Inconsistent licensing

[alyssais]

Cargo.toml says "Apache-2.0 OR BSD-3-Clause", but many files contain lines like the following, which suggests that only the Apache-2.0 license applies:

// SPDX-License-Identifier: Apache-2.0

It's therefore unclear whether using this code under the terms of only the BSD-3-Clause license is permitted. If the intention is to use the BSD-3-Clause for code originally taken from crosvm, but the Apache-2.0 license for new code (like Cloud Hypervisor does), then Cargo.toml should say "Apache-2.0 AND BSD-3-Clause".

[alyssais]

I've also noticed lines like this:

// Portions Copyright 2017 The Chromium OS Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE-BSD-Google file.

But the LICENSE-BSD-Google file was removed in 85ab9e3c4ead956621a0da71b15fcd59ad0e4b41 with a note saying "The vhost crate is written from scratch, so it should be licensed to Alibaba Cloud instead of Google." So is there code in this crate covered by that license or not? If there is, shouldn't that license file still be present?

[Ablu]

@jiangliu: Can you clarify this? Those are all files claimed by Alibaba Cloud Computing:

❯ rg --before-context=1 'SPDX-License-Identifier: Apache-2.0$' -g '!rust-vmm-ci' -g '!crates/vhost-user-backend'
crates/vhost/src/vhost_user/message.rs
1-// Copyright (C) 2019 Alibaba Cloud Computing. All rights reserved.
2:// SPDX-License-Identifier: Apache-2.0

crates/vhost/src/vhost_user/mod.rs
1-// Copyright (C) 2019 Alibaba Cloud Computing. All rights reserved.
2:// SPDX-License-Identifier: Apache-2.0

crates/vhost/src/vhost_user/frontend_req_handler.rs
1-// Copyright (C) 2019-2021 Alibaba Cloud. All rights reserved.
2:// SPDX-License-Identifier: Apache-2.0

crates/vhost/src/vhost_user/dummy_backend.rs
1-// Copyright (C) 2019 Alibaba Cloud Computing. All rights reserved.
2:// SPDX-License-Identifier: Apache-2.0

crates/vhost/src/vhost_user/backend_req_handler.rs
1-// Copyright (C) 2019 Alibaba Cloud Computing. All rights reserved.
2:// SPDX-License-Identifier: Apache-2.0

crates/vhost/src/vhost_user/backend_req.rs
1-// Copyright (C) 2020 Alibaba Cloud. All rights reserved.
2:// SPDX-License-Identifier: Apache-2.0

crates/vhost/src/vhost_user/backend.rs
1-// Copyright (C) 2019 Alibaba Cloud Computing. All rights reserved.
2:// SPDX-License-Identifier: Apache-2.0

crates/vhost/src/vhost_user/frontend.rs
1-// Copyright (C) 2019 Alibaba Cloud Computing. All rights reserved.
2:// SPDX-License-Identifier: Apache-2.0

crates/vhost/src/vhost_user/connection.rs
1-// Copyright (C) 2019 Alibaba Cloud Computing. All rights reserved.
2:// SPDX-License-Identifier: Apache-2.0

vhost-user-backend already is Apache-2.0 only. Should vhost be the same?

[Ablu]

Related: https://github.com/rust-vmm/vm-virtio/issues/283

[jiangliu]

Historically there are some code derived from crosvm project, so it should be "Apache-2.0 AND BSD-3-Clause". I remembered there was an agreement to license code from project crosvm as "Apache 2.0". If it's true, I would prefer "Apache-2.0" instead of "Apache-2.0 AND BSD-3-Clause".

[Ablu]

I remembered there was an agreement to license code from project crosvm as "Apache 2.0". If it's true, I would prefer "Apache-2.0" instead of "Apache-2.0 AND BSD-3-Clause".

Thanks for the clarification!

Is there some documentation around this agreement available?

[jiangliu]

The community has discussed about it in community meetings, but not sure whether it's documented.

[Ablu]

@andreeaflorescu: Do you happen to recall details? :thinking: Would be great if we could reference some archival of the agreement.

[andreeaflorescu]

Our initial intention was to go for Apache 2.0 OR BSD-3-Clause, but since the code in Crosvm is licensed under BSD-3-Clause, that is not really possible. See the discussion here: https://github.com/rust-vmm/vmm-sys-util/issues/161. We ended up with using BSD-3-Clause for the crates that have code coming from Crosvm as well.

[Ablu]

Ah, I thought there was some agreement to change a license. But it just seems to be the dropping of BSD. Then we can just advertise Apache-2.0 for the whole crate.

[andreeaflorescu]

Ah, I thought there was some agreement to change a license. But it just seems to be the dropping of BSD. Then we can just advertise Apache-2.0 for the whole crate.

It's the opposite. Since you have code from Crosvm, you can't have it as Apache-2.0. So it has to be BSD-3-Clause.

[Ablu]

It's the opposite. Since you have code from Crosvm, you can't have it as Apache-2.0. So it has to be BSD-3-Clause.

Ah. I understood @jiangliu's comment as the code being under 'Apache-2.0'. I guess we need to double check our SPDX tags then...