wiki:SWLicense

Version 12 (modified by RayPlante, 11 years ago) (diff)

--

An Open Source License for LSST

Introduction

LSST as a project has a mandate to publish all of its software as open source. There are a multitude of open source/free software licenses to choose from. At the same time, LSST has a few specific desiderata to take into consideration when choosing the "right" license:

  • Acknowledgement and credit of authorship
  • Establishing ownership without restricting use
  • Preserving all non-commercial use
  • Allowing, but not necessarily encouraging, commercial use

Another issue to take into consideration is that of copyright. Code written using LSST funds would have the approved LSST copyright notice, all other code would have the appropriate copyright notice instead. Whatever license is chosen should allow the specification and preservation of different copyright notices.

Proposal

Given all the above, the Apache License 2.0 appears to be a good fit. It allows users of Apache licensed software to

  • Copy, distribute and modify the software
  • Exercise patent rights on the portions of software that they use that would normally only be the right of the licensor only

At the same time, the Apache license requires that

  • All copies, modified or unmodified, are accompanied by a copy of the license
  • All modifications are clearly marked as being the work of the modifier
  • All notices of copyright, trademark and patent rights are reproduced accurately in distributed copies
  • The licensee does not start legal action against the licensor(s) over patent infringement
  • The licensee does not use any trademarks that belong to the licensor

It is useful to note that software distributed under the Apache license 2.0 is provided as is (i.e. without any warranty of any sort).

Implementation

In practice adopting the Apache License 2.0 means

  1. Adding a reference to the appropriate license and copyright information to each source file and each header.
  2. Distributing with the code or otherwise making available a LICENSE file and a NOTICE file.

The LICENSE file contains the Apache License 2.0 text itself. The NOTICE file contains all the copyright notices needed.

Proposed disclaimer in source/header files (local NOTICE file)

/* See the NOTICE file distributed with this work 
 * for information regarding copyright ownership.
 *
 * Licensed under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */


Proposed disclaimer in source/header files (remote NOTICE file)

/* See the NOTICE file available at
 *
 *     http://www.lsst.org/license/NOTICE
 *
 * for information regarding copyright ownership.
 *
 * Licensed under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */


Example NOTICE file (adapted from Apache httpd 2.0)

LSST Pipeline Framework
Copyright 2008, 2009, 2010 LSST Corporation.

This product includes software developed by the
LSST Project (http://www.lsst.org/).

Portions of this software were developed at the National Center
for Supercomputing Applications (NCSA) at the University of
Illinois at Urbana-Champaign.

This software contains code derived from the RSA Data Security
Inc. MD5 Message-Digest Algorithm, including various
modifications by Spyglass Inc., Carnegie Mellon University, and
Bell Communications Research, Inc (Bellcore).

Regular expression support is provided by the PCRE library package,
which is open source software, written by Philip Hazel, and copyright
by the University of Cambridge, England. The original software is
available from
   ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/

Comments

Email discussion between Ray and Francesco

Date: Wed, 3 Sep 2008 07:12:40 -0500 (CDT)
From: Ray Plante
To: Francesco Pierfederici
Cc: Robyn Allsman

Francesco,

Would you have time to address some questions regarding this topic before the meeting. Putting the answers on the trac page would be best. (I suppose I can put my questions there, too.)

  • Does the Apache license say anything regarding linking with libraries covered by other licenses?
  • Apache 2 is said to be "compatible" with GNU. What does this mean to us, particularly with regard to linking against GNU libraries? What versions of GNU is it compatible with.
  • It was suggested at a past DC3 telecon that because we link against GNU software, we must license our own as GNU, or that at least that there are enough open questions about this that GNU represents the safest choice. In your opinion, what is the status of this discussion?

thanks! Ray

Date: Wed, 3 Sep 2008 13:56:47 +0100
From: "Francesco Pierfederici"

My understanding is that if we link our software against GNU Licensed software then the combined binary product (our code + GNU code) has to be GPLed. There is no way around it. The Apache 2 license is compatible with GPL 3 but not 2 or earlier versions (because of the clause on patents in the Apache license). Compatibility with GPL means that we can link against GPLed code. However the end result has to be GPLed as well.

The Apache 2 license is very liberal and does not even require that modified version of the software are distributed under the Apache license. As far as mixing software covered by the Apache license with code covered by other licenses, the Apache license does not affect the license status of the other work. You just have to give proper credits etc. This is in stark difference with the GPL, of course.

Another option would be a BSD license. Those are compatible with all version of GPL. However also in that case, linking with GPLed code produces GPL code.

From Ray Plante

If you look at the attached document, 3rdparty.txt, you will see list of 3rd party packages we currently depend on along with the license it employs. (We have other products available, but I haven't added these yet.) A few use GPL v2.

I surmise the following, then:

  • Since some of the packages are GPL v2, we technically cannot go with Apache 2. If we ignored this issue and went with Apache 2, this would not be an enforcement issue. However, the Modified BSD would not have this problem.
  • We must specifically license the binary distributions under GPL.
  • We need to make sure our eups-based distribution system distributes copies of the licenses for the 3rd party packages.

CCB Notes and Discussion

This proposal was discussed on 3 Sept. and the GPL compatibility issue continues to nag at us. We identified four alternative proposals:

  1. Apache 2 + GPL

description

  1. Mod-BSD + GPL

description

  1. public domain + GPL

description

  1. GPL

description

Further Resources

  1. OSS Watch discussion of the Apache License 2.0
  2. Wikipedia Article on Apache License 2.0
  3. A listing of open source licenses from opensource.org
  4. GNU's evaluation of compatible OSS licenses
  5. The Modified BSD License

Attachments