fix: use proper SPDX headers to clarify LGPL3 vs JSA licensing #1321
Conversation
for more information, see https://pre-commit.ci
github-actions
bot
added
topic: calorimetry
|
@c-dilks I'm going through and clarifying the licensing of EICrecon source in some cases. Many cases of code added by you (before you were an employee of Jefferson Lab) was made with the default language about top level LICENSE file, which didn't exist and could have been assumed to refer to the JSA public domain language in the NOTICE.md file. Since you retain the copyright, would you be willing to license this code under the LGPL? |
Capybara summary for PR 1321 |
| // | ||
| // | ||
| // SPDX-License-Identifier: JSA | ||
| // Copyright (C) 2022 David Lawrence |
There was a problem hiding this comment.
Almost none of these attributions in src/detectors are correct. You, @wdconinc , are the primary author after all the conversions. The original configuration variables were derived from the LGPL3 code. Single item from API like void InitPlugin(JApplication *app) { is not subject to copyright.
There was a problem hiding this comment.
You may be right about this. I was going to keep the first batch of commits limited to making a literal translation from the various headers we have to the recommended spdx headers. We can handle the changes in licensing through code review (for some files where I am the sole copyright holder, I have changed this from JSA license to LGPL3).
There was a problem hiding this comment.
This is not the correct translation then. Assigning everyone's code copyright to JSA without asking is a regression compared to status quo.
There was a problem hiding this comment.
I'm asking and will be asking others (see #1321 (comment)).
When these contributions were made, even by people who may be perfectly fine with LGPL3, the licensing language in the repository was (at best) ambiguous, and definitely not as unambiguously LGPL3 as it is now. Until Jan 15, 2024, #1237, only the NOTICE.md was include at top-level, and it indicated that contributions were under the JSA public domain clause, unless otherwise indicated (such as for src/algorithms, since #185, or for files with explicit LGPL-3.0-or-later SPDX header, such as most of src/factories). Any other code from before Jan 15 should be assumed to have been contributed under the conditions of the NOTICE.md file, and we should secure permissions from the copyright holders to license it under LGPL3. I think in that sense the only approach is to assume the contributions were made in line with the JSA notice, and ask all copyright holders to license them as LGPL3.
Some clear cases that can be resolved right away, however (and this isn't exhaustive):
- under src/algorithms, src/factories: this is all LGPL-3.0-or-later (possibly there are others), and it should be labeled like that,
- some code has been mistakenly labeled as JSA in the SPDX header (e.g. src/algorithms/tracking/TrackParamTruthInit.cc which came from LGPL-3.0-or-later juggler), and this should be fixed,
- some code has mistakenly not been labeled as LGPL-3.0-or-later (i.e. missing SPDX header), and this should be fixed.
I don't think there will be many issues getting people to agree to license their changes to LGPL3, though we may get one or two holdouts.
There was a problem hiding this comment.
It wasn't my intention to go into that detail. All I'm saying:
- Original files in src/detectors are a derivative work from other codes (like https://eicweb.phy.anl.gov/EIC/benchmarks/reconstruction_benchmarks/-/blob/master/benchmarks/clustering/options/full_cal_reco.py?ref_type=heads for BEMC.cc ) and can't claim copyright.
- The current files were entirely rewritten by you.
These are the reasons why I think signing off copyright on those files is too generous in the first place.
github-actions
bot
added
topic: tracking
I'm fine with LGPLv3. All of my contributions in any EIC organization-owned repository were before my employment at Jefferson Lab, except for small bug fixes. Luigi and Alexander may not want their contributions under JSA, since I think we've been assuming we are under LGPLv3 and they are not Jefferson Lab employees. |
Briefly, what does this PR introduce?
This modifies the headers to be clear about which license applies. All unclear licensing is deferred to JSA especially when it was still referring to the "top-level LICENSE file" which at the time was JSA.
What kind of change does this PR introduce?
Please check if this PR fulfills the following:
Does this PR introduce breaking changes? What changes might users need to make to their code?
No.
Does this PR change default behavior?
No.