I forgot to mention that the center of my question was about the second stage of the license - once it reaches the condition to transform to a free license, whether it is absolutely fine to add the software to Fedora under that specific free license, or whether there is any specific point of view the Fedora Legal team holds, or other specific requirements how to list the license correctly.

On the other hand, Fedora package maintainers shouldn't try to guess the resulting license(s) that applies to the user, they should only list the licenses of the contents of the binary rpm. In this case, assuming that the license already transformed to the free one might be the guessing package maintainer shouldn't do.

And as Daniel showed,

On Wed, Jul 17, 2024 at 1:45 PM Daniel P. Berrangé berrange@redhat.com wrote:

BUSL-1.1 is already listed as 'not-allowed' in Fedora:

https://docs.fedoraproject.org/en-US/legal/not-allowed-licenses/ https://gitlab.com/fedora/legal/fedora-license-data/-/blob/main/data/BUSL-1....

For the time window that the code is under BUSL-1.1, it is non-free.

When the timeout in BUSL-1.1 triggers, the BUSL-1.1 ceases to apply to the code. The code becomes covered by GPL-2.0. IIUC, after that point in time, it would be allowed in Fedora but being listed as GPL-2.0-or-later in the spec, rather than BUSL-1.1.

the software clearly can't be added to Fedora before the transformation, yet it's still unclear to me if, and how, it would be possible after the transformation.

Michal

--

Michal Schorm Software Engineer Core Services - Databases Team Red Hat

--

On Wed, Jul 17, 2024 at 1:45 PM Daniel P. Berrangé berrange@redhat.com wrote:

On Wed, Jul 17, 2024 at 01:33:01PM +0200, Michal Schorm wrote:

...

Hello,

I'd like a review of 'MariaDB Business Source License (BSL)'. Here is a specific instance of the license: https://github.com/mariadb-corporation/MaxScale/blob/24.02/licenses/LICENSE2... Here is FAQ about it: https://mariadb.com/bsl-faq-mariadb/

TL;DR: the license says it's non-free, but it becomes free (GPL in this case) after a specific time.

--

BUSL-1.1 is already listed as 'not-allowed' in Fedora:

https://docs.fedoraproject.org/en-US/legal/not-allowed-licenses/ https://gitlab.com/fedora/legal/fedora-license-data/-/blob/main/data/BUSL-1....

For the time window that the code is under BUSL-1.1, it is non-free.

When the timeout in BUSL-1.1 triggers, the BUSL-1.1 ceases to apply to the code. The code becomes covered by GPL-2.0. IIUC, after that point in time, it would be allowed in Fedora but being listed as GPL-2.0-or-later in the spec, rather than BUSL-1.1.

IOW, it would all depend on the date listed in the license for the specific version you want to add to Fedora.

...

Apart from this specific case, I'd like to hear your guidance in similar cases in general - whether they are mostly accepted or rather avoided (by Fedora), as more licenses with this idea exists, e.g.: https://github.com/getsentry/sentry/blob/master/LICENSE.md

I'd assume the precedent set by denying BUSL is followed for licenses with similar conceptual rules.

With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

On Wed, Jul 17, 2024 at 7:33 AM Michal Schorm mschorm@redhat.com wrote:

Hello,

I'd like a review of 'MariaDB Business Source License (BSL)'. Here is a specific instance of the license: https://github.com/mariadb-corporation/MaxScale/blob/24.02/licenses/LICENSE2... Here is FAQ about it: https://mariadb.com/bsl-faq-mariadb/

TL;DR: the license says it's non-free, but it becomes free (GPL in this case) after a specific time.

--

Apart from this specific case, I'd like to hear your guidance in similar cases in general - whether they are mostly accepted or rather avoided (by Fedora), as more licenses with this idea exists, e.g.: https://github.com/getsentry/sentry/blob/master/LICENSE.md

As noted, BUSL-1.1 is already not allowed. The only other distantly conceptually related license that has been considered by Fedora AFAIK is the historically significant, but largely unused, license formerly known as the Transitive Grace Period Public License, which was classified as "good" under the Callaway system. However, TGPPL is quite different from BUSL in that it is a copyleft license (OSL derivative I believe) with a temporary permission for *licensees* to distribute original or derivative works under a proprietary license. The BUSL-derived Sentry licenses (currently the subject of an SPDX issue) have AFAIK not been considered by Fedora, and I hope that these licenses have no impact on any existing Fedora package.

