GPL version and license notices needs improvement about open-source-logiciel-libre

[ian-kelling]

Unfortunately the GC cannot commit to future licenses, and should a situation arise where > GPL4.0 produces text that explicitly prevents the GC from using the license, we would have > to rescind the text.

I work at the Free Software Foundation, which wrote and maintains the GPL license. So please read what I have to say. As far as I can tell, did not read the link at the start of my issue, which was the most important part of the issue https://www.gnu.org/licenses/identify-licenses-clearly.html. Please go to that link, and read it. If you had read that, you would know that GPL 3.0 is actually one of 2 licenses when applied to software: "GPL 3.0 or later", or "GPL 3.0 only". If you don't state which one, the actual license you are using is ambiguous, and will cause problems. In the file publishing-open-source-code.md, that is the mistake you've made. If you take nothing else from this issue, please read https://www.gnu.org/licenses/identify-licenses-clearly.html !

Also, the license "GPL 3.0 or later" does not mean you are recommending using GPLv4 before its been written. The name of the license IS "GPL 3.0 or later", and that license will only ever include the GPLv3 text. The "or later" is a matter of license compatibility, allowing for whoever you distribute that software to, to then redistribute it under a later version of the GPL. You already endorse using the Apache license, and the MIT license, which both already grant that permission! So, your objection seems to be out of a misunderstanding. To learn about license compatibility please read https://www.gnu.org/licenses/license-compatibility.en.html

[gcharest]

Thanks! We'll see how we can align with your recommendation!

[ShadeWyrm]

Unfortunately the GC cannot commit to future licenses, and should a situation arise where GPL4.0 produces text that explicitly prevents the GC from using the license, we would have to rescind the text.

[ian-kelling]

Also, as my last comment implies, please reopen this issue.

[ShadeWyrm]

The issue of explicit language occurs.

While you are correct, individuals reading the text "GPL 3.0 or later" can take it to view that the GC has explicitly endorsed all future GNU licenses, which we simply cannot do.

On the other hand if we apply "GPL 3.0 Only" we remove the ability to upgrade the license.

The ambiguity is an unfortunate but pseudo intended side effect.

Happy to continue to discuss, but hopefully this clarifies my reasoning a little bit?

[smellems]

I understand GC cannot accept future licences, but it's not really the case. Code would still be licensed under GPL3 and we could relicence it to GPL4, or not. We decide, but we also leave it open for others to fork and relicence..

Seems like it would be ok to recommend the GPL3 licences "or later", so that it's clear and not left to individual projects to figure it out if they decide to use a reciprocal licence.

The ORE, uses the SPDX License identifiers: the only choices for GPL licences are -only or -or-later.

@ian-kelling how do you make the distinction for projects? Is the default GPL3 text the or-later version? I'm guessing it there was a notice in the readme it would be good:

Unless otherwise noted, the source code of this project is covered under Crown Copyright, Government of Canada, and is distributed under the General Public License (GPL) 3.0 or later.

[smellems]

Looking at GC projects that use GPL

https://github.com/nrc-cnrc/EGSnrc - AGPL3 - notice in readme does not specify version, only AGPL

https://framagit.org/metroprojects/metro - GPL2 - again notice only mentions GPL

This is a good way to do it, since the licence text says

If the Program does not specify a version number of the GNU GPL, you may choose any version ever published by the Free Software Foundation

But I guess you can only go forward..

[smellems]

Started a PR to work on the issue. I understand we need to be clear that we are recommending version 3 and not later versions. But also that the code should be licenced with the GPL3-or-later licences and not the GPL3-only licences.

[ian-kelling]

@smellems the FSF's official recommendation is to distinguish "or later" vs "only" is by using the license header, as described in the section "How to Apply These Terms to Your New Programs" in the license itself, https://www.gnu.org/licenses/gpl-3.0.en.html. Beyond that, note I'm not able to speak on behalf of FSF because I'm a licensing nerd, but my title is sysadmin, and if you email [email protected], they will happily answer for free. However my understanding is that SPDX identifiers at the top of files are equivalent to directions in the license. Also, license headers are hard to remember, so its pretty well established that instead or in addition, many languages or package repositories like npm specify a manifest file that has a license field, generally taking an spdx identifier. And the next best is if the software does not have a manifest file like that for whatever reason, the readme file is a good place and an spdx identifier which specifies "or-later" vs "only" is the best way to identify the license.

[ShadeWyrm]

@ian-kelling / @smellems - how is this?

"'GPL 3.0 or later', 'LGPL 3.0 or later' and 'AGPL 3.0 or later' refer to specific licenses, not a commitment to future licenses."