certainly continue shipping non-free firmware on the
installation media regardless of what the default choice is within
Gentoo.

[gentoo-project] Re: What should the default acceptable licenses be?

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 2900 bytes --]

On 1/26/19 10:04 PM, Kristian Fiskerstrand wrote:
> I would like to point the community at the following bug
> https://bugs.gentoo.org/676248:
> Bug 676248 - non-free licenses are accepted without user prompt
> 
> In summary the question is whether non-free licenses should be accepted
> by default in Gentoo. today only licenses requiring EULA are not
> accepted by default. So this is a good opportunity to discuss whether we
> should deviate substantially from other distros like Debian.
> 
> My personal opinion is we should have a default accepting FSF and OSI
> approved free/libre licenses and require acceptance for anything else
> though package.license / ACCEPT_LICENSE. Since we have this model
> already we don't need a separate repository like debian does for its
> binary packages, so any change has relatively minor impact on our users
> as long as it is presented properly and with a proper timeline.
> 

This topic has been discussed from time to time, including in 2013 in
https://archives.gentoo.org/gentoo-project/message/b36af97cdf6172217974a3afb30475bd
. However, context change and 6 years is likely enough time to permit a
new discussion.

What constitute free software is a broad discussion, so for the context
of these discussions I recommend we keep to the FSF and OSI definitions.
These definitions protects the user's rights to copy/modify/use the
application without repercussions, and that is exactly why it should be
the default license.

As soon as a user start using a non-free license the user needs to
make judgments on how it will impact on further choice, and likely need
to consult a lawyer for practicality if using it in any commercial context.

In particular in a scenario where the license change unexpectedly this
can be an interesting twist, as seen with MongoDB. To quote

http://lists.opensource.org/pipermail/license-review_lists.opensource.org/2018-October/003739.html
:
"Developers don’t always pay attention and given they have stated any
updates to older versions moving forward are SSPL a developer just
grabbing a security update suddenly means you’re not under AGPL anymore
but SSPL."

The consequences for a user arise when using non-free licenses, so the
default should be to allow free licenses by default.

A more puritan approach could be to not provide any approved license at
all, but the Gentoo Social contract says "Gentoo is and will remain free
software", which makes @FREE the natural choice.

Most of the issues from the previous discussions have been solved by
now, increasing the value of re-opening the discussion, and the
user-impact is minimal for setting a default of @FREE given proper
documentation in the handbook.


-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Re: What should the default acceptable licenses be?

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 4817 bytes --]

On Tue, Feb 5, 2019 at 6:49 PM Kristian Fiskerstrand <k_f@gentoo.org> wrote:

> On 1/26/19 10:04 PM, Kristian Fiskerstrand wrote:
> > I would like to point the community at the following bug
> > https://bugs.gentoo.org/676248:
> > Bug 676248 - non-free licenses are accepted without user prompt
> >
> > In summary the question is whether non-free licenses should be accepted
> > by default in Gentoo. today only licenses requiring EULA are not
> > accepted by default. So this is a good opportunity to discuss whether we
> > should deviate substantially from other distros like Debian.
> >
> > My personal opinion is we should have a default accepting FSF and OSI
> > approved free/libre licenses and require acceptance for anything else
> > though package.license / ACCEPT_LICENSE. Since we have this model
> > already we don't need a separate repository like debian does for its
> > binary packages, so any change has relatively minor impact on our users
> > as long as it is presented properly and with a proper timeline.
> >
>
> This topic has been discussed from time to time, including in 2013 in
>
> https://archives.gentoo.org/gentoo-project/message/b36af97cdf6172217974a3afb30475bd
> . However, context change and 6 years is likely enough time to permit a
> new discussion.
>
> What constitute free software is a broad discussion, so for the context
> of these discussions I recommend we keep to the FSF and OSI definitions.
> These definitions protects the user's rights to copy/modify/use the
> application without repercussions, and that is exactly why it should be
> the default license.
>

So I think the TL;DR for me here is that I'd rather the Council have
decided that "We interpret the social contract in a way whereby Gentoo
should espouse free software and we believe we can do better here by
setting the default ACCEPT_LICENSE to "-* @FREE". I think some of your
comments below go further than that and I'm not sure that helps your case
(and at least the comments concern me slightly.)

I believe that irrespective of any ideology that @FREE does provide
benefits, namely that:
 - The OSI and FSF are stewards of the OSD and they will vet and review
licenses that meet the OSD. This is beneficial to end users who want a
vetted and controlled licensing experience for such software.
 - Users trust the OSI and FSF (and by extension, licenses@gentoo.org, who
populate the in-tree copy) with this task.

Delegation is a useful tool that removes the burden from users who would
have to vet on their own.


