[Cython] License information on each individual files

[Benjamin Lerman]

Hi,

I'm planning to use cython in chromium.

To be able to use cython as a third-party library, we need a license
header on every files in the project (because we are creating source
packages, and need to have clear licensing).

Would cython accept to add such a copyright header on its files?

Thanks in advance,

[Sturla Molden]

Post by Benjamin Lerman
Would cython accept to add such a copyright header on its files?

You want to display the Apache licence in every single file, even those
with utility C code?

Can't you do this in your own copy of Cython? I am quite sure the license
allows you to modify the source files (almost) however you like.

What do you do with other Python projects which do not put copyright
notices everywhere?

Have you considered to get rid of the lawyer who makes these stupid
requests?

Just asking...


Sturla

[Nathaniel Smith]

Post by Sturla Molden

Post by Benjamin Lerman
Would cython accept to add such a copyright header on its files?

You want to display the Apache licence in every single file, even those
with utility C code?

It's annoying, but a pretty standard request. Debian once made me do
this for some package or another (forget which) before they would
distribute it, though obviously that rule is inconsistently applied.
Still, it's pretty trivial and has real-world consequences, so why
reject a patch like this?

-n

[Robert Bradshaw]

Post by Nathaniel Smith

Post by Sturla Molden

Post by Benjamin Lerman
Would cython accept to add such a copyright header on its files?

You want to display the Apache licence in every single file, even those
with utility C code?

It's annoying, but a pretty standard request. Debian once made me do
this for some package or another (forget which) before they would
distribute it, though obviously that rule is inconsistently applied.
Still, it's pretty trivial and has real-world consequences, so why
reject a patch like this?

Debian currently distributes Cython without these headers.

I am curious why a licence in a top level directory that explicitly states
it applies to everything in that directory is not sufficiently clear. What
about auto-generated files? What about binary blobs? All 1000+ test files?

http://www.apache.org/dev/apply-license.html#copy-per-file

- Robert

[Nathaniel Smith]

Post by Robert Bradshaw

Post by Nathaniel Smith

Post by Sturla Molden

Post by Benjamin Lerman
Would cython accept to add such a copyright header on its files?

You want to display the Apache licence in every single file, even those
with utility C code?

It's annoying, but a pretty standard request. Debian once made me do
this for some package or another (forget which) before they would
distribute it, though obviously that rule is inconsistently applied.
Still, it's pretty trivial and has real-world consequences, so why
reject a patch like this?

Debian currently distributes Cython without these headers.

Yes, they're inconsistent, as I noted.

Post by Robert Bradshaw
I am curious why a licence in a top level directory that explicitly states
it applies to everything in that directory is not sufficiently clear. What
about auto-generated files? What about binary blobs? All 1000+ test files?
http://www.apache.org/dev/apply-license.html#copy-per-file

That link is about sticking a copy of the apache license text in every
file, this is about having a few line header saying "This is part of
Cython, copyright Cython devs, released under Apache-2, see LICENSE.txt for
details".

I'm just saying, you can argue about how chromium's lawyers ought to think,
or you can just say "whatever, patches welcome" and merge it if it arrives.
Your time is yours to spend as you wish :-) I was also very annoyed
initially when asked to do this, so thought I'd share my experience in case
it was useful.

-n

[Julian Taylor]

On Fri, Jul 18, 2014 at 10:13 PM, Sturla Molden

Post by Sturla Molden

Post by Benjamin Lerman
Would cython accept to add such a copyright header on its files?

You want to display the Apache licence in every single file,

even those

Post by Sturla Molden
with utility C code?

It's annoying, but a pretty standard request. Debian once made me do
this for some package or another (forget which) before they would
distribute it, though obviously that rule is inconsistently applied.
Still, it's pretty trivial and has real-world consequences, so why
reject a patch like this?
Debian currently distributes Cython without these headers.
Yes, they're inconsistent, as I noted.

