Hi,
valgrind as a whole is licensed under the GPLv2+, but has a couple of development headers, all separately packaged in the valgrind-devel subpackage) with a lax-permissive license. Since they are meant to embed valgrind specific (code) annotations into other programs/libraries they carry an explicit exception from the GPL.
There are 7 such files, all exactly the same, except for the embedded file name, "This file is part of..." description and Copyright notice. See below for the exact text and variants.
It would be nice to give this binary subpackage its own License tag.
But I have some trouble figuring out which (SPDX) tag to use.
The closest seems to be what SPDX calls "bzip2-1.0.6" (which kind of makes sense since Julian Seward started both the bzip2 and valgrind projects). https://spdx.org/licenses/bzip2-1.0.6.html
I could use that identifier. But it seems to be an oddly specific identifier, for an older version of bzip2. And the Fedora bzip2 package just uses BSD-4-Clause. I could also use BSD-4-Clause since that is more generic. But the text of what SPDX calls BSD-4-Clause doesn't really match (so maybe the Fedora bzip2 package got that wrong?)
What would be to best license tag to use here?
They all look as follows:
/* -*- c -*- ----------------------------------------------------------------
Notice that the following BSD-style license applies to this one file (valgrind.h) only. The rest of Valgrind is licensed under the terms of the GNU General Public License, version 2, unless otherwise indicated. See the COPYING file in the source distribution for details.
----------------------------------------------------------------
This file is part of Valgrind, a dynamic binary instrumentation framework.
Copyright (C) 2000-2017 Julian Seward. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. The origin of this software must not be misrepresented; you must not claim that you wrote the original software. If you use this software in a product, an acknowledgment in the product documentation would be appreciated but is not required.
3. Altered source versions must be plainly marked as such, and must not be misrepresented as being the original software.
4. The name of the author may not be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
----------------------------------------------------------------
Notice that the above BSD-style license applies to this one file (valgrind.h) only. The entire rest of Valgrind is licensed under the terms of the GNU General Public License, version 2. See the COPYING file in the source distribution for details.
---------------------------------------------------------------- */
They only differ in "this one file ([valgrind|cachegrind|callgrind|drd|helgrind|memcheck|dhat].h) only" at the top and the bottom. And the description and Copyright notice.
This file is part of Cachegrind, a high-precision tracing profiler built with Valgrind.
Copyright (C) 2023-2023 Nicholas Nethercote. All rights reserved.
--
This file is part of callgrind, a valgrind tool for cache simulation and call tree tracing.
Copyright (C) 2003-2017 Josef Weidendorfer. All rights reserved.
--
This file is part of DRD, a Valgrind tool for verification of multithreaded programs.
Copyright (C) 2006-2020 Bart Van Assche bvanassche@acm.org. All rights reserved.
--
This file is part of Helgrind, a Valgrind tool for detecting errors in threaded programs.
Copyright (C) 2007-2017 OpenWorks LLP info@open-works.co.uk
--
This file is part of MemCheck, a heavyweight Valgrind tool for detecting memory errors.
Copyright (C) 2000-2017 Julian Seward. All rights reserved.
--
This file is part of DHAT, a Valgrind tool for profiling the heap usage of programs.
Copyright (C) 2020 Nicholas Nethercote. All rights reserved.
--
Thanks,
Mark
On Fri, Nov 17, 2023 at 1:18 PM Mark Wielaard mjw@fedoraproject.org wrote:
Hi,
valgrind as a whole is licensed under the GPLv2+, but has a couple of development headers, all separately packaged in the valgrind-devel subpackage) with a lax-permissive license. Since they are meant to embed valgrind specific (code) annotations into other programs/libraries they carry an explicit exception from the GPL.
There are 7 such files, all exactly the same, except for the embedded file name, "This file is part of..." description and Copyright notice. See below for the exact text and variants.
It would be nice to give this binary subpackage its own License tag.
But I have some trouble figuring out which (SPDX) tag to use.
