RFC: Streamline ScanCode data-related licenses

[pombredanne]

Here is what I suggest we change:

1. remove the disclaimer requirement entirely from the code and use a plain Apache-2.0 throughout
   https://github.com/nexB/scancode-toolkit/blob/b14ca7b2af3ee09486d9cf704752118db5d75064/NOTICE#L17
2. change the license of the licenses dataset from CC0-1.0 to CC-BY-4.0
   https://github.com/nexB/scancode-toolkit/blob/b14ca7b2af3ee09486d9cf704752118db5d75064/src/licensedcode/data/data.ABOUT

Why?

• for 1. this has proven pretty useless and has raised interrogations from @armijnhemel @tsteenbe @sschuberth and @hesa and a few others
• for 2. the license dataset as a whole is soon being published as an open database with an API and website. We need some minimal attribution for Scancode and the CC-BY-4.0 is a well known Permissive license for data

What would be the impact?

Both 1. and 2. would come together and have little impact:

• removing the extra notices from the code will be a one time search/replace operation
• the scan output will be unchanged (the disclaimer would stay, but would just be that a disclaimer)
• the licenses dataset would need to be changed in one place (or a very few places)
• there would be no impact on a typical user of scancode
• folks that would want to publish the licenses dataset would only need to provide a simple attribution that is TBD
• while we update the licenses, we should apply SDPX-License-Identifier throughout the codebase

Comments and feedback welcomed!
@mjherzog @DennisClark @qduanmu @tdruez @richardfontana @LeChasseur ping

[LeChasseur]

I have no objections with regard to 1 (I can consider German law only).
I understand the purpose of 2. This is absolutely ok. To make life easier I recommend to provide a concrete attribution note that can be copied for reuse. A possible example:
nexB Inc., „ScanCode License Dataset“ (https://LINK_TO_DATA), https://creativecommons.org/licenses/by/4.0/legalcode

[pombredanne]

@LeChasseur @mjherzog for your review here are the suggested changes:

• the new NOTICE: https://github.com/nexB/scancode-toolkit/blob/18c836e82b0b9a97b8237326694d21bf75c38796/NOTICE
• a code header notice: https://github.com/nexB/scancode-toolkit/blob/18c836e82b0b9a97b8237326694d21bf75c38796/src/licensedcode/__init__.py

[pombredanne]

Note that in hindsight a shorter notice for code may be better than https://github.com/nexB/scancode-toolkit/blob/18c836e82b0b9a97b8237326694d21bf75c38796/src/licensedcode/__init__.py
e.g. this (which is also only about code under Apache):

#
# Copyright (c) nexB Inc. and others. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
# Visit https://aboutcode.org and https://github.com/nexB/scancode-toolkit for
# support and download. ScanCode is a trademark of nexB Inc.
#

rather than the longer:

# Copyright (c) nexB Inc. and others. All rights reserved.
# SPDX-License-Identifier: Apache-2.0 AND CC-BY-4.0
#
# Visit https://aboutcode.org and https://github.com/nexB/scancode-toolkit for
# support and download. ScanCode is a trademark of nexB Inc.
#
# The ScanCode software is licensed under the Apache License version 2.0.
# The ScanCode open data is licensed under CC-BY-4.0.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# 

[pombredanne]

Also, https://github.com/nexB/scancode-toolkit/blob/18c836e82b0b9a97b8237326694d21bf75c38796/src/licensedcode/data/data.ABOUT contains the proposed data notice

[sschuberth]

ScanCode open data by nexB Inc. and others licensed under CC-BY-4.0

I'm wondering about the "open data" wording here; it sounds as if there is other, non-open data in ScanCode that is licensed differently. But isn't what you want to say just that the "data is (openly) licensed under CC-BY-4.0"?

[pombredanne]

@sschuberth

I'm wondering about the "open data" wording here; it sounds as if there is other, non-open data in ScanCode that is licensed differently. But isn't what you want to say just that the "data is (openly) licensed under CC-BY-4.0"?

Good point! That was more highlight the fact the data is open not that there is anything that's not. But that's redundant and obvious I guess.

[hesa]

Tiny comment on https://github.com/nexB/scancode-toolkit/blob/18c836e82b0b9a97b8237326694d21bf75c38796/NOTICE:

"The preferred way to attribute te data is this notice::"
=>
"The preferred way to attribute the data is this notice:"

[pombredanne]

@hesa Thanks! I guess that's me wanting to put ReST everywhere :)

[pombredanne]

actually there is also a typo, not only the double colons! ... thanks!

[pombredanne]

BTW, in case you have not seen this, this is generated from the scancode license data https://scancode-licensedb.aboutcode.org/

[mjherzog]

@pombredanne @DennisClark
I have attached my suggested text for the separate Code, Data notices and Codebase notices.
For the Code and Data notices I have drafted a notice that is somewhat longer than Philippe's suggestion because I added a URL for license text. I considered using a LicenseDB URL, but decided that it would be better to reference the original author URL.
I also rewrote the text for the ScanCode GH and AboutCode.org URLs to be more clear about what information you can get from each.
For the combined notice:

• I restructured the top to mirror the other notices (and removed the legalese and disclaimer)
• Removed Scancode-LicenseRefs for other-permissive and other-copyleft because these are really just placeholders AND we already have and maintain detailed license info in ABOUT files.
• The last two sentences in Third-party software licenses section still need work - I cannot exactly parse the relationship we describe among binaries, archives and ABOUT files.

SCTK-Code-Notice-v1.0.txt
SCTK-Data-Notice-v1.0.txt
SCTK-Codebase-Notice-v1.0.txt

[DennisClark]

@mjherzog the texts look good to me! One minor thing in the Codebase one:

ScanCode data attribution
=====================
ScanCode includes datasets

The row of equal signs does not exactly line up with the title of the section -- but no big deal.

[tsteenbe]

@pombredanne Thumbs up for this change from my side, I did find it funny that you have a source code request text into the notice as above you provide the download URLs. Is this a requirement coming from one of the third party licenses?