SPDX statement in appdata file does not match LICENSE

[nirs]

Gnome software reports Darktable license as Proprietary, since the appdata file
defines:

darktable/data/darktable.appdata.xml.in

Line 10 in 1dd4b36

<project_license>GPL-3.0+ AND GPL-2.0+ AND LGPL-2.0+ AND BSD-3-Clause AND MIT AND CC-BY-SA-1.0 AND CC-BY-2.5 AND CC-BY-NC-3.0</project_license>

and CC-BY-NC-3.0 is not an approved OSI or FSF free software license.

According to https://www.darktable.org/about/ and https://github.com/darktable-org/darktable/blob/master/LICENSE
the license is GPLv3.

The issue is described in
https://www.freedesktop.org/software/appstream/docs/chap-Metadata.html#tag-project_license

The license given in the project_license tag should be the ‘main’ license of the project. For a software project, this is typically the license for the code. It is not recommended to include the license for accompanying documentation (for example) in project_license, as that could confuse users. In particular, the CC-BY-SA-3.0 license which is commonly used for documentation is not an (FSF or OSI) approved license for free software, so including it in project_license results in the project as a whole being considered non-free.

Looking in https://spdx.github.io/spdx-spec/appendix-IV-SPDX-license-expressions/#1-disjunctive-or-operator
it seems that using OR will fix this issue.

See also gnome-software bug:
https://gitlab.gnome.org/GNOME/gnome-software/-/issues/1338

[ralfbrown]

My reading is that OR is used when the code as a whole can be distributed under any one of multiple licenses, not that various parts fall under different licenses. That becomes particularly clear in the following paragraph about the AND operator, which is for when one must abide by all of the provisions of both.

So it looks like project_license should state GPL-3.0+ as abiding by its terms would also satisfy the other code licenses (and I think the CC licences except -NC)

[github-actions]

This issue did not get any activity in the past 60 days and will be closed in 365 days if no update occurs. Please check if the master branch has fixed it and report again or close the issue.

[nirs]

@ralfbrown I agree that using GPL3 seems to be the best way to fix this issue.

[mcatanzaro]

I agree that simplifying the license field down to just GPL-3.0+ makes sense. You certainly shouldn't include documentation or content licenses there.

That said, I'm very nervous about seeing the CC-BY-NC-3.0. The NC licenses are banned from Fedora, and presumably most other major Linux distributions, due to the noncommercial use restriction. (As you can imagine, people like to use Fedora/Ubuntu/etc. for commercial purposes.) This is very serious and, if not corrected, could result in Darktable being removed from distros now that it's been noticed. However, I did a very quick search of the Darktable codebase, and I'm not actually sure that any content in Darktable really actually uses this license? I could easily have missed something, but the only obvious reference I found was in src/libs/metadata.c, which seems fine. So hopefully this is just a simple mistake, and updating the license tag is all that's required?

Note the other Creative Commons licenses (the non-NC ones) that you've listed are all fine for distros, even though they are not free software licenses. Distros simply do not expect all your content and documentation to meet FSF free software definitions. But GNOME Software does, which is why you don't want to list these in the appstream metadata.

[mcatanzaro]

Since nobody responded, I've reported this here.

[darix]

@TurboGit @aurelienpierre you might want to consider this as release critical. as this means that distros either have to strip the offending files or will drop DT all together.

[parafin]

right now it seems that offending file is .appdata.xml

[darix]

maybe the old manual was affected which is now split out?

that would also mean if the distros just drop the manual pdf, then we would be clean again.

[hanatos]

