Projects that depend on tslib inherit the Microsoft copyright

[evmar]

Hello,

If I build an app that combines tslib with other code -- e.g. use TypeScript in an app -- as far as I understand the license header on https://github.com/Microsoft/tslib/blob/master/tslib.js, it requires me to include that copyright+license in the resulting product.

Is that intentional? I think when I use the TypeScript compiler without the --importHelpers flag, I do not have this additional requirement.

[DanielRosenwasser]

Hmm, this definitely was not the intent; these helpers get auto-injected anyway. Babel has also done this with their helpers under an MIT license which has similar implications. Let me try to figure things out on our end.

[evmar]

Just wanted to ask if there was any progress on this.

[evmar]

Ping again!

[DanielRosenwasser]

As an update, I've reached out to our appropriate legal reps. They're not in the office at the moment so we'll need to wait on that.

[ricmoo]

Heya @DanielRosenwasser !

I would also like to include this in the dist builds of ethers, but the Apache license is incompatible.

Could we possibly get these licensed under multiple, permissive licenses (e.g. MIT, BSD, et cetera)?

Or better yet, just released into the public domain.

Or provide a way in TypeScript to override the library included with importHelpers, so we can override "tslib" with our own implementations.

Thanks! :)

[evmar]

Sorry to re-ping, just wanted to make sure you didn't forget this.

[DanielRosenwasser]

@ricmoo if you're bundling, couldn't you use path aliasing? But I could see that.

Also, looping back with our legal team.

[evmar]

Maybe legal team is now back from vacation and ready to take a fresh look? (Sorry again for all the annoying comments!)

[DanielRosenwasser]

So here's what I can state given the conversations I've had thus far.

Occasionally, the TypeScript compiler injects JavaScript code that users don’t actually write. These are helper functions to make it easier for us to make JavaScript work equivalently with respect to the input TypeScript code. We do not expect users to provide any reference to the Apache 2.0 license governing the TypeScript compiler for the JavaScript code occasionally injected into the output of the compiler. Likewise, we have no expectation that the license text in tslib needs to be retained upon redistribution.

[ricmoo]

Can that “expectation” be put in writing? :)

Maybe a /*! Public domain: Microsoft 2018 */ injected into the code along side it?

[mmotorny]

Please do not use "public domain", it's not a license and it makes it impossible to use such code in corporate context. Essentially, only government or very long time makes code public domain.

[avonwyss]

@mmotorny There are "public-domain" licenses such as the CC0 or the Unlicense which should not be problematic in corporate environments (the problems are when there is no license, because this means that the author retains the copyrights). IMHO any of these should be a good fit for the TSLib code.

[mmotorny]

@avonwyss I'm aware of CC0 and Unlicense, but that's not what @ricmoo was suggesting.

[ricmoo]

Really all I was implying is that the license be inlined, and formalized. Not simply suggested in a GitHub issue that it "should be alright to include"...

[evmar]

LLVM is changing their license to a ""Apache 2.0 with LLVM Exception", where the exception is a block at the end of the license to work around issues like these.

http://llvm.org/foundation/relicensing/
http://llvm.org/foundation/relicensing/LICENSE.txt (scroll to the bottom to see the exception)

[evmar]

Another ping -- @DanielRosenwasser's comment is exactly what we want, but we need it in some place that lawyers will believe, because I believe GitHub comments are non-binding. ;)

[grandin-j]

Any movement here? It seems like everyone agrees on the solution. Any chance of making it happen?

[DanielRosenwasser]

Hey all, just wanted to thank everyone for your patience and to give an update here.

We've managed to get the conversation rolling further and I'm generally pretty happy with the direction we're moving towards. We're looking into adding a license exception, but the specifics are in the works. When we figure that out, we'll post it here to get a gauge on whether the language feels reasonable.

[SamB]

We're looking into adding a license exception,

So, the kind that, like the LLVM exception mentioned above, gets listed at https://spdx.org/licenses/exceptions-index.html, or the kind where your legal people say "yeah, you can use a more liberal license for that part of the code"?

Also, the part about the non---importHelpers case not adding any Apache license headers got me thinking:

Why isn't tslib just getting the helper code from the compiler, perhaps using a special flag to ask tsc to just spit out all helpers (for a given target).

That might not really help with the legal situation, but wouldn't it simplify updates to tslib?

[evmar]

The exceptions in C++ compilers (LLVM/gcc) are actually written about that case specifically, where the compiler emits some code into the resulting binary, like TS without importHelpers. Currently TS is silent about the legal status of the code in inserts inline, which is what the above LLVM exception is more concerned with.

The tslib issue makes this problem more apparent because it tslib does have an explicit license on it.

[owen-m1]

+1 - I cannot use Typescript in some open source until this is changed

[snario]

+1

[pkieltyka]

+1

[evmar]

I spoke to @DanielRosenwasser in person about this at tsconf, and I now understand I had two separate issues confused.

1. Code that TS inserts into the output bundle is of unclear copyright. This is the thing the LLVM exception is all about, but that is not what this particular issue is about.
2. This library (tslib) that TS may add as dependency of output, and how that requires the resulting artifacts to carry the MS copyright. For this one, the best solution is to relicense this library as something that doesn't require the MS copyright on compilation output.

For #2, you can use a license like:
https://opensource.org/licenses/0BSD
For your lawyers, I know it's not the normal license you'd like to use, but this is all for a very special case and it's also not very much code.

[evmar]

Another update on this: as best we can tell at this point, this is not going to be fixed by the TS team -- we've attempted to reach out many times across two years and through multiple channels and still don't have a response.

Our best idea at this point is to attempt a clean room reimplementation of tslib, though we haven't seriously investigated it at this point. If you were considering doing the same, please comment on this bug to share what you end up with.

[phinguyen202]

Hi guys,
I know less about licences. I'm writing a react library using typescript and tslib. And yeah, I know I have include Ms copyright+license in the resulting product as evmar said. I'm planning to set it under MIT licence. Is that any illegal?

[DanielRosenwasser]

@phinguyen202 as long as you specifically call out which parts are MIT vs. Apache 2.0 you should be fine, but I'd check with an attorney regarding what you're trying to achieve.

Keep in mind, if you're writing a library, you shouldn't need to bundle tslib - let your consumers do that.

[DanielRosenwasser]

Hey all, after some internal discussion, we're leaning towards relicensing tslib under the Zero-Clause BSD license. 0BSD is derived from the ISC license, but specifically differs in that it does not place any requirement on the copyright notice appearing in copies of the licensed work.

- Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. 
+ Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted.

 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 

In the near future, we'll be putting up a PR to replace the license. We'll give the PR about 10 business days, and if there are no strong objections, we'll pull the change in and publish a new version of tslib with the less-restrictive license.

[DanielRosenwasser]

See #96 for the PR.

[DanielRosenwasser]

tslib 1.11.2 should contain the relicense.

Thanks to everyone for helping out here and being patient! 🙂

[penx]

Despite the move to zero clause BSD, bundlers still retain the license because it starts with /*!

https://stackoverflow.com/questions/11248363/the-purpose-of-starting-an-initial-comment-with-in-javascript-and-css-files

This is for legal reasons. By default comments with @license, @preserve or starting with /*! are preserved

webpack/webpack#324 (comment)

I have opened #160 to remove the /*!.