search

spdx / license-list-XML

This is the repository for the master files that comprise the SPDX License List
Other
344 stars 278 forks source link

New license request: ASL [SPDX-Online-Tools] #1730

Closed chenrui333 closed 1 year ago

chenrui333 commented 1 year ago

1. License Name: Amazon Software License 2. Short identifier: ASL 3. License Author or steward: AWS 4. Comments: This is the license used by many amazon devtools projects 5. License Request Url: http://tools.spdx.org/app/license_requests/188 6. URL(s): https://github.com/codeflows/kinesis-to-s3/blob/master/AMAZON_SOFTWARE_LICENSE.txt 7. OSI Status: Unknown 8. Example Projects: https://github.com/codeflows/kinesis-to-s3/ code search results: https://github.com/search?q=This+Amazon+Software+License+%28%22License%22%29+governs+your+use%2C+reproduction&ref=opensearch&type=code

chenrui333 commented 1 year ago

projects are using this license

richardfontana commented 1 year ago

I know SPDX doesn't condone this but "ASL" is in my experience still a pretty widely used non-SPDX/pre-SPDX misabbreviation for the Apache License 2.0 -- so I wonder whether the proposed short identifier could be confusing.

richardfontana commented 1 year ago

@chenrui333 for me those links get redirected to non-tool-specific pages. Do you have links to source repositories using this license?

jlovejoy commented 1 year ago

I had the same issue on the tools links as @richardfontana

@MarkAtwood - do you have anything to say about this one?

chenrui333 commented 1 year ago

projects are using this license

To my knowledge, I dont think these repos have publicly hosted source code available.

chenrui333 commented 1 year ago

This is the only one that I found under amzn org, https://github.com/amzn/sample-fire-tv-app-video-skill/blob/master/LICENSE.md

There are many others in this code search, https://github.com/search?q=This+Amazon+Software+License+%28%22License%22%29+governs+your+use%2C+reproduction&ref=opensearch&type=code

swinslow commented 1 year ago

Here's my take on how I think this one fares under the license inclusion principles. Other participants in the SPDX legal team, please weigh in as well.

New submission review

Definitive Factors

These must all be satisfied to allow inclusion in the license list

  1. Is the submitted license unique, that is, it does not match another license already on the License List as per the matching guidelines?
    • [X] Yes
    • [ ] No
  2. If a software license, does it apply to source code and not only to executables?
    • [ ] Yes
    • [ ] No
    • [X] => Unclear. By its terms, I don't see anything in here that would prevent the license from being used with executables. But the comments in this thread appear to indicate that it has only been used with executables so far.
  3. Does the license have identifiable and stable text, and is not in the midst of drafting?
    • [X] Yes => See https://aws.amazon.com/asl/ which states that this is the version since 2008. Note that the version on that page does not include the preamble from the submitted version: "This Amazon Software License (“License”) governs your use, reproduction, and distribution of the accompanying software as specified below."
    • [ ] No
  4. Has the license steward, if any, committed to versioning new versions and to not modify it after addition to the list?
    • [ ] Yes
    • [X] No => @MarkAtwood might weigh in here

Other factors for inclusion

Roughly in order of descending importance

  1. Does the license substantially comply with one of the free/open content definitions? (examples include the Open Source Definition and the Debian Free Software Guidelines) (Approval by the organisation that publishes the definition is not required)
    • [ ] Yes
    • [X] No => Section 3.3 prohibits use of the code other than to interact with Amazon / AWS services.
  2. Is the license structured to be generally usable by anyone, and not specific to one organisation or project?
    • [ ] Yes
    • [X] No => Same comment as above re: Section 3.3
  3. Does the license have substantial use such that it is likely to be encountered (ie. use in many projects, or in one significant project)? (For recently written licenses, definitive plans for it to be used in at least one or a few significant projects may satisfy this)
    • [X] Yes => The AWS tools listed here are probably widely enough used to count as substantial use
    • [ ] No
  4. Is the license primarily intended to facilitate the free distribution of content with limited restrictions?
    • [ ] Yes
    • [X] No => Same comment as above re: Section 3.3. Even though the content itself (the "Work") can be freely redistributed, I don't see how "may only use with Amazon / AWS" can be seen as "limited restrictions".
  5. Does the license steward support this submission, or is at least aware of and not in opposition of it?
    • [ ] Yes
    • [ ] No
    • [X] Unclear => @MarkAtwood might weigh in, or might not feel the need to, given the comments above.

Summary of factors, outcome, comments

I'm opposed to adding this one. Given the use restriction in 3.3 limiting this to use solely with Amazon / AWS, this isn't appropriate to add to the license list.

Amazon might choose to institute a standard LicenseRef for use with this license (in fact, I think that might have been one of the original use cases for the license namespace idea that @MarkAtwood had suggested) but that would not involve adding this to the SPDX License List.

swinslow commented 1 year ago

As an aside, I also agree in full with @richardfontana's comments above about not using "ASL" for a prefix here. Though given my review above, that might not be relevant if others agree that it shouldn't be added at all :)

MarkAtwood commented 1 year ago

I'm just catching up. This was not submitted by the license steward, which is me. This should not be merged. Amazon will use LicenseRef- syntax when tagging this license.

swinslow commented 1 year ago

Thank you @MarkAtwood!

Given your feedback (and the other comments in this thread), I'll close this one.

chenrui333 commented 1 year ago

I'm just catching up. This was not submitted by the license steward, which is me. This should not be merged. Amazon will use LicenseRef- syntax when tagging this license.

Hi @MarkAtwood, thanks for the comment in here. From the practice perspective, what does LicenseRef- syntax mean when applying the proper license attribution? Thanks!

MarkAtwood commented 1 year ago

Amazon uses the following text in source files using this license:

// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. // SPDX-License-Identifier: LicenseRef-.amazon.com.-AmznSL-1.0 // Licensed under the Amazon Software License http://aws.amazon.com/asl/