Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

License tests and copyright notice missing #88

Closed
wolfganggallo opened this issue Jul 10, 2020 · 2 comments
Closed

License tests and copyright notice missing #88

wolfganggallo opened this issue Jul 10, 2020 · 2 comments
Labels
duplicate This issue or pull request already exists
Milestone

Comments

@wolfganggallo
Copy link

I'm submitting a...


[ ] Regression (a behavior that used to work and stopped working in a new release)
[ ] Bug report  
[ ] Performance issue
[ ] Feature request
[x] Documentation issue or request
[ ] Support request
[x] Other... Please describe:

Current behavior

No copyright notice is given in your license file and the file misses the license texts. Since the MIT license requires the preservation of the copyright notice at distribution, you are making it hard to impossible to use your library legally in Germany where copyright can not be waivered. I'm not a lawyer, this is just what they tell me ;-)

Expected behavior

A copyright notice is given in your license file including the full license texts. Maybe this link helps: https://www.disclaimergenerator.net/copyright-notices/

Minimal reproduction of the problem with instructions

See https://github.com/xmldom/xmldom/blob/master/LICENSE.md

What is the motivation / use case for changing the behavior?

A big company's compliance department is refusing to allow the use of an application using your library because your copyright notice is missing.

@karfau
Copy link
Member

karfau commented Jul 10, 2020

Thx for opening this issue.
Since some details of the current licensing are unclear to me I will add my findings and question here:

Dual-Licensing

The LGPL link in the LICENSE.md file (and original LICENSE file) is redirected to https://www.gnu.org/licenses/lgpl-3.0.html.
Since the file was created 2013 (and the only change was regarding white spaces and file rename), and the LGPL v3 was released 2007 it can be assumed that the original author meant that version. According to section 6 of that License this includes future versions since the author didn't specify a version.
(But since f62560d the package.json specifies [LGPL-2.0](https://www.gnu.org/licenses/old-licenses/lgpl-2.0.html) OR MIT.)

The file further offers the option to freely choose from either MIT or LGPL.

To my knowledge this fork has been created because the original author/contributors no longer responded to any requests regarding this library. Which I assume means that they didn't consent to it other then licensing the code base this way.

Would the xmldom (github) organization be able to decide that the fork is now redistributed under MIT?
Or would this be a violation of the LGPL part of the License (especially since the original author did not consent?

I don't know why I should choose the LGPL when doing anything with it, since provides less options than the MIT. As far as I understand it, MIT licensed code can be integrated into a (L)GPL project which will put it under that license then. So I don't really understand why it is important to offer those two options.

Copyright notice

The "template" of MIT and the How to of the (L)GPL say they require a Copyright Notice, as stated by @wolfganggallo .

My first guess, based on the released versions on npm (including xmldom-alpha) would have been:

Copyright 2012-2017 jindw jindw@xidea.org
Copyright 2019-2020 Chris Brody chris@brody.consulting

But:

  • jindw did not release a version of the library in 2015, so it might need to be 2012-2014, 2016, 2017
  • I didn't check if other people have published a version of the library, if so, they need to be added
  • is jindw sill a copyright owner for 2019-2020?
  • If it should be based on contributors based on git commits (only to source code or also to test code/docs?) it get's more complicated and should be automated.

The "How to of the (L)GPL" even recommends to put a note about the license including Copyright notice into each file.

  • I guess it should be adopted to indicate the choice of MIT or LGPL.

  • If those Copyright notices should only contain the people that contributed to it, this seems to be a maintenance nightmare if it's not fully automated.

  • Does every contributor agree to license her or his contribution under either license?

Conclusion

I think it's a good idea to come to a decision here, and one that doesn't block other important work.
I also consider it an important issue, because it's hard to argue about something that's not clear/transparent.

@karfau
Copy link
Member

karfau commented Jan 21, 2021

Was recently solved, see #173 (duplicate), #172, #178 (PR)

@karfau karfau closed this as completed Jan 21, 2021
@karfau karfau added this to the 0.5.0 milestone Jan 21, 2021
@karfau karfau added the duplicate This issue or pull request already exists label Jan 21, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
duplicate This issue or pull request already exists
Projects
None yet
Development

No branches or pull requests

2 participants