7:17 p.m.
Hi Niels,
Thanks for the list! It's nice to see that the license situation is actually pretty
clear.
* License compatibility wise, we are doing well: all idpy related software is apache2
licensed, and we do not seem to have dependencies that outright conflict that license,
apart from "chardet" which is LGPL licenced. (I used this a a baseline:
https://www.apache.org/legal/resolved.html) While I do not think any of us have the
ambition to sell SaToSa as a product directly, I was wondering if we should replace this
with an alternative with a more suitable license.
Actually, I think the LGPL (in contrast the the regular GPL) is fine in this case, as long
as we're using the library in unmodified form. The LGPL inly imposes GPL-like copyleft
restrictions on modification of the library itself, whereas other programs that merely use
the library as-is can do so under BSD-like conditions.
* Given the long list of dependencies, I must say I was wondering if we do not have a
little cleaning up to do.
Indeed!
* For the idpy related software I note the copyright statements seem to be missing or
incomplete: I know for sure Roland has been working on several components, but I suspect
he has been doing so with multiple hats on. However I e.g. do not see either GEANT
project, UMEA or NORDUnet copyright reflected, while I do see commits from GEANT project
members in the git history. I am wondering if we should rectify this, especially in the
light of the EU's sensitivity to being able to see what their money was used for (we
have had questions on that in previous EC reviews of the GEANT project). I could also
image a similar sentiment with some of the NRENs and companies that contributed?
I think the same holds for any SURFnet-contributions to the code (I'm not entirely up
to date as to which of Martin's patches have been merged): we would very much
appreciate explicit copyright or attribution statements. We would also be happy discuss a
contributor license agreement, if you would like that.
Greetings,
Bas.
--
Niels van Dijk Technical Product Manager Trust & Security
Mob: +31 651347657 | Skype: cdr-80 | PGP Key ID: 0xDE7BB2F5
SURFnet BV | PO.Box 19035 | NL-3501 DA Utrecht | The Netherlands
www.surfnet.nl<http://www.surfnet.nl>
www.openconext.org<http://www.openconext.org>
_______________________________________________
Idpy-discuss mailing list
Idpy-discuss at lists.sunet.se<mailto:Idpy-discuss at lists.sunet.se>
https://lists.sunet.se/listinfo/idpy-discuss