[Task]: Update Licenses available for add-on developers to choose from on AMO

diox commented 6 days ago

Description

Following https://github.com/mozilla/addons/issues/14976 and after discussions with Legal and Product, we have settled on doing the following:

Update all Licenses names, slugs and urls to follow SPDX. Notably, add the "only" suffix were relevant.
Add Apache License 2.0, ISC License, GNU Affero General Public License v3.0 only, The Unlicense
Update API documentation to reflect those changes

Final License order in devhub should be:

Mozilla Public License 2.0 Details
Apache License 2.0 Details
GNU General Public License v2.0 only Details
GNU General Public License v3.0 only Details
GNU Lesser General Public License v2.1 only Details
GNU Lesser General Public License v3.0 only Details
GNU Affero General Public License v3.0 only Details
MIT License Details
ISC License Details
BSD 2-Clause "Simplified" License Details
The Unlicense Details
All Rights Reserved
Other

Acceptance Criteria

  ### Milestones/checkpoints
  - [ ] All Licenses names, slugs and URLs should follow [SPDX](https://spdx.org/licenses/) definition
  - [ ] New Licenses are added, with specific order in devhub
  - [ ] API docs are updated

Checks

[X] If I have identified that the work is specific to a repository, I have removed "repository:addons-server" or "repository:addons-frontend"

┆Issue is synchronized with this Jira Task

leoheitmannruiz commented 4 days ago

This is awesome! Thank you.

A few questions and remarks, the most important one first:

How are licenses not on this list going to be dealt with?

GPL-3.0-or-later, for instance. Continuing to intend for people to choose "Other" and enter the name of the license seems like a bad idea. Won't this continue to allow for cases similar to the Apache-2.0 fiasco? Your plans are great improvements, but really, I feel like this is a lot more important.
I'm very interested in why you decided against a way to to choose any license from SPDX.

Was the complexity of the change this would require a major reason not to do so?
Can you please elaborate on why you decided to list (only) the "only" variants of the GPL family of licenses, instead of (also) the "or-later" variants?

I feel like your proposed license list will lead to a lot of "or-later" licensed add-ons being published as "only". It seems to me that even people applying the GPL family of licenses to their source code are often not aware of this annoying complexity. I am quite convinced that the right approach is to list both variants, so as to educate people.
Have you talked about whether or not the names of licenses should be translatable?

abyrne-moz commented 1 day ago

Thanks for your follow-up!

The most popular licences were selected in collaboration with our open source licensing legal consultants. As mentioned in the previous issues, adding dozens of licence options to AMO would be unwieldy and overwhelm submitters with a multitude of unnecessary options. The Other option exists to provide a choice for any licence to be used, and for those users it is up to the submitter of the add-on to add the text for the licence.

The specific version of the licence was chosen, rather than the or later, to prevent ambiguity and ensure a specific licence is chosen.

Given that the names of the licences are proper nouns, they have not been translated at this time.

leoheitmannruiz commented 1 day ago

I'm afraid I'm lacking the skill to be able to persuade you :(

It's just a little sad to me.. I feel like you're doing something really great by allowing developers to choose a license for their source code and then you're dropping the ball right in front of the goal, by not allowing for a standardized way to choose the GPL-3.0-or-later (surely, one of the most popular licenses on AMO) and fueling the confusion of "-only" and "-or-later". And, not allowing for a standardized way of selecting all but a few very popular licenses. I'm thinking of researchers in five years, looking at how use of the BlueOak-1.0.0 evolved. But also, I'm thinking of properness and pedanticness. I don't want to see some add-ons saying "GPL 3 later", others "GPL v3 and up" and another "GPL-3-or-later", when all of them could say GPL-3.0-or-later (or the license name SPDX associates with that identifier, of course).

So, that's how I'm feeling about this, hehe.

But it seems to me that you're not keen on discussing this much longer, so I'll leave you be :)

Again, thanks for what you've already done (or are planning to do). I think they are great improvements! And, generally, thanks for taking the time!

All the best!

Given that the names of the licences are proper nouns, they have not been translated at this time.

Sorry, I should have provided more information. I assumed Mathieu Pillard was going to answer :)

Please read these two comments for the context in which I asked the question.

diox commented 1 day ago

We'll be dropping translations for all licenses as part of implementing this issue.

leoheitmannruiz commented 1 day ago

Ok!

mozilla / addons