It is inconsistent but still encouraged.
As a debian maintainer I much appreciate when the files all contain
copyright statements, it simplifies one of the most time consuming part
of packaging, making sure all the copyrights are in order.
Per file copyright headers allow automated tools to quickly classify a
source tree and make it easier to find the files that need more detailed
checking.

I am curious why a licence in a top level directory that explicitly
states it applies to everything in that directory is not
sufficiently clear. What about auto-generated files? What about
binary blobs? All 1000+ test files?
http://www.apache.org/dev/apply-license.html#copy-per-file
That link is about sticking a copy of the apache license text in every
file, this is about having a few line header saying "This is part of
Cython, copyright Cython devs, released under Apache-2, see LICENSE.txt
for details".

Yes you only need to include a short header not the full license.
The recommended header is in the APPENDIX section:
http://www.apache.org/licenses/LICENSE-2.0

[Robert Bradshaw]

Post by Nathaniel Smith

Post by Robert Bradshaw

Post by Nathaniel Smith

Post by Sturla Molden

Post by Benjamin Lerman
Would cython accept to add such a copyright header on its files?

You want to display the Apache licence in every single file, even those
with utility C code?

It's annoying, but a pretty standard request. Debian once made me do
this for some package or another (forget which) before they would
distribute it, though obviously that rule is inconsistently applied.
Still, it's pretty trivial and has real-world consequences, so why
reject a patch like this?

Debian currently distributes Cython without these headers.

Yes, they're inconsistent, as I noted.

Post by Robert Bradshaw
I am curious why a licence in a top level directory that explicitly
states it applies to everything in that directory is not sufficiently
clear. What about auto-generated files? What about binary blobs? All 1000+
test files?
http://www.apache.org/dev/apply-license.html#copy-per-file

That link is about sticking a copy of the apache license text in every
file, this is about having a few line header saying "This is part of
Cython, copyright Cython devs, released under Apache-2, see LICENSE.txt for
details".
I'm just saying, you can argue about how chromium's lawyers ought to
think, or you can just say "whatever, patches welcome" and merge it if it
arrives. Your time is yours to spend as you wish :-) I was also very
annoyed initially when asked to do this, so thought I'd share my experience
in case it was useful.

It's not just the initial patch; I'm primarily worried about the
maintenance burden. For example, either we require (and enforce) it on all
new files or you get into this inconsistent state where some files have a
statement and some don't, and it's unclear what the copyright implications
of this inconsistency is. And that's assuming we don't have to mess with
years, author lists, etc. (not clear what the request was).

There's plenty of precedent for not tagging every file (e.g. the linux
kernel).

- Robert

[Sturla Molden]

Post by Robert Bradshaw
It's not just the initial patch; I'm primarily worried about the
maintenance burden

And also, will it break utility code and binary blobs? It might not even be
safe to put it in every file.

And when put in files with utility C code, will it be included in the
generated .c file and taint this file with a notification about Cython's
Apache license?

Sturla

[Stefan Behnel]

Post by Sturla Molden

Post by Robert Bradshaw
It's not just the initial patch; I'm primarily worried about the
maintenance burden

And also, will it break utility code and binary blobs? It might not even be
safe to put it in every file.
And when put in files with utility C code, will it be included in the
generated .c file and taint this file with a notification about Cython's
Apache license?

Well, on the technical side, stuff at the beginning of a utility code file
should just be ignored, up to the first header line (starting with a
sequence of at least 5 comment characters). Some of them already contain
leading comments anyway.

On the legal side, the licensing state of the generated code does not
change by copying the license description from the global license file into
each code file, because the global license already applies to the complete
code base anyway (unless stated otherwise).

However, what *is* the licensing state of the generated code? Strictly
speaking, the code generated by Cython, all parts of which are embedded in
Cython's own source code, could be considered a "derivative work" by some.
The Apache license states this regarding "redistribution of derivative works":


"""
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:

(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and

(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and

(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and

(d) If the Work includes a "NOTICE" text file as part of its
distribution, [does not apply].

