Licence violation

[karenetheridge]

(copy of https://rt.cpan.org/Ticket/Display.html?id=154829)

Attention Alceu Rodrigues de Freitas Junior:

Your release Regexp-Common-v1.0.0 will not be indexed, first because you do not have PAUSE permissions for any modules in this distribution, but second because version 1.0.0 is less than the previously-released version, 2024080801.

And then, I see your new README.md says:

This project is a fork from Regexp::Common.
Looks like the original project is not being maintained anymore

The last release was on 2024-08-08, just four days ago. I'm not sure how that constitutes "not being maintained anymore"?

But there is a much more serious problem here: you have republished someone else's code and put your own name and copyright on it, while stripping the original licence file and switching to your own licence, which is incompatible with the original. You also removed all original authorship information in the metadata and documentation, and now declare yourself as the author of this work.

The COPYRIGHT.* files, which you deleted, set out very clearly the conditions under which you may repackage, modify and republish this work. Among other things, they include clauses that state that the original copyrights and licences must be retained.

I trust you will act immediately to rectify these grievous errors.

[glasswalk3r]

Your release Regexp-Common-v1.0.0 will not be indexed, first because you do not have PAUSE permissions for any modules in this distribution, but second because version 1.0.0 is less than the previously-released version, 2024080801.

True, but by mistake because I forgot to rename the directories and files. And actually, I received an automated notification about that seconds after the upload:

The following report has been written by the PAUSE namespace indexer. Please contact modules@perl.org if there are any open questions.

User: ARFREITAS (Alceu Rodrigues de Freitas Junior) Distribution file: Regexp-Common-v1.0.0.tar.gz Number of files: 122 *.pm files: 35 README: Regexp-Common-v1.0.0/README.md META-File: Regexp-Common-v1.0.0/META.yml META-Parser: Parse::CPAN::Meta 2.150010 META-driven index: no Timestamp of file: Mon Aug 12 22:18:24 2024 UTC Time of this run: Mon Aug 12 22:19:54 2024 UTC

This distribution name will only be indexed when uploaded by users with permission for the package Regexp::Common.

Also, let me clearly state that I am not looking for taking over the namespace. That's another reason for choosing a totally different versioning scheme. And I'll keep making changes that will probably be incompatible at some point.

The last release was on 2024-08-08, just four days ago. I'm not sure how that constitutes "not being maintained anymore"?

I tried to contact the author months ago by email and Linkedin, without any answer. I also tried contact from the CPAN Testers, and Neil Bowers came to my rescue:

Em 26/06/2024 06:56, Neil Bowers escreveu:

Hi Alceu,

I've heard back from Abigail, and at this time they don't want to give co-maint on Regexp-Common.

The module is depended on by hundreds of other CPAN distributions, so I wonder if Abigail is concerned about giving co-maint to an unknown person.

Sorry, Neil

Please, consider that I didn't ask to become a co-maintainer in any instance:

Hello Neil,

Thank you for checking that and returning back to me.

I don't know if it helps, but actually becoming a co-maintainer wasn't even my first option: when I created this PR, I noticed that there are older PRs over there and the oldest was created 10 years ago!

My first guess was that Abigail wasn't being able to carry on maintaining Regexp-Common and here we are.

My PR actually doesn't change a single line of code of the distribution, it is just a migration to Dist::Zilla and added metadata that is currently missing on Metacpan.

Anyway, I understand the concern.

Kind regards,

Alceu

Maybe the code is still being maintained, but looks like I'm not part of small group that is actually considered for any proposal and that is fine. I'm not asking for it either.

But there is a much more serious problem here: you have republished someone else's code and put your own name and copyright on it, while stripping the original licence file and switching to your own licence, which is incompatible with the original. You also removed all original authorship information in the metadata and documentation, and now declare yourself as the author of this work.

The COPYRIGHT.* files, which you deleted, set out very clearly the conditions under which you may repackage, modify and republish this work. Among other things, they include clauses that state that the original copyrights and licences must be retained.

Wrong and wrong.

Each of the files give credit to the original creators, as the MIT license requests. Besides, the MIT license is right here. I don't see any issue in copying all others, but basically they state the same.

If the GPL3 is incompatible or not, that's open to debate. I'm not a lawyer, but I'm keeping the code free and giving the proper credits. What I'm missing here?

I trust you will act immediately to rectify these grievous errors.

Grievous errors to whom? To the community? To the original authors?

Just unbelievable what the Perl community became: someone try to get a PR approved, it's clearly just ignored (not even a polite "we didn't like your proposal") and when I forked the project and publish a module into a different namespace, in less than 8 hours I got an issue named "license violation".