The closest seems to be what SPDX calls "bzip2-1.0.6" (which kind of makes sense since Julian Seward started both the bzip2 and valgrind projects). https://spdx.org/licenses/bzip2-1.0.6.html
I could use that identifier. But it seems to be an oddly specific identifier, for an older version of bzip2. And the Fedora bzip2 package just uses BSD-4-Clause. I could also use BSD-4-Clause since that is more generic. But the text of what SPDX calls BSD-4-Clause doesn't really match (so maybe the Fedora bzip2 package got that wrong?)
Sounds like it, but I'll try to look into that later.
What would be to best license tag to use here?
They all look as follows:
/* -*- c -*-
Notice that the following BSD-style license applies to this one file (valgrind.h) only. The rest of Valgrind is licensed under the terms of the GNU General Public License, version 2, unless otherwise indicated. See the COPYING file in the source distribution for details.
This file is part of Valgrind, a dynamic binary instrumentation framework.
Copyright (C) 2000-2017 Julian Seward. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
The origin of this software must not be misrepresented; you must not claim that you wrote the original software. If you use this software in a product, an acknowledgment in the product documentation would be appreciated but is not required.
Altered source versions must be plainly marked as such, and must not be misrepresented as being the original software.
The name of the author may not be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This seems indeed to match bzip2-1.06 -- Jilayne, I assume the full text of what is wrapped in the <copyrightText> tag could be ignored for purposes of matching? i.e. https://github.com/spdx/license-list-XML/blob/main/src/bzip2-1.0.6.xml#L10-L...
The SPDX Matching Guidelines say: "To avoid a license mismatch merely because the copyright notice (usually found above the actual license or exception text) is different. The copyright notice is important information to be recorded elsewhere in the SPDX document, but for the purposes of matching a license to the SPDX License List, it should be ignored because it is not part of the substantive license text."
but this does not define what a "copyright notice" is. If we don't hear from Jilayne, I'd go ahead with assuming that this is a perfect match. :)
- Richard
Notice that the above BSD-style license applies to this one file (valgrind.h) only. The entire rest of Valgrind is licensed under the terms of the GNU General Public License, version 2. See the COPYING file in the source distribution for details.
*/
They only differ in "this one file ([valgrind|cachegrind|callgrind|drd|helgrind|memcheck|dhat].h) only" at the top and the bottom. And the description and Copyright notice.
This file is part of Cachegrind, a high-precision tracing profiler built with Valgrind.
Copyright (C) 2023-2023 Nicholas Nethercote. All rights reserved.
--
This file is part of callgrind, a valgrind tool for cache simulation and call tree tracing.
Copyright (C) 2003-2017 Josef Weidendorfer. All rights reserved.
--
This file is part of DRD, a Valgrind tool for verification of multithreaded programs.
Copyright (C) 2006-2020 Bart Van Assche bvanassche@acm.org. All rights reserved.
--
This file is part of Helgrind, a Valgrind tool for detecting errors in threaded programs.
Copyright (C) 2007-2017 OpenWorks LLP info@open-works.co.uk
--
This file is part of MemCheck, a heavyweight Valgrind tool for detecting memory errors.
Copyright (C) 2000-2017 Julian Seward. All rights reserved.
--
This file is part of DHAT, a Valgrind tool for profiling the heap usage of programs.
Copyright (C) 2020 Nicholas Nethercote. All rights reserved.
--
Thanks,
Mark
legal mailing list -- legal@lists.fedoraproject.org To unsubscribe send an email to legal-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi Richard,
On Fri, 2023-11-17 at 13:52 -0500, Richard Fontana wrote:
This seems indeed to match bzip2-1.06 -- Jilayne, I assume the full text of what is wrapped in the <copyrightText> tag could be ignored for purposes of matching? i.e. https://github.com/spdx/license-list-XML/blob/main/src/bzip2-1.0.6.xml#L10-L...