You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
"""

There was an official statement of the core devs back in 2007 that the
generated code is free of restrictions, but it was based on the Python
License at the time and I also don't think it's expressed in the code base
anywhere.

http://thread.gmane.org/gmane.comp.python.cython.devel/117

http://article.gmane.org/gmane.comp.python.cython.devel/122

Post by Sturla Molden
From my side, that statement definitely still applies. I really don't want

to have anything to say on what users do with the code generated from their
own source code. I do not even consider the generated code a "derivative
work" myself, but IANAL...

Anyway, as far as I understand it, the worst case is that people who ship
Cython generated code have to add a copy of the Apache License to their
package as well as any attribution notices we ship. That's annoying, but
not really the end of the world.

Also, utility code files could be exempt from the license explicitly by
stating so (although they'd then need another license to allow for safe
contributions to them). AFAICT, there were some twenty people or so who
ever contributed to the Cython/Utility directory and less than ten people
who ever changed or added a notable amount of code in them. That might be
worth it, given that it's difficult enough to argue that the rest of the
generated code, which gets created (and substantially modified along the
way) from tiny snippets in another code base (so tiny that none of them
could ever be considered a protectable piece of work by itself) falls under
any "derivative work" licensing terms at all. And any substantial (i.e.
protectable) portion of these snippets was written by one of seven people
or so.

Therefore, adding the license header explicitly to all files that really
fall under that license, and exclude the utility code files while doing so,
actually sounds like a good idea.


Stefan

[Nathaniel Smith]

Received: from localhost (HELO mail.python.org) (127.0.0.1)
by albatross.python.org with SMTP; 19 Jul 2014 19:42:28 +0200
Received: from mail-oa0-f54.google.com (unknown [209.85.219.54])
(using TLSv1 with cipher ECDHE-RSA-AES128-SHA (128/128 bits))
(No client certificate requested)
by mail.python.org (Postfix) with ESMTPS
for <cython-devel-+ZN9ApsXKcEdnm+***@public.gmane.org>; Sat, 19 Jul 2014 19:42:27 +0200 (CEST)
Received: by mail-oa0-f54.google.com with SMTP id n16so5189219oag.41
for <cython-devel-+ZN9ApsXKcEdnm+***@public.gmane.org>; Sat, 19 Jul 2014 10:42:21 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=x-gm-message-state:mime-version:sender:in-reply-to:references:date
:message-id:subject:from:to:content-type;
bh=s9Em33YfY7h9XuKb+8FZIJVX9eheJ+Jp0X+80vuMiVU=;
b=gzJ/33t2m8Mco8wz6cH7GeieT3ajAh3Zg4S8ianRIg7u75rOLm6rRqgtJm00reTLoZ
Sb6yEYRLHpRaz46KA+l4u3q58BhLx4JATOPIlv5/1QESw5yosgfiJvNOpZ2Rk4jWTx+/
Nr8JjfVHtb1QRnE6jhRWZxkAYKg9/YG/3P1vmvQZr7ezquTmcUwtAQZz6ShxQkEry65Q
ZCWWNtNiT7nox7bsUmwS99+lpFhoejbwmzRnDKnBIvDrwVFe9mkNFxNniXZVpAhexpe4
M30AcqnqTXBmPCEyJ1kfh2j0J8wkElE6eVLQoylfGQi+g9PetYOrQ3QbG0JEc2WoIgwX
2A4w==
X-Gm-Message-State: ALoCoQnYYo8+plRMkZpA/GF4Dl3X3tkCLE4QJQhS4NaR1KR+hIlSpTbaf0M0OcCV0/y4Fvluqub3
X-Received: by 10.60.158.41 with SMTP id wr9mr19384898oeb.46.1405791740965;
Sat, 19 Jul 2014 10:42:20 -0700 (PDT)
Received: by 10.60.35.35 with HTTP; Sat, 19 Jul 2014 10:42:20 -0700 (PDT)
In-Reply-To: <53CA12A8.5020606-KjMAwuNBv5izQB+***@public.gmane.org>
X-Google-Sender-Auth: NcjDg8mclXPRkqDV_K5Mgdm8o9Q
X-BeenThere: cython-devel-+ZN9ApsXKcEdnm+***@public.gmane.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Core developer mailing list of the Cython compiler
<cython-devel.python.org>
List-Unsubscribe: <https://mail.python.org/mailman/options/cython-devel>,
<mailto:cython-devel-request-+ZN9ApsXKcEdnm+***@public.gmane.org?subject=unsubscribe>
List-Archive: <http://mail.python.org/pipermail/cython-devel/>
List-Post: <mailto:cython-devel-+ZN9ApsXKcEdnm+***@public.gmane.org>
List-Help: <mailto:cython-devel-request-+ZN9ApsXKcEdnm+***@public.gmane.org?subject=help>
List-Subscribe: <https://mail.python.org/mailman/listinfo/cython-devel>,
<mailto:cython-devel-request-+ZN9ApsXKcEdnm+***@public.gmane.org?subject=subscribe>
Errors-To: cython-devel-bounces+gcpc-cython-dev-2=m.gmane.org-+ZN9ApsXKcEdnm+***@public.gmane.org
Sender: "cython-devel"
<cython-devel-bounces+gcpc-cython-dev-2=m.gmane.org-+ZN9ApsXKcEdnm+***@public.gmane.org>
Archived-At: <http://permalink.gmane.org/gmane.comp.python.cython.devel/15318>

