Hi Richard, On Wed, 2024-01-17 at 21:22 -0500, Richard Fontana wrote: > On Wed, Jan 17, 2024 at 6:57 PM Mark Wielaard <mark@xxxxxxxxx> wrote: > > On Fri, Nov 24, 2023 at 08:07:02PM +0100, Mark Wielaard wrote: > > > On Mon, 2023-09-18 at 20:47 -0400, Richard Fontana wrote: > > > > On Sun, Sep 17, 2023 at 11:37 AM Mark Wielaard <mark@xxxxxxxxx> wrote: > > > > > Likewise for valgrind we have examples of the above. For example the > > > > > dhat tool which have a GPLv2+ copyright and license header, but also > > > > > say: > > > > > > > > > > /* > > > > > Parts of this file are derived from Firefox, copyright Mozilla Foundation, > > > > > and may be redistributed under the terms of the Mozilla Public License > > > > > Version 2.0, as well as under the license of this project. A copy of the > > > > > Mozilla Public License Version 2.0 is available at at > > > > > https://www.mozilla.org/en-US/MPL/2.0/. > > > > > */ > > > > > > > > > > Again, although there is a reference to MPLv2 here, the code is only > > > > > available under GPLv2+. > > > > > > > > But that notice literally says there is code available under MPL 2.0. > > > > > > > > If the notice is incorrect, that is a bug that should be fixed > > > > upstream. But a mere conflict with a project's conception of what its > > > > effective license is would not mean that the license notice is > > > > incorrect. > > > > > > In the case of relicensing MPLv2 to GPLv2+ you could indeed argue that > > > no notice at all should remain in the source file to the MPLv2. The > > > MPLv2 does indeed require you remove all MPL notices when converting a > > > source file to the GPL. But again I consider it rude to not even > > > mention the origin of the source code and provide a (historical) > > > reference. > > > > So in the above case, what would be your advice? Should upstream > > change that notice that tells the user the original code (over there) > > is also available under the MPL, but that this derived version is only > > distributed under the GPL? Or should they just completely remove the > > reference to the original MPL code? > > What MPL-2.0 actually says on this (if I'm understanding the situation > correctly) is: > > "You may create and distribute a Larger Work under terms of Your > choice, provided that You also comply with the requirements of this > License for the Covered Software. If the Larger Work is a combination > of Covered Software with a work governed by one or more Secondary > Licenses, and the Covered Software is not Incompatible With Secondary > Licenses, this License permits You to additionally distribute such > Covered Software under the terms of such Secondary License(s), so that > the recipient of the Larger Work may, at their option, further > distribute the Covered Software under the terms of either this License > or such Secondary License(s)." > > If dhat is the 'Larger Work' here (caveat, I haven't actually looked > at dhat and I don't know what it actually copies from Firefox source > code), what MPL seems to be saying is that the original creator of > dhat has to provide the choice of licenses to their recipients. I seem > to remember telling Luis Villa that I found this a little puzzling > when I first looked at it but that was many years ago now. Right, the MPL-2.0 "combining" FAQ also says you have to do this double step dance. First publish as a dual license subject to the terms of the MPL 2.0 and then further distribute it just under the secondary license. Which is what seems to have happened in the valgrind git repository. It is a little puzzling because the creator and the recipient could simply be the same person (but technically in the valgrind git repo the commits were made by different people). > > I assume the License tag in the above case would simply be > > GPL-2.0-or-later without any mention of the MPL? > > Given the wording of that notice, plus the underlying compliance issue > noted above, I think the License tag should include `(GPL-2.0-or-later > OR MPL-2.0)`. I still don't understand why we should add the OR MPL-2.0 part. Since the files as a whole are now publish under GPL-2.0-or-later (no longer dual licensed). There is just the notice that parts of the code were derived from code available under both the MPL-2.0 and the project license (GPLv2). Which seems ok to preserve the historical record. But adding OR MPL-2.0 to the license tag seems false advertisement, the (now modified) code as (re)distributed is only available under the GPL- 2.0-or-later (since we aren't redistributing the whole valgrind git history). Cheers, Mark -- _______________________________________________ legal mailing list -- legal@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to legal-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/legal@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