> As soon as a user start using a non-free license the user needs to
> make judgments on how it will impact on further choice, and likely need
> to consult a lawyer for practicality if using it in any commercial context.
>

> In particular in a scenario where the license change unexpectedly this
> can be an interesting twist, as seen with MongoDB. To quote
>
>
> http://lists.opensource.org/pipermail/license-review_lists.opensource.org/2018-October/003739.html
> :
> "Developers don’t always pay attention and given they have stated any
> updates to older versions moving forward are SSPL a developer just
> grabbing a security update suddenly means you’re not under AGPL anymore
> but SSPL."
>
> The consequences for a user arise when using non-free licenses, so the
> default should be to allow free licenses by default.
>

I mostly don't find this argument valuable. OSI and FSF have consequences
to anyone who redistributes them, but somehow they are allowed by default
(because freedom?) This is why I continue to advocate for a deliberate
choice based on the social contract ("Gentoo is and will remain Free and
thus the default should be "-* @FREE" rather than some kind of objective
choice based on 'consequences'; which I think just muddle the point.


>
> A more puritan approach could be to not provide any approved license at
> all, but the Gentoo Social contract says "Gentoo is and will remain free
> software", which makes @FREE the natural choice.
>

I agree w/this FWIW.


>
> Most of the issues from the previous discussions have been solved by
> now, increasing the value of re-opening the discussion, and the
> user-impact is minimal for setting a default of @FREE given proper
> documentation in the handbook.
>

I'm going to re-iterate william's comment here in that I don't think the
council has a good idea of what the user impact is; however I suspect this
is not an intractable issue and I don't think it blocks any decision (and
as noted in the meeting, we can always make changes later.)

-A


>
> --
> Kristian Fiskerstrand
> OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
> fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
>
>

[-- Attachment #2: Type: text/html, Size: 6714 bytes --]

Re: [gentoo-project] Re: What should the default acceptable licenses be?

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 1796 bytes --]

On 2019-02-12 20:40, Alec Warner wrote:
> This is why I continue to advocate for a deliberate choice based on
> the social contract ("Gentoo is and will remain Free and thus the
> default should be "-* @FREE" rather than some kind of objective 
> choice based on 'consequences'; which I think just muddle the point.

Sorry, I don't get this. You understand that a change from

> ACCEPT_LICENSE="* -@EULA" (active today)

to

> ACCEPT_LICENSE="-* @FREE"

is the same like

> ACCEPT_LICENSE="@FREE"

Isn't it ("-*" isn't needed; at the moment we say "don't prompt for _any
license_ except licenses from @EUAL group")?


And I also don't understand people discussing consequences:

1) There's no hard block.

2) Existing systems won't break because PM will prompt to accept any
license of installed packages not yet accepted. Even in case you will
reject that prompt, your existing system won't break (you won't get new
updates for those packages, that's all).

3) New users will have to learn about ACCEPT_LICENSE earlier, that's all.

4) There's also no plan to force projects like releng to stick to
ACCEPT_LICENSE default. If any project wants to use package X which
requires license Y they are free to do so (of course you have to comply
with law, only content which we are allowed to redistribute...).

5) This change will basically only affect stage3. And ulm already did an
audit of stage3 and aside kernel sources (due to outdated eclass) all
currently included packages are only using licenses from @FREE group. So
if you want to, you could say, we are only adjust ACCEPT_LICENSE to
licenses we are actually using in our stage3.


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Re: What should the default acceptable licenses be?

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 761 bytes --]

On 2/13/19 10:34 AM, Thomas Deutschmann wrote:
> On 2019-02-12 20:40, Alec Warner wrote:
>> This is why I continue to advocate for a deliberate choice based on
>> the social contract ("Gentoo is and will remain Free and thus the
>> default should be "-* @FREE" rather than some kind of objective 
>> choice based on 'consequences'; which I think just muddle the point.
> Sorry, I don't get this. You understand that a change from
> 

I understand it more as a point about how we present the change; and I
agree, it is more clear to just refer to social contract and no other
rationale or description.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Re: What should the default acceptable licenses be?

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1029 bytes --]

>>>>> On Wed, 13 Feb 2019, Thomas Deutschmann wrote:

> On 2019-02-12 20:40, Alec Warner wrote:
>> This is why I continue to advocate for a deliberate choice based on
>> the social contract ("Gentoo is and will remain Free and thus the
>> default should be "-* @FREE" rather than some kind of objective
>> choice based on 'consequences'; which I think just muddle the point.

> Sorry, I don't get this. You understand that a change from

>> ACCEPT_LICENSE="* -@EULA" (active today)

> to

>> ACCEPT_LICENSE="-* @FREE"

> is the same like

>> ACCEPT_LICENSE="@FREE"

> Isn't it ("-*" isn't needed; at the moment we say "don't prompt for
> _any license_ except licenses from @EUAL group")?

It is the same when starting from an empty default. IIUC, Portage
does its lookup in the order make.globals, then make.defaults,
then make.conf, so keeping the "-*" would have the advantage that it
overrides the default of previous Portage versions. Otherwise, I don't
see how "-* @FREE" (rather than "@FREE") could cause any harm.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]