Post by Stefan Behnel

Post by Sturla Molden

Post by Robert Bradshaw
It's not just the initial patch; I'm primarily worried about the
maintenance burden

And also, will it break utility code and binary blobs? It might not even be
safe to put it in every file.
And when put in files with utility C code, will it be included in the
generated .c file and taint this file with a notification about Cython's
Apache license?

Well, on the technical side, stuff at the beginning of a utility code file
should just be ignored, up to the first header line (starting with a
sequence of at least 5 comment characters). Some of them already contain
leading comments anyway.
On the legal side, the licensing state of the generated code does not
change by copying the license description from the global license file into
each code file, because the global license already applies to the complete
code base anyway (unless stated otherwise).
However, what *is* the licensing state of the generated code? Strictly
speaking, the code generated by Cython, all parts of which are embedded in
Cython's own source code, could be considered a "derivative work" by some.

I suspect that "some" includes most lawyers and judges ;-). There's
tons of copyrightable code copied into Cython output.

[...]

Post by Stefan Behnel
From my side, that statement definitely still applies. I really don't want
to have anything to say on what users do with the code generated from their
own source code. I do not even consider the generated code a "derivative
work" myself, but IANAL...
Anyway, as far as I understand it, the worst case is that people who ship
Cython generated code have to add a copy of the Apache License to their
package as well as any attribution notices we ship. That's annoying, but
not really the end of the world.

No, the worst case is that GPL2 projects can't legally use code
written in Cython (perhaps even indirectly via other projects) :-(.
This might be okay because of the language in the GPL that's designed
to make it possible to write e.g. GPL'ed Win32 programs, but I'm not
at all sure.

Post by Stefan Behnel
Also, utility code files could be exempt from the license explicitly by
stating so (although they'd then need another license to allow for safe
contributions to them).

There's substantial prior art for this kind of thing, see e.g. the GCC
runtime exception, the Classpath exception, etc.

You might want to send an email to help-rbQqYLFhARYurNyw8EiOWEB+***@public.gmane.org describing
the situation and asking for advice. (See
https://www.softwarefreedom.org/about/contact/)

-n

[Stefan Behnel]

Post by Nathaniel Smith

Post by Stefan Behnel

Post by Sturla Molden

Post by Robert Bradshaw
It's not just the initial patch; I'm primarily worried about the
maintenance burden

And also, will it break utility code and binary blobs? It might not even be
safe to put it in every file.
And when put in files with utility C code, will it be included in the
generated .c file and taint this file with a notification about Cython's
Apache license?

