freedomofpress / securedrop

GitHub repository for the SecureDrop whistleblower platform. Do not submit tips here!
https://securedrop.org/
Other
3.62k stars 686 forks source link

Add license blurb to source files #2052

Closed redshiftzero closed 7 years ago

redshiftzero commented 7 years ago

We generally don't add license notices to the top of our source files, but this is a recommended practice. This would be very easy to do. The only thing that would be extremely annoying to maintain would be the list of authors for each file, so I propose we link to the GitHub contributors page, which shows each author and links to their commits.

ageis commented 7 years ago

Personal opinion only, but this idea makes me a little queasy. It seems like some classic stubborn Stallman didactic nonsense with no real grounding in pragmatism. It will increase the size of the repository and number of lines and make it take longer for people to clone. Also, you have to determine what counts as a source file and what doesn't (.py? .yml? .sh? tests?). There might be files that are strange outliers because of their expected format and won't accommodate the addition of a license... I like the single LICENSE file myself.

I've read the discussion on such posts as:

and it seems that there are possible legal reasons for this practice under GPLv3. I wonder if it would be worthwhile to consult and obtain a lawyer's interpretation here.

heartsucker commented 7 years ago

I agree with @ageis. I sort of hate this pattern, so I'd say SD shouldn't do it.

Also, from the AGPL:

How to Apply These Terms to Your New Programs ... To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found.

Those are "safest" and "should" which implies that it's not mandatory. It seems that best reasoning for this is to prevent accidental reuse under the wrong license. Since pretty much everything in SD is so application specific, (shell scrips, python files, configs, etc.) I think it's unlikely anyone could accidentally include anything in another app.

Also, I'd interpret this phrase:

To do so, attach the following notices to the program

to mean "attach the license to your program when distributed" which means 1) in the git repo and 2) in the Debian package.

ghost commented 7 years ago

There is nothing mandatory in having a copyright notice in each file indeed. Although I prefer that it is done consistently, I don't have strong feelings about it.

@ageis full disclosure: I happen to like RMS and respect his point of view. I'm not crossed because you wrote "classic stubborn Stallman didactic nonsense with no real grounding in pragmatism", don't worry ;-) I just wanted to clarify I have a different opinion on that matter.

ghost commented 7 years ago

@redshiftzero created this issue because I added a copyright notice in new files I created, which is something I consistently do whenever I hold copyright on a work to clearly state my name and the license under which I release it. I'm not forcing anyone to do the same nor do I suggest this becomes a general policy. This is a personal thing and I care about it.

redshiftzero commented 7 years ago

This was just a proposal for discussion and I don't feel strongly either way. Given that consensus was "don't care" or "this is bad", I'm closing. Thanks for input all!