But you've also asked an interesting question that also hasn't come up before:

"once it reaches the condition to transform to a free license, whether it is absolutely fine to add the software to Fedora under that specific free license, or whether there is any specific point of view the Fedora Legal team holds, or other specific requirements how to list the license correctly."

I think it's "fine" in theory, but somewhat risky. I imagine that in some cases it won't be clear whether a particular version mixes BUSL (at various stages of the process towards the "change date") and post-BUSL licenses. And if we concluded that the change date had occurred for everything, we might want to require some further action, at a minimum documenting the conclusion (not just in the license tag) and probably also at least including a copy of the post-BUSL allowed license.

I think we can cross the bridge when we come to it -- or have we come to it?

Also:

"Fedora package maintainers shouldn't try to guess the resulting license(s) that applies to the user, they should only list the licenses of the contents of the binary rpm. In this case, assuming that the license already transformed to the free one might be the guessing package maintainer shouldn't do."

I think this is alluding to the "no effective license" principle. But in lots of situations we have to make guesses and interpretations of various sorts. I can maybe see adopting the position that these licenses are so odious that we don't want to distribute anything that was even formerly under them (until the theoretical trigger to free is reached) but that seems a little extreme to me if it's just a kind of political gesture. There's already a license allowed in Fedora -- it's pretty obscure and I can't remember the name offhand -- where the license basically says something like "proprietary until the year 2000, then you have the following FOSS license" and this is allowed because in that case the change date is clearly something that occurred *long* ago.

Richard

On Wed, Jul 17, 2024 at 3:45 PM Richard Fontana rfontana@redhat.com wrote:

The BUSL-derived Sentry licenses (currently the subject of an SPDX issue) have AFAIK not been considered by Fedora, and I hope that these licenses have no impact on any existing Fedora package.

...

I think we can cross the bridge when we come to it -- or have we come to it?

...

I think this is alluding to the "no effective license" principle. But in lots of situations we have to make guesses and interpretations of various sorts. I can maybe see adopting the position that these licenses are so odious that we don't want to distribute anything that was even formerly under them (until the theoretical trigger to free is reached) but that seems a little extreme to me if it's just a kind of political gesture. There's already a license allowed in Fedora -- it's pretty obscure and I can't remember the name offhand -- where the license basically says something like "proprietary until the year 2000, then you have the following FOSS license" and this is allowed because in that case the change date is clearly something that occurred *long* ago.

I was recently contacted by MariaDB upstream, saying they would like to see MaxScale (a DB proxy) [1], their product, to become adopted by distributions, since the oldest major version (21.06) just recently reached the license transformation date (2024-06-03) and should be under 'GPL-2.0-or-later' now. [2]

So in this case - no, the package is not part of Fedora yet, we only just started talks about whether it could be. But yes, I believe we just came to that bridge.

I also share the opinion that there's no need to be strict just for the reason for a political gesture. Likely the exact opposite - I believe we should be happy the upstreams are accepting the idea of FOSS and are making an effort to find some compromise with what they are used to - and try to be welcoming to this type of licenses.

If the Fedora Legal team would find this acceptable, we need to find out how to record this, just like Neal said.

[1] https://github.com/mariadb-corporation/MaxScale [2] https://github.com/mariadb-corporation/MaxScale/blob/24.02/licenses/LICENSE2...

--

Michal Schorm Software Engineer Core Services - Databases Team Red Hat

--

On Wed, Jul 17, 2024 at 3:45 PM Richard Fontana rfontana@redhat.com wrote:

On Wed, Jul 17, 2024 at 7:33 AM Michal Schorm mschorm@redhat.com wrote:

...

Hello,

I'd like a review of 'MariaDB Business Source License (BSL)'. Here is a specific instance of the license: https://github.com/mariadb-corporation/MaxScale/blob/24.02/licenses/LICENSE2... Here is FAQ about it: https://mariadb.com/bsl-faq-mariadb/

TL;DR: the license says it's non-free, but it becomes free (GPL in this case) after a specific time.