Well, on the technical side, stuff at the beginning of a utility code file
should just be ignored, up to the first header line (starting with a
sequence of at least 5 comment characters). Some of them already contain
leading comments anyway.
On the legal side, the licensing state of the generated code does not
change by copying the license description from the global license file into
each code file, because the global license already applies to the complete
code base anyway (unless stated otherwise).
However, what *is* the licensing state of the generated code? Strictly
speaking, the code generated by Cython, all parts of which are embedded in
Cython's own source code, could be considered a "derivative work" by some.

I suspect that "some" includes most lawyers and judges ;-). There's
tons of copyrightable code copied into Cython output.

The bulk of what gets "copied" are really just tiny character sequences
each of which would be impossible to protect legally. And they even get
substantially modified before being written out. But there's probably still
plenty of room for lawyers to sell days of work here, and the utility code
files form a major piece of work by themselves that gets copied into the
generated code in substantial (i.e. protectable) chunks.

Post by Nathaniel Smith

Post by Stefan Behnel
From my side, that statement definitely still applies. I really don't want
to have anything to say on what users do with the code generated from their
own source code. I do not even consider the generated code a "derivative
work" myself, but IANAL...
Anyway, as far as I understand it, the worst case is that people who ship
Cython generated code have to add a copy of the Apache License to their
package as well as any attribution notices we ship. That's annoying, but
not really the end of the world.

No, the worst case is that GPL2 projects can't legally use code
written in Cython (perhaps even indirectly via other projects) :-(.

Interesting:

https://www.apache.org/licenses/GPL-compatibility.html

I wasn't aware of that problem, but now that I read about it, it's not
really a surprise.

Post by Nathaniel Smith

Post by Stefan Behnel
Also, utility code files could be exempt from the license explicitly by
stating so (although they'd then need another license to allow for safe
contributions to them).

There's substantial prior art for this kind of thing, see e.g. the GCC
runtime exception, the Classpath exception, etc.
the situation and asking for advice. (See
https://www.softwarefreedom.org/about/contact/)

Thanks for the pointer. Since it's a legal issue, it's usually best to
leave it to those who know their way around in that well minded area.

Stefan

[Robert Bradshaw]

Post by Stefan Behnel

Post by Nathaniel Smith

Post by Stefan Behnel

Post by Sturla Molden

Post by Robert Bradshaw
It's not just the initial patch; I'm primarily worried about the
maintenance burden

And also, will it break utility code and binary blobs? It might not even be
safe to put it in every file.
And when put in files with utility C code, will it be included in the
generated .c file and taint this file with a notification about Cython's
Apache license?

Well, on the technical side, stuff at the beginning of a utility code file
should just be ignored, up to the first header line (starting with a
sequence of at least 5 comment characters). Some of them already contain
leading comments anyway.
On the legal side, the licensing state of the generated code does not
change by copying the license description from the global license file into
each code file, because the global license already applies to the complete
code base anyway (unless stated otherwise).
However, what *is* the licensing state of the generated code? Strictly
speaking, the code generated by Cython, all parts of which are embedded in
Cython's own source code, could be considered a "derivative work" by some.

I suspect that "some" includes most lawyers and judges ;-). There's
tons of copyrightable code copied into Cython output.

The bulk of what gets "copied" are really just tiny character sequences
each of which would be impossible to protect legally. And they even get
substantially modified before being written out. But there's probably still
plenty of room for lawyers to sell days of work here, and the utility code
files form a major piece of work by themselves that gets copied into the
generated code in substantial (i.e. protectable) chunks.

Agreed, but if someone wrote a new Python-to-C compiler and grabbed
all our UtilityCodes to do so that would IMHO constitute a derivative
work.

Post by Stefan Behnel

Post by Nathaniel Smith

Post by Stefan Behnel
From my side, that statement definitely still applies. I really don't want
to have anything to say on what users do with the code generated from their
own source code. I do not even consider the generated code a "derivative
work" myself, but IANAL...

Yep. That's been the position every time the topic has come up, and
has been on our wiki for quite a while. I've clarified it here:

https://github.com/cython/cython/pull/306