4

My first ever question...

Within the (excellent) GNURadio Project the source code (example here) generally features a header declaring the copyright holder, the project that the file is part of and an SPDX line pointing to the GPL3. The project source has a copy of the GPL3 in its root.

My question is, is the SPDX line in the source code file sufficient to unequivocally assert that the file is licensed with GPL3?

I'm not sure that it is. My thinking is that, taken in isolation, the file makes no written English assertion as to what the licensing conditions for the file are or where to go look for them. SPDX is merely a machine digestible convenience for developers wanting to automatically keep their license usage properly sorted. The words "license" and "gpl3" are used, but words like "under the terms of" or "applies" are absent.

A developer familiar with SPDX knows what it means. Not all developers know SPDX. Also I think it's doubtful that the Man on the Clapham Omnibus can be expected to understand the meaning of an SPDX line, and there's nothing in the GPL3 text that unequivocally refers to each individual source file in a project by name, or to the name of the program.

If there is no adequate reference in the source to GPL3, a recipient has a program that happens to come with a copy of the GPL3 text.

Also section 5b of GPL3 requires that a modified work should contain "prominent notices" that GPL3 applies. Does that, stricly speaking, mean that someone modifying GNURadio-style source code has to put all the traditional license text back into each file? My assumption is no, presumably one can adopt the original authors' styles.

However, that leads on to another question. Suppose I were to contribute to the project, and I put in the GPL3 recommended header text in the files I've created; can I object if someone else subsequently removes it?

I read in a presentation about SPDX that it's considered best practice to include both the SPDX line(s), and the traditional text about the license terms. Also, the GPL3 text itself states that it is safest to include the recommended text.

Note

I'm not part of the GNURadio project. I'm simply using it, glanced round its git repo, was startled to see very little in the way of license terms in source headers and wondered about the wisdom of that absence.

Improve this question
4
  • 1
    Related (not necessarily a duplicate): Is using the GPLv3 without putting a license notice in each source file OK?
    – apsillers ♦
    Apr 16, 2020 at 2:57
  • 1
    Even more interesting, they formerly had full license headers but replaced them en masse with SPDX about 3 months ago: github.com/gnuradio/gnuradio/commit/… This must have been discussed somewhere among GNU Radio contributors (though I couldn't tell you where).
    – apsillers ♦
    Apr 16, 2020 at 11:21
  • @apsillers I've just taken a look through the relevant discussion, github.com/gnuradio/gnuradio/pull/3109, doesn't look like the matter arose. They even discussed removing copyright notices, but didn't!
    – bazza
    Apr 16, 2020 at 12:19
  • @apsillers, not relevant to the question in general, but I notice that the GNURadio project won't include contributions unless the copyright is assigned to the EFF. So with that specific project, the issue of how prominent a notice needs to be is down to the EFF to decide, not the original author. I can see why they've done this - it avoids the question of who owns it and who can relicsense it when it's the work of many different contributors. Does mean one has to trust the EFF to not go rouge and monetise it for its own profit (probably an unlikely scenario).
    – bazza
    Apr 17, 2020 at 11:18

1 Answer 1

Reset to default
2

The legal language of GPL3 does not refer to 'machine readable' or 'plain readable'. In order to accommodate both (and to comply with the license terms) you should include the machine readable SPDX into every single file and in addition have a license.md with the complete language of the license, the copyright and other attribution notices.

Maybe, in the future (GPLv4 ?), we will see license language change to allow relying only on SPDX statements. But for now the thinking is: A few 100 Bytes of legal language in each project is not a burden for anyone.

Improve this answer
5
  • It's not the text of the GPL license that I'm worried about, it's the practice of ignoring what it say developers must do to ensure that the license is enforceable. It's an assumption that a project is an indivisible collection of files (a "work"), but that seems pretty risky. If the files can be individually downloaded, then the project is divisible. With a project like GNURadio which builds a lot of libraries, it seems possible to have a portion of the project build something useful, without that portion containing any license terms at all.
    – bazza
    Nov 5, 2021 at 8:56
  • 1
    @bazza You can (unfortunately) not prevent that other -irresponsible- developers ignore your license determination, even if it is clearly written in each and every file. The only way to react to that is (when you identified inappropriate use of your file (a correct fork is always OK)) to notify the other developer and ask him to correct it. If you have backing from a corporation you can use a lawyer. But a simple letter or e-mail should suffice, because nobody will want to create another issue like we had with mimemagic
    – Martin_in_AUT
    Nov 5, 2021 at 9:25
  • Indeed. I guess it comes down to the default rights under copyright law. This page for the UK gov.uk/copyright states that all the rights remain with the author. So files separated from a license are, by default, not licensed to a third party in any way whatsoever. Flipped the other way, is a separate license.md file always adequate for a third party to rely on as a source of license T&C's? Or can a malicious developer claim that the projects files are not licensed, and their repo holding a copy of GPL3 is unrelated. Unlikely I'd say, but one does wonder.
    – bazza
    Nov 5, 2021 at 10:37
  • I remember reading that Register article at the time; what a mess...
    – bazza
    Nov 5, 2021 at 10:41
  • @bazza As you probably know, GPL is enforceable in many countries, Wikipedia lists some cases. As mentioned above, your best option is probably to have a plain text license statement and the SPDX identifier in each file. SPDX is around since 2010, so every 'person having ordinary skill in the art' of programming should be aware of the existence and will recognize it as an expression of the licensor's (=your) intention.
    – Martin_in_AUT
    Nov 6, 2021 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.