--

Apart from this specific case, I'd like to hear your guidance in similar cases in general - whether they are mostly accepted or rather avoided (by Fedora), as more licenses with this idea exists, e.g.: https://github.com/getsentry/sentry/blob/master/LICENSE.md

As noted, BUSL-1.1 is already not allowed. The only other distantly conceptually related license that has been considered by Fedora AFAIK is the historically significant, but largely unused, license formerly known as the Transitive Grace Period Public License, which was classified as "good" under the Callaway system. However, TGPPL is quite different from BUSL in that it is a copyleft license (OSL derivative I believe) with a temporary permission for *licensees* to distribute original or derivative works under a proprietary license. The BUSL-derived Sentry licenses (currently the subject of an SPDX issue) have AFAIK not been considered by Fedora, and I hope that these licenses have no impact on any existing Fedora package.

But you've also asked an interesting question that also hasn't come up before:

"once it reaches the condition to transform to a free license, whether it is absolutely fine to add the software to Fedora under that specific free license, or whether there is any specific point of view the Fedora Legal team holds, or other specific requirements how to list the license correctly."

I think it's "fine" in theory, but somewhat risky. I imagine that in some cases it won't be clear whether a particular version mixes BUSL (at various stages of the process towards the "change date") and post-BUSL licenses. And if we concluded that the change date had occurred for everything, we might want to require some further action, at a minimum documenting the conclusion (not just in the license tag) and probably also at least including a copy of the post-BUSL allowed license.

I think we can cross the bridge when we come to it -- or have we come to it?

Also:

"Fedora package maintainers shouldn't try to guess the resulting license(s) that applies to the user, they should only list the licenses of the contents of the binary rpm. In this case, assuming that the license already transformed to the free one might be the guessing package maintainer shouldn't do."

I think this is alluding to the "no effective license" principle. But in lots of situations we have to make guesses and interpretations of various sorts. I can maybe see adopting the position that these licenses are so odious that we don't want to distribute anything that was even formerly under them (until the theoretical trigger to free is reached) but that seems a little extreme to me if it's just a kind of political gesture. There's already a license allowed in Fedora -- it's pretty obscure and I can't remember the name offhand -- where the license basically says something like "proprietary until the year 2000, then you have the following FOSS license" and this is allowed because in that case the change date is clearly something that occurred *long* ago.

Richard

On Wed, Jul 17, 2024 at 4:14 PM Daniel P. Berrangé berrange@redhat.com wrote:

If it is MariaDB who are pushing this, then I'd note they could take steps to make this into a total non-issue.

Sure. I'm now here to understand what's the status on Fedora side. Once I get a clear understanding, I can start negotiations.

I believe, however, we are about to hit this issue sooner or later again, with different similar licenses, and then with increasing frequency, as Neal suggested. So IMO it's worth debating now.

--

Michal Schorm Software Engineer Core Services - Databases Team Red Hat

--

On Wed, Jul 17, 2024 at 4:14 PM Daniel P. Berrangé berrange@redhat.com wrote:

On Wed, Jul 17, 2024 at 04:08:03PM +0200, Michal Schorm wrote:

...

On Wed, Jul 17, 2024 at 3:45 PM Richard Fontana rfontana@redhat.com wrote:

...

The BUSL-derived Sentry licenses (currently the subject of an SPDX issue) have AFAIK not been considered by Fedora, and I hope that these licenses have no impact on any existing Fedora package.

...

...

I think we can cross the bridge when we come to it -- or have we come to it?

...

...

I think this is alluding to the "no effective license" principle. But in lots of situations we have to make guesses and interpretations of various sorts. I can maybe see adopting the position that these licenses are so odious that we don't want to distribute anything that was even formerly under them (until the theoretical trigger to free is reached) but that seems a little extreme to me if it's just a kind of political gesture. There's already a license allowed in Fedora -- it's pretty obscure and I can't remember the name offhand -- where the license basically says something like "proprietary until the year 2000, then you have the following FOSS license" and this is allowed because in that case the change date is clearly something that occurred *long* ago.

I was recently contacted by MariaDB upstream, saying they would like to see MaxScale (a DB proxy) [1], their product, to become adopted by distributions, since the oldest major version (21.06) just recently reached the license transformation date (2024-06-03) and should be under 'GPL-2.0-or-later' now. [2]

So in this case - no, the package is not part of Fedora yet, we only just started talks about whether it could be. But yes, I believe we just came to that bridge.

I also share the opinion that there's no need to be strict just for the reason for a political gesture. Likely the exact opposite - I believe we should be happy the upstreams are accepting the idea of FOSS and are making an effort to find some compromise with what they are used to - and try to be welcoming to this type of licenses.