darktable$ grep CC-BY-NC -rn *
data/darktable.appdata.xml.in:10:  <project_license>GPL-3.0+ AND GPL-2.0+ AND LGPL-2.0+ AND BSD-3-Clause AND MIT AND CC-BY-SA-1.0 AND CC-BY-2.5 AND CC-BY-NC-3.0</project_license>
po/de.po:20456:msgstr "Creative Commons Namensnennung, nicht kommerziell (CC-BY-NC)"
po/de.po:20466:"Bedingungen (CC-BY-NC-SA)"
po/el.po:12992:msgstr "Creative Commons Attribution-NonCommercial (CC-BY-NC)"
po/el.po:13000:msgstr "Creative Commons Attribution-NonCommercial-ShareAlike (CC-BY-NC-SA)"
po/el.po:13008:msgstr "Creative Commons Attribution-NonCommercial-NoDerivs (CC-BY-NC-ND)"
po/ro.po:13287:msgstr "Creative Commons Attribution-NonCommercial (CC-BY-NC)"
po/ro.po:13296:msgstr "Creative Commons Attribution-NonCommercial-ShareAlike (CC-BY-NC-SA)"
po/ro.po:13305:msgstr "Creative Commons Attribution-NonCommercial-NoDerivs (CC-BY-NC-ND)"
po/fr.po:20437:"Pas d'utilisation commerciale (CC-BY-NC)"
po/fr.po:20449:"Partage des conditions initiales à l'identique (CC-BY-NC-SA)"
po/fr.po:20461:"Pas de modification (CC-BY-NC-ND)"
po/it.po:18901:msgstr "Attribuzione Creative Commons - Non commerciale (CC-BY-NC)"
po/it.po:18911:"(CC-BY-NC-SA)"
po/it.po:18920:"Attribuzione Creative Commons - Non commerciale - No opere derivate (CC-BY-NC-"
po/zh_CN.po:18581:msgstr "知识共享 署名-非商业性使用（CC-BY-NC）"
po/zh_CN.po:18589:msgstr "知识共享 署名-非商业性使用-相同方式共享（CC-BY-NC-SA）"
po/zh_CN.po:18597:msgstr "知识共享 署名-非商业性使用-禁止演绎（CC-BY-NC-ND）"
po/pt_BR.po:20277:msgstr "Creative Commons Attribution-NonCommercial (CC-BY-NC)"
po/pt_BR.po:20285:msgstr "Creative Commons Attribution-NonCommercial-ShareAlike (CC-BY-NC-SA)"
po/pt_BR.po:20293:msgstr "Creative Commons Attribution-NonCommercial-NoDerivs (CC-BY-NC-ND)"
po/sk.po:16796:"zakázané modifikovať (CC-BY-NC-ND)"

what about translations?

[ralfbrown]

watermarks/promo.svg seems to be labeled by-nc-3.0 in its XML. Didn't that come up in some other issue earlier this year?

Every other occurrence of "by-nc" in the repo is either one of the presets for the metadata module or the translation of the preset name in a .po file.

[darix]

what is the promo.svg used for? can we just drop it?

[kmilos]

Didn't that come up in some other issue earlier this year?

Indeed: #10002

[darix]

well he allows relicening the file in a comment. so we have many options just someone from the DT team needs to decide which way to go.

[parafin]

Removing it might break someone's edits.

[darix]

which begs the question ... what implications for the licensing of the photo edits using this file, the whole issue has? :D

[darix]

@MRIG so relicening the file as CC-BY-SA-3.0 or newer might be ok for you?

[mcatanzaro]

This is not fixed. Please refer back to the first post in this issue: you need to remove all content and documentation licenses from the appstream metadata, or the software is still going to be considered proprietary by software centers. Only list software licenses there. I recommend: <project_license>GPL-3.0+</project_license>

[darix]

can you explain why CC licenses cause problems?

because it would be kinda incorrect to not list the licenses for data files.

[mcatanzaro]

They're not software licenses. Please read the first post of this issue again. The documentation for the <project_license> tag says "don't do it," so that's why you shouldn't do it. :)

[darix]

I mean sure i can do a follow up PR that just removes the CC parts ... but it still feels wrong.

[darix]

As a follow up question ... are there any tools that would warn a software developer about this problem so it could be integrated in the testsuite and/or package build?

[mcatanzaro]

Really all I can do is refer you to the documentation:

The license given in the project_license tag should be the ‘main’ license of the project. For a software project, this is typically the license for the code. It is not recommended to include the license for accompanying documentation (for example) in project_license, as that could confuse users. In particular, the CC-BY-SA-3.0 license which is commonly used for documentation is not an (FSF or OSI) approved license for free software, so including it in project_license results in the project as a whole being considered non-free.

That's the same quote from the first comment in this issue.

The "main" license for Darktable is GPLv3+. You're not expected to list the licenses of every component file.

As a follow up question ... are there any tools that would warn a software developer about this problem so it could be integrated in the testsuite and/or package build?

I do not know, sorry. :(