| Subject: | License Inconsitencies |
I was gearing up to do a more-comprehensive analysis[1], but half way through I realised I'd made a mistake and had to start-over for some of it
The most clear thing I can say is the top level license in metadata ( which is often as far as people look, and is the most visible license data on metacpan ), is inadequate for how the code currently is.
Secondly, there's a lot of conflation between the "perl license" and various other licenses that *look* to be "the perl license", but are not.
The "perl license" implies "Artistic 1 OR GPL1-OR-NEWER", and any declarations saying "Artistic or GPL" give a different license condition, as does any declaration that says "Artistic or GPL-2".
Many of the embedded files are BSD-licensed, LGPL-2.1+ licensed, GPL2+-only licensed,
./README-215-Foundation, Inc. They are neither required to create the binary nor
./README-216-linked to the source code of this module in any other way.
^ this may be fine for some, but anyone who distributes this code whole-sale is still bound by the license terms of the test files in order to distribute them.
And anyone who *runs* tests involving those test files, must do so while complying with their license.
And it is really no small feat to understand all the licenses in this dist, and anyone who takes the entries in META>* for granted are kidding themselves.
And in attempting to create a single SPDX-like string that comprehensively encompassed all the files in the dist, I just got a headache.
Full output of my "grep for licensy things" here: https://gist.github.com/kentfredric/6b699ed648b934ee39e150b978993691
1: https://gist.github.com/kentfredric/0512bd8c0099d0e6dc8b264b614afd8a
--
- CPAN kentnl@cpan.org
- Gentoo Perl Maintainer kentnl@gentoo.org ( perl@gentoo.org )
The most clear thing I can say is the top level license in metadata ( which is often as far as people look, and is the most visible license data on metacpan ), is inadequate for how the code currently is.
Secondly, there's a lot of conflation between the "perl license" and various other licenses that *look* to be "the perl license", but are not.
The "perl license" implies "Artistic 1 OR GPL1-OR-NEWER", and any declarations saying "Artistic or GPL" give a different license condition, as does any declaration that says "Artistic or GPL-2".
Many of the embedded files are BSD-licensed, LGPL-2.1+ licensed, GPL2+-only licensed,
./README-215-Foundation, Inc. They are neither required to create the binary nor
./README-216-linked to the source code of this module in any other way.
^ this may be fine for some, but anyone who distributes this code whole-sale is still bound by the license terms of the test files in order to distribute them.
And anyone who *runs* tests involving those test files, must do so while complying with their license.
And it is really no small feat to understand all the licenses in this dist, and anyone who takes the entries in META>* for granted are kidding themselves.
And in attempting to create a single SPDX-like string that comprehensively encompassed all the files in the dist, I just got a headache.
Full output of my "grep for licensy things" here: https://gist.github.com/kentfredric/6b699ed648b934ee39e150b978993691
1: https://gist.github.com/kentfredric/0512bd8c0099d0e6dc8b264b614afd8a
--
- CPAN kentnl@cpan.org
- Gentoo Perl Maintainer kentnl@gentoo.org ( perl@gentoo.org )