The SPDX Matching Guidelines say: "To avoid a license mismatch merely because the copyright notice (usually found above the actual license or exception text) is different. The copyright notice is important information to be recorded elsewhere in the SPDX document, but for the purposes of matching a license to the SPDX License List, it should be ignored because it is not part of the substantive license text."
but this does not define what a "copyright notice" is. If we don't hear from Jilayne, I'd go ahead with assuming that this is a perfect match. :)
OK, but can we use a more appropriate tag. bzip2-1.0.6 seems a little odd (it is a version of bzip2 with a CVE[*] from a couple of years back). Maybe just call it 'bzip2' or 'Hybrid-BSD' as Fedora used to call it (although it seems to still use the plain 'BSD' tag for it) since it seems to be a generic license used by different projects: https://fedoraproject.org/wiki/Licensing:BSD#Hybrid_BSD_(half_BSD,_half_zlib)
Thanks,
Mark
[*] NVD assigned it a 9.8 Critcal score (!), but it really isn't a security issue (and even if it was a bug, it really didn't have any impact), still hope people have updated their bzip2 though: https://gnu.wildebeest.org/blog/mjw/2019/08/02/bzip2-and-the-cve-that-wasnt/
On Mon, Nov 20, 2023 at 6:26 AM Mark Wielaard mjw@fedoraproject.org wrote:
Hi Richard,
On Fri, 2023-11-17 at 13:52 -0500, Richard Fontana wrote:
This seems indeed to match bzip2-1.06 -- Jilayne, I assume the full text of what is wrapped in the <copyrightText> tag could be ignored for purposes of matching? i.e. https://github.com/spdx/license-list-XML/blob/main/src/bzip2-1.0.6.xml#L10-L...
The SPDX Matching Guidelines say: "To avoid a license mismatch merely because the copyright notice (usually found above the actual license or exception text) is different. The copyright notice is important information to be recorded elsewhere in the SPDX document, but for the purposes of matching a license to the SPDX License List, it should be ignored because it is not part of the substantive license text."
but this does not define what a "copyright notice" is. If we don't hear from Jilayne, I'd go ahead with assuming that this is a perfect match. :)
OK, but can we use a more appropriate tag. bzip2-1.0.6 seems a little odd (it is a version of bzip2 with a CVE[*] from a couple of years back). Maybe just call it 'bzip2' or 'Hybrid-BSD' as Fedora used to call it (although it seems to still use the plain 'BSD' tag for it) since it seems to be a generic license used by different projects: https://fedoraproject.org/wiki/Licensing:BSD#Hybrid_BSD_(half_BSD,_half_zlib)
We're trying to standardize on using SPDX License List (https://spdx.org/licenses/) license identifiers as much as possible. I think we'd only deviate from that where use of the SPDX identifier would be highly misleading or confusing. There's sort of an example of this: https://gitlab.com/fedora/legal/fedora-license-data/-/blob/main/data/License... but that's where there would otherwise be a composite SPDX expression.
You could propose this change to the SPDX legal team by submitting an issue at https://github.com/spdx/license-list-XML but historically they've been very resistant to identifier deprecations (with the notable exception of the GPL identifiers :)
Richard
Hi Richard,
On Mon, 2023-11-20 at 09:41 -0500, Richard Fontana wrote:
On Mon, Nov 20, 2023 at 6:26 AM Mark Wielaard mjw@fedoraproject.org wrote:
but this does not define what a "copyright notice" is. If we don't hear from Jilayne, I'd go ahead with assuming that this is a perfect match. :)
OK, but can we use a more appropriate tag. bzip2-1.0.6 seems a little odd (it is a version of bzip2 with a CVE[*] from a couple of years back). Maybe just call it 'bzip2' or 'Hybrid-BSD' as Fedora used to call it (although it seems to still use the plain 'BSD' tag for it) since it seems to be a generic license used by different projects: https://fedoraproject.org/wiki/Licensing:BSD#Hybrid_BSD_(half_BSD,_half_zlib)
We're trying to standardize on using SPDX License List (https://spdx.org/licenses/) license identifiers as much as possible. I think we'd only deviate from that where use of the SPDX identifier would be highly misleading or confusing. There's sort of an example of this: https://gitlab.com/fedora/legal/fedora-license-data/-/blob/main/data/License... but that's where there would otherwise be a composite SPDX expression.
