W3C appears to refer to the wrong license for OSI approval

[brianwarner]

Hi, I think I found a discrepancy in the W3C license references. There are three variants tracked in the license list: W3C, W3C-19980720, and W3C-20150513.

W3C is marked as OSI-approved, but the license text differs from OSI's static copy. The OSI static copy instead matches W3C-19980720, despite the fact that OSI's site references the SPDX identifier for the 2015 version.

Based upon OSI's page, it looks like they either approved the 1998 or 2015 version, which means W3C probably shouldn't be marked as OSI approved. Again, purely based upon the text, the OSI approved flag should likely go with W3C-19980720.

[brianwarner]

Update, looking at the OSI mailing lists, it appears they intended to approve the 2015 version. The OSI approved flag should probably move to W3C-20150513.

[jlovejoy]

Hello @brianwarner ! Thanks for looking into this. I'll give it a check as well - things over on the OSI site have changed here and there over the years and we reconciled a lot of the licenses with them a loonnnng time ago, so good to catch anything that we may have missed!

[swinslow]

Hi @brianwarner, thanks for flagging this and apologies for the slow response!

Digging into the history on this as well, it looks like there's a few things going on:

• 1998 version (what SPDX calls W3C-19980720): at least as of Feb. 2011, according to the Wayback Machine, the version that OSI called "W3C" at that time was the 1998 version.
• 2002 version (what SPDX calls W3C): I'm not finding any clear reference to this on the OSI site or mailing lists. Where I am finding this version is on the FSF's license site and GNU's comments about various licenses. So although this definitely pre-dates my involvement with SPDX, I'm guessing SPDX may have originally grabbed this version at or near the start of the License List?
• 2015 version (what SPDX calls W3C-20150513): As @brianwarner noted above, it looks like W3C asked to have OSI approve W3C's updated version of the license. And it appears OSI just replaced the 1998 version (which they called "W3C") with this one at https://opensource.org/license/W3C. OSI's site does correctly point to the SPDX 2015 identifier for this one.

So to fix all of this, here's where I think we're at:

• 1998 version (W3C-19980720): should be marked as OSI approved (because it was historically)
• 2002 version (W3C): should probably NOT be marked as OSI approved; would be helpful to understand where this version originated from on the SPDX list. (@jlovejoy, maybe you have a key to the history here?)
• 2015 version (W3C-20150513): should be marked as OSI approved

Additionally:

• We might consider deprecating the W3C identifier and replacing it with W3C-20021231. That would mean that W3C would remain valid for existing/prior uses; but it might help steer away from confusion for people using it inadvertently.
• It would probably be worth notifying the mailing list about some or all of the above, particularly the removal of the "is OSI approved" for the W3C identifier.
• It would be helpful to have someone from OSI weigh in about the above, since we're just guessing as to what may or may not have actually been approved previously. :)

[swinslow]

@jlovejoy Let's perhaps plan to discuss this one on the legal team call today.

In particular I'd like to get participants' thoughts on comfort level around removing the "is OSI approved" mark from the W3C identifier. I don't have concerns about adding it to the other two based on current information, but I'm hesitant to remove it from W3C without at least talking it through.

[swinslow]

Discussed on 2024-08-08 legal team call, agreed to the following:

• 2015 version (W3C-20150513): Steve to submit PR to mark 2015 version as OSI approved, since that clearly mirrors current OSI website status
• for the others, @jlovejoy to dig deeper including in SPDX historical records to better understand what decisions had been made / which things had been looked at previously