[Clarification] License on data components of this repository?

[sirocyl]

Hey, I'm interested in applying the raw data (CSV, JSON) for the list of issuers here in an application to be used on a network-free kiosk on the registration floor of a near-future event.

However, the application, which we're working on publishing as open-source, is under the MIT license, which is incompatible with - and therefore forbids - transcluding code from GPLv2/v3-licensed projects.

I'd like to ask if the raw data - in the three files registry.json, registry-normalized.json and registry-normalized.csv - can be provided or used under more permissive license terms, or if there is a source issuer list/trust registry that these are based on, which is not GPL-encumbered that you use, which we can connect with instead.

If the specified registry data can be used under a license independent of the code, I would recommend clarifying this in the LICENSE file and README.md, in the repository.

[vitorpamplona]

Hey Tyler,

The 3 files you mentioned are the core of this project. We are keeping it as GPLv3 for now because there is a lot of responsibility built-in in guaranteeing the trust of these keys. We not only run background checks in each one of these entities to make sure they are what they say they are, but we also keep track of any vulnerabilities on the QR codes they release daily. What you see is just the end product of a lot of manual work. That work is being financed by commercial licenses to the data. I am happy to discuss the details of a commercial license when your application gets ready for that discussion.

Best,

[sirocyl]

That's all good! Just wanted to ask and make sure, because respecting licenses is a good thing.

To make sure that we're handling this well enough, is it okay that we'll ensure that the use of this code remains in a separate module, synchronized verbatim with this repo, and interface with it externally (i.e., not linking or transcluding code from this)?

[vitorpamplona]

I appreciate you for respecting the license. Though I am not sure if it works. Since the trust registry is such an essential part of your application, to the point that it would not work without it, one could make a case that it is a hard dependency or a derivative work (even if you don't directly link it).

But another solution is to dual-license your app. I believe you can do an MIT License AND a GPLv3 license and call it a day.

[sirocyl]

I'm reasonably sure we can offer that with our application, in fact. I'll check with my other collaborator and see how that works out. Thank you!