I don't think that is really an issue. Before Fedora also used identifiers and licenses not recognized by other organizations like the FSF or OSI (this valgrind/bzip2 Hybrid BSD license isn't recognized by either as far as I know). And this is also how other distros use SPDX only when it makes sense. Debian for example uses SPDX identifiers where it makes sense, but e.g. in this particular case they drop and ignore redundant trailing license identifier version numbers (or simply use BDS-variant as license tag).
You could propose this change to the SPDX legal team by submitting an issue at https://github.com/spdx/license-list-XML but historically they've been very resistant to identifier deprecations (with the notable exception of the GPL identifiers :)
Hohum, github. That does seems to use a lot of proprietary javascript and doesn't allow reporting issues without a github account, which I don't have and don't really want. Too bad that seems to be the way to discuss with the SPDX legal team :{
So for now I'll just keep using the old identifiers for valgrind and use generic BSD for this subpackage till it is clear how to get this cleaned up with SPDX.
Thanks,
Mark
On Fri, Nov 24, 2023 at 11:36 AM Mark Wielaard mjw@fedoraproject.org wrote:
Hi Richard,
On Mon, 2023-11-20 at 09:41 -0500, Richard Fontana wrote:
You could propose this change to the SPDX legal team by submitting an issue at https://github.com/spdx/license-list-XML but historically they've been very resistant to identifier deprecations (with the notable exception of the GPL identifiers :)
Hohum, github. That does seems to use a lot of proprietary javascript and doesn't allow reporting issues without a github account, which I don't have and don't really want. Too bad that seems to be the way to discuss with the SPDX legal team :{
They also have a mailing list but from what I understand it uses groups.io, a non-FOSS web service. You could also ask Jilayne Lovejoy to consider it, she's one of the SPDX-legal leads and also reads this list.
Richard
Hi,
On Fri, Nov 24, 2023 at 01:18:22PM -0500, Richard Fontana wrote:
On Fri, Nov 24, 2023 at 11:36 AM Mark Wielaard mjw@fedoraproject.org wrote:
On Mon, 2023-11-20 at 09:41 -0500, Richard Fontana wrote:
You could propose this change to the SPDX legal team by submitting an issue at https://github.com/spdx/license-list-XML but historically they've been very resistant to identifier deprecations (with the notable exception of the GPL identifiers :)
Hohum, github. That does seems to use a lot of proprietary javascript and doesn't allow reporting issues without a github account, which I don't have and don't really want. Too bad that seems to be the way to discuss with the SPDX legal team :{
They also have a mailing list but from what I understand it uses groups.io, a non-FOSS web service.
Hohum, unfortunate, but not entirely unsurprising for a Linux Foundation project :{
You could also ask Jilayne Lovejoy to consider it, she's one of the SPDX-legal leads and also reads this list.
Great. So yes, that would be nice. So Jilayne, if we could get a generic identifier for this license statement, maybe just call it 'Hybrid-BSD' [*], that would be really helpful.
BTW. I happen to be one of the upstream maintainers of bzip2 and of valgrind, which both use this license variant for some of the code. So we could do a release that explicitly uses a generic name for this if that helps.
