search

oss-review-toolkit / ort

A suite of tools to automate software compliance checks.
https://oss-review-toolkit.org
Apache License 2.0
1.61k stars 313 forks source link

Please consider making example configuration files public domain #4298

Open LourensVeen opened 3 years ago

LourensVeen commented 3 years ago

Currently, files like https://github.com/oss-review-toolkit/ort/blob/master/examples/rules.kts carry an Apache license notice. If I copy this file into my repository and then customise it to my project and push it to GitHub, I'll have to update all my license notices as well to reflect that parts of my repository now have an additional copyright owner, and possibly that some files are licensed under a different license than everything else.

That's quite a big hassle, and since the configuration format seems to be undocumented currently, making a configuration file from scratch to get around it is also going to be difficult. If the examples were licensed under CC-0 or in some other way put in the public domain then this could all be avoided. Would you please consider doing so?

tsteenbe commented 3 years ago

@LourensVeen We planning to set up a separate ORT configuration repo soon that more turn-key then what currently under the ORT examples. Was thinking myself as well to use CC0-1.0 as well but which license we pick is something ORT technical steering committee will need to take a decision on.

Will add this topic to our next TSC agenda...

hyandell commented 3 years ago

MIT-0 is another item to consider. Short, sweet, no attribution.

LourensVeen commented 3 years ago

Interesting, I didn't know about MIT-0.

Having looked at it, I would still much prefer CC-0. CC-0 was written by lawyers who carefully considered the problem of legally contributing something to the public domain in jurisdictions around the world, and did their best to build a reliable solution. MIT-0 seems to be another one of those "I'm a developer and I don't understand all this legal text the experts wrote, so I'll just write my own legal text that I think I understand."

That's a common enough occurrence unfortunately, and it's pretty silly. If someone said "Linux is big and complicated and I don't understand all this stuff about page tables and interrupts and IO ports, so I wrote my own kernel which is much simpler." would you expect it to work correctly? Considering that its author by their own admission doesn't understand the context in which the code has to operate?

In my view, it's better engineering to just accept that you cannot be an expert on everything, apply the expertise you do have where it counts, and for the rest rely on high-quality components made by people who know what they're doing. To me, that's the lawyers over at Creative Commons and in this case the CC-0 declaration. I'm sure that there are lots of nuances I'm missing in how the legal text interacts with copyright laws around the world, but I trust them to have dealt with these much better than I ever could.

The only disadvantage I can see to using CC-0 would be that it doesn't license patents, only copyrights. The MIT license doesn't contain a clear patent grant either, so that doesn't help. Maybe a combination of CC-0 with the patent clause from the Apache License 2.0 would be a good solution for licensing examples? I'm not a lawyer though, so I'll end here before this gets into writing-your-own-kernel territory :-).

LourensVeen commented 3 years ago

And having just found the AWS version, to answer this:

The CC0 and various "do what you want" licenses and various public domain dedications may be less attractive to the initial developer for various reasons (i.e., a license is preferable to a public domain dedication).

I would argue that a license is less attractive than a public domain dedication from the perspective of the person receiving the sample code, because they would still have code in their repository that was owned by someone else and licensed to them, and it would still be an extra license to track, even if there's no requirement to list the license anywhere. In fact, the latter clause may only make it more difficult to keep track of who owns what.

On the other hand, you'll still need to know that you used the sample code under CC-0 if anyone ever sues you over it, so you need to keep track anyway. I guess the only way around that would be a public registry (e.g. run by the Library of Congress for the US) of works dedicated to the public domain, but to my knowledge we don't have one of those. It's actually a pretty annoying problem...