What is wrong with you guys?

[Grinnz]

But there is a much more serious problem here: you have republished someone else's code and put your own name and copyright on it, while stripping the original licence file and switching to your own licence, which is incompatible with the original. You also removed all original authorship information in the metadata and documentation, and now declare yourself as the author of this work. The COPYRIGHT.* files, which you deleted, set out very clearly the conditions under which you may repackage, modify and republish this work. Among other things, they include clauses that state that the original copyrights and licences must be retained.

Wrong and wrong.

Each of the files give credit to the original creators, as the MIT license requests. Besides, the MIT license is right here. I don't see any issue in copying all others, but basically they state the same.

If the GPL3 is incompatible or not, that's open to debate. I'm not a lawyer, but I'm keeping the code free and giving the proper credits. What I'm missing here?

Your versions of the modules label you as the author and copyright holder of the code in the documentation, which is incorrect (if the name was intended to be changed, the copyright statement would make more sense, but the author statement is still incorrect). Additionally, changing the license of code you do not own (without the permission of all parties) is prohibited. A license is not an exhaustive description of what you may or may not do, but only a mechanism to allow or disallow specific actions atop the default state of unlicensed code which allows no use, reuse or modification.

[Grinnz]

I am sympathetic that the nuances of open source licensing are confusing and difficult to navigate, the correct course to achieve what you tried to do would be to change the name of each module (as you intended), retain the original author, license, and copyright notices, and add yourself as author/copyright owner of the new names and code changes.

[glasswalk3r]

Your versions of the modules label you as the author and copyright holder of the code in the documentation, which is incorrect (if the name was intended to be changed, the copyright statement would make more sense, but the author statement is still incorrect). Additionally, changing the license of code you do not own (without the permission of all parties) is prohibited. A license is not an exhaustive description of what you may or may not do, but only a mechanism to allow or disallow specific actions atop the default state of unlicensed code which allows no use, reuse or modification.

Yes, the name was intended to be changed. What else I would choose a different name with in the dist.ini file?

Additionally, changing the license of code you do not own

Who owns the code, if the license clearly states the code can be modified as long the original authors names are kept?

[Grinnz]

Who owns the code, if the license clearly states the code can be modified as long the original authors names are kept?

The author of that code, unless specified otherwise.

[glasswalk3r]

I am sympathetic that the nuances of open source licensing are confusing and difficult to navigate, the correct course to achieve what you tried to do would be to change the name of each module (as you intended), retain the original author, license, and copyright notices, and add yourself as author/copyright owner of the new names and code changes.

Once more, I'm not looking for taking the Regexp::Common namespace.

[glasswalk3r]

Who owns the code, if the license clearly states the code can be modified as long the original authors names are kept?

The author of that code, unless specified otherwise.

So, let me if I got this straight:

1. The code is free for usage and change
2. I kept the requirements in place to do that.
3. But I need to ask for an author (that clearly ignores me) for an authorization?

I think you're out of your mind.

[Grinnz]

Who owns the code, if the license clearly states the code can be modified as long the original authors names are kept?

The author of that code, unless specified otherwise.

So, let me if I got this straight:

1. The code is free for usage and change
2. I kept the requirements in place to that.
3. But I need to ask for an author that clearly ignores for an authorization?

I think you're out of your mind.

Please feel free to seek other opinions, but this is how software licensing works. Permission to modify, reuse, and redistribute the code is not permission to call yourself the author or change its license.

The first google results I see on this topic are:

https://softwareengineering.stackexchange.com/a/55328 https://www.reddit.com/r/opensource/comments/10nh6mz/can_i_change_my_license/

[glasswalk3r]

Please feel free to seek other opinions, but this is how software licensing works. Permission to modify, reuse, and redistribute the code is not permission to call yourself the author or change its license.

The first google results I see on this topic are:

https://softwareengineering.stackexchange.com/a/55328 https://www.reddit.com/r/opensource/comments/10nh6mz/can_i_change_my_license/

And I need to take for granted your first search on Google about that?

You know what?

The Perl community clearly doesn't need any help.

I'm dropping this module, removing from both CPAN and here.

Of course, Microsoft will never let go of the repository by the way, feel free to complain with them about that.

[Grinnz]

I was merely demonstrating how easy it is to verify what I have stated, without hiring a lawyer. Do as you will.

[glasswalk3r]

[glasswalk3r]

Once PAUSE finishes the file deletion, I'll close this issue. All files from this repository were removed and history rewritten.