search

spdx / license-list-XML

This is the repository for the master files that comprise the SPDX License List
Other
343 stars 279 forks source link

Deprecation notice for AGPL-1.0 doesn't make any sense #1922

Closed richardfontana closed 1 year ago

richardfontana commented 1 year ago

The line https://github.com/spdx/license-list-XML/blob/main/src/AGPL-1.0.xml#L13 states: <notes><p>DEPRECATED: Use the license identifier AGPL-1.0-only instead of APL-1.0, and use AGPL-1.0-or-later instead of AGPL-1.0.</p></notes>

The APL-1.0 is presumably a typo (APL-1.0 is the unrelated Adaptive Public License). But if it's a typo for AGPL-1.0, the corrected statement DEPRECATED: Use the license identifier AGPL-1.0-only instead of AGPL-1.0, and use AGPL-1.0-or-later instead of AGPL-1.0. still seems to not make any sense, because it is not specifying whether to use AGPL-1.0-only or AGPL-1.0-or-later instead of AGPL-1.0.

I am not sure what was actually intended here. But I notice that there is no counterpart deprecation note for GPL-2.0 and GPL-3.0. Why should AGPL-1.0 need such a deprecation note if there isn't one for the closest textual counterpart (GPL-2.0)?

Furthermore, though perhaps this is a separate or larger issue, to the extent this was an outgrowth of some earlier effort to treat AGPL-1.0 similarly to the legacy GPL-family identifiers, AGPL-1.0 was not an FSF-stewarded license. The commit message that introduced this DEPRECATED note says:

`On Thu, Dec 28, 2017 at 09:56:54AM -0800, Jilayne Lovejoy wrote [1]:

I am conferring with the FSF as to AGPL-1.0 - I will make the appropriate changes as needed when I get feedback there. No further discussion needed at this point.

On Thu, Jan 11, 2018 at 09:56:18PM +0000, Jilayne Lovejoy wrote [2]:

... I have confirmed that we should treat AGPL-1.0 that same) as we suspected. `

Why would the opinion of the FSF have mattered at all here, given that AGPL-1.0 was not an FSF license?

jlovejoy commented 1 year ago

looking at the Notes for AGPL v. GPL-* - we put a general note about updates for SPDX License List v3.0 on the main page, stating, "Release 3.0 replaced previous Identifiers for GNU licenses with more explicit Identifiers to reflect the "this version only" or "any later version" option specific to those licenses. As such, the previously used Identifiers for those licenses are deprecated as of v3.0." - so I think that is why the individual licenses don't have notes. Since AGPL was updated for 3.1 it got a note. Not saying this is necessarily a good explanation, but I think that is why it's different.

That being said, if it's helpful to add a note on the GPLs, that's not much work to do so.

richardfontana commented 1 year ago

I guess though as to the "larger issue", it seems SPDX has an undocumented (?) rule to defer to license stewards to some degree in all matters pertaining to the design, naming and interpretation of license identifiers, where an identified license steward exists. In the case of AGPL-1.0, the license steward is the defunct Affero, Inc., which was headed by Henry Poole (now CEO of CivicActions). The FSF is not the license steward of AGPL-1.0 so why should the FSF's opinion matter in that case? It is true as a background factual matter that AGPL version 1 was drafted in consultation with people at the FSF including FSF's then general counsel, but I don't see how that fits into what I'm saying is the undocumented rule of "defer to the license steward" which seems to be the whole underlying reason for SPDX's deprecation of the older set of GPL-family identifiers.

jlovejoy commented 1 year ago

I"m not really sure how this is a "larger issue" and as for what or how we even got feedback from the FSF on this question specifically, I don't really remember and not sure it's worth the time to dig back... :)

jlovejoy commented 1 year ago

once #1923 is merged, let's close this. adding more comments in other deprecated license doesn't seem critical at this point, so much as correcting a note that was kind of wrong/confusing