License requirements for plugins on plugins.qgis.org

[Xpirix]

QGIS Enhancement: License requirements for plugins on plugins.qgis.org

Date 2023/11/27

Author Lova Andriarimalala (@Xpirix)

Contact lova@kartoza.com

For QGIS Plugins Website

Summary

The current QEP is a synthesis of this discussion in the QGIS Developers mailing list.
This is the setting up of a validator that makes license file as required in a plugin package according to the issue #38 in the QGIS-Django repository. I've opened a pull request about this issue here and it was merged and deployed. However, making the license file as required is a breaking change that impacts the plugin upload/update workflow. It needs then a discussion with the community.

Proposed Solution

Please find below the proposed solution according to the suggestions in the mailing list, in the issue #38 and this PR:

1. For now, a license file should be recommended. When missing, it should generate a non-blocking warning either on new or existing plugins. I'll be creating a documented PR  for this fix shortly.
2. Implement licensing requirements on schedule: important steps like documentation updates, communication with the community, and non-blocking warnings (1)... should be considered first.
3. Add a license field into the metadata.txt: IDS value should be from a common list. The suggestions for the IDS value list provider are:  (a) https://spdx.org/licenses/, (b) Use PyPi classifiers and include tooling to check it. As @timlinux said, this is probably a job for another QEP.

Example(s)

Please find below a screenshot of the warning when uploading or updating a plugin package that doesn't contain a license file:

Affected Files

• qgis-app/plugins/forms.py
• qgis-app/plugins/tests/test_validator.py
• qgis-app/plugins/validator.py
• qgis-app/plugins/views.py

Issue Tracking ID(s)

• Plugin licence #38

Votes

(required)

[Xpirix]

Hello everyone,

I've created a new PR here as mentioned in this QEP.

Best regards.

[timlinux]

Just a note that Julien suggested: "+1 for the metadata field with a spdx license. But take care, it's not so easy to a have an exhaustive list. Maybe we should move to the PyPi classifiers since plugins are Python packages and there is already a work on maintaining a metadata ecosystem, including tooling to check it (pip install packaging)."

[timlinux]

@Xpirix maybe we can go a little further and make this a soft requirement for now, but advertise that it will become a hard requirement in the future. This could be done with an amendment to your message:

"Please note that as of 1 June 2024, providing a license file will be mandatory for any new updates to existing plugins and for any new plugins published."

We could also add a notification system to the plugins home page that provides any topical news such as the above to users visiting the site.

[Xpirix]

"Please note that as of 1 June 2024, providing a license file will be mandatory for any new updates to existing plugins and for any new plugins published."

@timlinux Thank you. I will modify the PR with this message.

We could also add a notification system to the plugins home page that provides any topical news such as the above to users visiting the site.

In my understanding, it is something like the QGIS Feed homepage, but with a simpler design. So we can manage this system on the administration page and show the notification on the plugins home page according to a date range (start_date and expiration_date).

[Xpirix]

Hello everyone,

The PR regarding the soft requirements (non-blocking warning) for the plugin license is now merged and deployed.

Best regards.

[timlinux]

For some background reading (tangenital)

https://blog.qgis.org/2016/05/29/licensing-requirements-for-qgis-plugins/

[m-kuhn]

Thank you so much for writing this !
Making this a soft requirement for now is certainly a good way and an announced time to switch (6-12 months) to enforcing this is good.

I still see a lot of mentions of the license file in the proposal and the discussion. Do we strictly want to require this file or is it considered to keep the file optional and to only make the metadata addition required?

I personally do not have a preference between pypi classifier as suggested by @troopa81 or spdx license.

[Guts]

Ups I've totally missed this QEP! Sorry for that 😞.

Well I would have some thoughts but it's too late, now. Good work!