Thanks,
Mark
[*] https://fedoraproject.org/wiki/Licensing:BSD#Hybrid_BSD_(half_BSD,_half_zlib)
Hi Jilayne,
On Sat, 2023-11-25 at 01:49 +0100, Mark Wielaard wrote:
On Fri, Nov 24, 2023 at 01:18:22PM -0500, Richard Fontana wrote:
On Fri, Nov 24, 2023 at 11:36 AM Mark Wielaard mjw@fedoraproject.org wrote:
On Mon, 2023-11-20 at 09:41 -0500, Richard Fontana wrote:
You could propose this change to the SPDX legal team by submitting an issue at https://github.com/spdx/license-list-XML but historically they've been very resistant to identifier deprecations (with the notable exception of the GPL identifiers :)
You could also ask Jilayne Lovejoy to consider it, she's one of the SPDX-legal leads and also reads this list.
Great. So yes, that would be nice. So Jilayne, if we could get a generic identifier for this license statement, maybe just call it 'Hybrid-BSD' [*], that would be really helpful.
This would still be really useful. If you know the history behind the version specific identifier, which is, as far as I can tell, not even used by bzip2 itself or by anyone redistributing bzip2, that would be helpful. There is a subpackage of Valgrind (valgrind-devel) that uses kind of a similar text, but in valgrind it is used as a kind of file- based GPL-exception with extra notices at the top and the bottom explaining what the larger work is for which the exception holds, and a disclaimer by the organisation that paid for the work (which I believe isn't legally significant, but Richard thinks is). See also https://gitlab.com/fedora/legal/fedora-license-data/-/issues/422
BTW. I happen to be one of the upstream maintainers of bzip2 and of valgrind, which both use this license variant for some of the code. So we could do a release that explicitly uses a generic name for this if that helps.
Thanks,
Mark
[*] https://fedoraproject.org/wiki/Licensing:BSD#Hybrid_BSD_(half_BSD,_half_zlib)
Hi Jilayne,
On Wed, 2024-01-17 at 18:45 +0100, Mark Wielaard wrote:
On Sat, 2023-11-25 at 01:49 +0100, Mark Wielaard wrote:
On Fri, Nov 24, 2023 at 01:18:22PM -0500, Richard Fontana wrote:
On Fri, Nov 24, 2023 at 11:36 AM Mark Wielaard mjw@fedoraproject.org wrote:
On Mon, 2023-11-20 at 09:41 -0500, Richard Fontana wrote:
You could propose this change to the SPDX legal team by submitting an issue at https://github.com/spdx/license-list-XML but historically they've been very resistant to identifier deprecations (with the notable exception of the GPL identifiers :)
You could also ask Jilayne Lovejoy to consider it, she's one of the SPDX-legal leads and also reads this list.
Great. So yes, that would be nice. So Jilayne, if we could get a generic identifier for this license statement, maybe just call it 'Hybrid-BSD' [*], that would be really helpful.
This would still be really useful. If you know the history behind the version specific identifier, which is, as far as I can tell, not even used by bzip2 itself or by anyone redistributing bzip2, that would be helpful. There is a subpackage of Valgrind (valgrind-devel) that uses kind of a similar text, but in valgrind it is used as a kind of file- based GPL-exception with extra notices at the top and the bottom explaining what the larger work is for which the exception holds, and a disclaimer by the organisation that paid for the work (which I believe isn't legally significant, but Richard thinks is). See also https://gitlab.com/fedora/legal/fedora-license-data/-/issues/422
If you have time to look at the Hybrid-BSD license and which kind of top/bottom "legal" notices are generic or not that would be really appreciated.
BTW. I happen to be one of the upstream maintainers of bzip2 and of valgrind, which both use this license variant for some of the code. So we could do a release that explicitly uses a generic name for this if that helps.
[*] https://fedoraproject.org/wiki/Licensing:BSD#Hybrid_BSD_(half_BSD,_half_zlib)
Thanks,
Mark
Hi Mark,
Sorry for not responding sooner on this. I got a bit stuck under some heavy project end of last year and am now finally catching up on fedora-legal-list issues!
I have now responded in detail to the Fedora-license-data issue at: https://gitlab.com/fedora/legal/fedora-license-data/-/issues/422
TL;DR is the SPDX identifier bzip2-1.0.6 to represent the licenses you found in Valgrind.