If it is MariaDB who are pushing this, then I'd note they could take steps to make this into a total non-issue.

ie they could update the git branch for the old version that is past the "Change Date" cutoff, such that its LICENSE file & file headers are updated to all refer to "GPL" instead of "BUSL", and then release an updated bugfix tarball. With that the FOSS nature would be fully unambiguous and thus trivally accepted by any distro maintainers.

With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

Dne 17. 07. 24 v 15:45 Richard Fontana napsal(a):

On Wed, Jul 17, 2024 at 7:33 AM Michal Schorm mschorm@redhat.com wrote:

...

Hello,

I'd like a review of 'MariaDB Business Source License (BSL)'. Here is a specific instance of the license: https://github.com/mariadb-corporation/MaxScale/blob/24.02/licenses/LICENSE2... Here is FAQ about it: https://mariadb.com/bsl-faq-mariadb/

TL;DR: the license says it's non-free, but it becomes free (GPL in this case) after a specific time.

--

Apart from this specific case, I'd like to hear your guidance in similar cases in general - whether they are mostly accepted or rather avoided (by Fedora), as more licenses with this idea exists, e.g.: https://github.com/getsentry/sentry/blob/master/LICENSE.md

As noted, BUSL-1.1 is already not allowed. The only other distantly conceptually related license that has been considered by Fedora AFAIK is the historically significant, but largely unused, license formerly known as the Transitive Grace Period Public License, which was classified as "good" under the Callaway system. However, TGPPL is quite different from BUSL in that it is a copyleft license (OSL derivative I believe) with a temporary permission for *licensees* to distribute original or derivative works under a proprietary license. The BUSL-derived Sentry licenses (currently the subject of an SPDX issue) have AFAIK not been considered by Fedora, and I hope that these licenses have no impact on any existing Fedora package.

But you've also asked an interesting question that also hasn't come up before:

"once it reaches the condition to transform to a free license, whether it is absolutely fine to add the software to Fedora under that specific free license, or whether there is any specific point of view the Fedora Legal team holds, or other specific requirements how to list the license correctly."

I think it's "fine" in theory, but somewhat risky. I imagine that in some cases it won't be clear whether a particular version mixes BUSL (at various stages of the process towards the "change date") and post-BUSL licenses. And if we concluded that the change date had occurred for everything, we might want to require some further action, at a minimum documenting the conclusion (not just in the license tag) and probably also at least including a copy of the post-BUSL allowed license.

Chm, I wonder how to for example apply security fix? Imagine there is some security issue fixed in the most recent version, will we reimplement such patch?

Vít

I think we can cross the bridge when we come to it -- or have we come to it?

Also:

"Fedora package maintainers shouldn't try to guess the resulting license(s) that applies to the user, they should only list the licenses of the contents of the binary rpm. In this case, assuming that the license already transformed to the free one might be the guessing package maintainer shouldn't do."

I think this is alluding to the "no effective license" principle. But in lots of situations we have to make guesses and interpretations of various sorts. I can maybe see adopting the position that these licenses are so odious that we don't want to distribute anything that was even formerly under them (until the theoretical trigger to free is reached) but that seems a little extreme to me if it's just a kind of political gesture. There's already a license allowed in Fedora -- it's pretty obscure and I can't remember the name offhand -- where the license basically says something like "proprietary until the year 2000, then you have the following FOSS license" and this is allowed because in that case the change date is clearly something that occurred *long* ago.

Richard

On Wed, Jul 17, 2024 at 02:54:13PM -0400, Richard Fontana wrote:

On Wed, Jul 17, 2024 at 2:47 PM Vít Ondruch vondruch@redhat.com wrote:

...

Dne 17. 07. 24 v 15:45 Richard Fontana napsal(a):

...

...

I think it's "fine" in theory, but somewhat risky. I imagine that in some cases it won't be clear whether a particular version mixes BUSL (at various stages of the process towards the "change date") and post-BUSL licenses. And if we concluded that the change date had occurred for everything, we might want to require some further action, at a minimum documenting the conclusion (not just in the license tag) and probably also at least including a copy of the post-BUSL allowed license.

Chm, I wonder how to for example apply security fix? Imagine there is some security issue fixed in the most recent version, will we reimplement such patch?

Good example. We generally won't be able to backport a BUSL-licensed security fix to a now-free old version. Maybe reimplementing a patch will be a solution.

That gets questionable if the "reimplemented" patch ends up being effectively (or actually) identical to the official patch, due to the neccessity of the technical approach to fix the issue.

With regards, Daniel