A couple other comments below :)
Thanks for your patience! Jilayne
On 2/19/24 10:25 AM, Mark Wielaard wrote:
Hi Jilayne,
On Wed, 2024-01-17 at 18:45 +0100, Mark Wielaard wrote:
On Sat, 2023-11-25 at 01:49 +0100, Mark Wielaard wrote:
On Fri, Nov 24, 2023 at 01:18:22PM -0500, Richard Fontana wrote:
On Fri, Nov 24, 2023 at 11:36 AM Mark Wielaardmjw@fedoraproject.org wrote:
On Mon, 2023-11-20 at 09:41 -0500, Richard Fontana wrote:
You could propose this change to the SPDX legal team by submitting an issue athttps://github.com/spdx/license-list-XML but historically they've been very resistant to identifier deprecations (with the notable exception of the GPL identifiers :)
that is correct, the SPDX License List has made a very concerted effort to only deprecate license ids under extenuating circumstances (which includes the changes made to GPL identifiers, to which there was a fair amount of resistance... :)
You could also ask Jilayne Lovejoy to consider it, she's one of the SPDX-legal leads and also reads this list.
Great. So yes, that would be nice. So Jilayne, if we could get a generic identifier for this license statement, maybe just call it 'Hybrid-BSD' [*], that would be really helpful.
This would still be really useful. If you know the history behind the version specific identifier, which is, as far as I can tell, not even used by bzip2 itself or by anyone redistributing bzip2, that would be helpful. There is a subpackage of Valgrind (valgrind-devel) that uses kind of a similar text, but in valgrind it is used as a kind of file- based GPL-exception with extra notices at the top and the bottom explaining what the larger work is for which the exception holds, and a disclaimer by the organisation that paid for the work (which I believe isn't legally significant, but Richard thinks is). See also https://gitlab.com/fedora/legal/fedora-license-data/-/issues/422
I dug a bit on this question, here's what I found: bzip2-1.0.5 was submitted for inclusion on the SPDX License List in Feb 2014 and accepted for version 1.20 - see https://lists.spdx.org/g/Spdx-legal/topic/22080444#811
The URL provided at that time (which redirects now) used the version number "1.0.5" in the license text, so that is why it is included in the SPDX id (b/c where there is a version number, we use it - makes it easier if there are later versions :) see https://web.archive.org/web/20140118032813/http://bzip.org/1.0.5/bzip2-manua...
bzip2-1.0.6 was discussed about 5 months later, as you can see at https://lists.spdx.org/g/Spdx-legal/topic/22080492#907 and https://wiki.spdx.org/view/Legal_Team/Minutes/2014-06-26 and then added as a distinct license.
and hey look, someone found the same Valgrind files you are looking at and emailed SPDX in 2019: https://lists.spdx.org/g/Spdx-legal/topic/35237515#2685
This question came up again in 2020, see: https://lists.spdx.org/g/spdx/topic/75871014#1330
bzip2-1.0.5 was deprecated as an SPDX identifier as of version 3.16 in 2022 - see https://github.com/spdx/license-list-XML/issues/1223
If you have time to look at the Hybrid-BSD license and which kind of top/bottom "legal" notices are generic or not that would be really appreciated.
done! No new id or license needed!
BTW. I happen to be one of the upstream maintainers of bzip2 and of valgrind, which both use this license variant for some of the code. So we could do a release that explicitly uses a generic name for this if that helps.
as noted above, SPDX does not change license ids unless it's an extenuating circumstance. (btw, naming is hard, and it's always easy to have 20/20 hindsight on a "better" name. In any case, anyone is welcome to join the SPDX-legal community and help come up with ids for licenses that are submitted :)
[*] https://fedoraproject.org/wiki/Licensing:BSD#Hybrid_BSD_(half_BSD,_half_zlib)
Thanks,
Mark
-
Jilayne Lovejoy -
Mark Wielaard -
Mark Wielaard -
Richard Fontana