regex-syntax: Does the Unicode license need to be reflected in Cargo.toml metadata?

[decathorpe]

I noticed that the regex-syntax crate includes code that's derived from Unicode data, and also includes the Unicode-DFS-2016 license text - but the license string in the crate metadata doesn't reflect this fact. Looking at other crates that contain code derived from unicode data, it looks like most of them have either recently added "AND Unicode-DFS-2016" to their license string, or were asked to do so, with the issue still open:

• Explain Unicode license agreement dtolnay/unicode-ident#9
• Ensure crate abides by the Unicode Data Files and Software License BurntSushi/bstr#129
• Add Unicode license. unicode-rs/unicode-xid#32
• bidi: update license tag to match the actual license wezterm/wezterm#2340

It looks like a similar change was discussed when the license terms for Unicode-DFS-2016 were added in this PR:
#535

But the conclusion was that "MIT OR Apache-2.0 OR Unicode-DFS-2016" would be wrong (which it is), not that it should probably be "(MIT OR Apache-2.0) AND Unicode-DFS-2016".

[BurntSushi]

My answer in the bstr issue remains my answer, as nothing has changed that I'm aware of: BurntSushi/bstr#129 (comment)

[decathorpe]

I wonder, does the "package.license" key in Cargo.toml needs to reflect the license of the entirety of a crate's contents? You could probably argue both ways, but as far as I understand it, if the crate's source code has portions that are licensed under the terms of the Unicode license agreement, you can't get around adding it to the crate's license specifier.

Coming from a linux distribution packaging background myself, that's the way package licenses are treated: They need to reflect all contents of the package, even if the project would like to "pretend" that some parts of their code isn't covered by different license terms than the ones they chose.

Even if you don't think the license specifier needs to be updated in this project (i.e. the regex-syntax/Cargo.toml file), I'll probably need to make sure the Fedora Linux package for the regex-syntax crate carries the complete license information (i.e. (MIT OR Apache-2.0) AND Unicode-DFS-2016), as that's based on both Fedora Linux rules and updated rules worked on by Red Hat Legal.

[BurntSushi]

I think you need to take this up with the Rust project itself.

[BurntSushi]

Unicode data pervades pretty much everything. So I expect you'll be needing to add such notices to almost every package, nevermind just Rust projects, if this is indeed the policy you're pursuing.

[decathorpe]

It's not my policy, but the policy Red Hat legal asked any package maintainer in Fedora Linux to follow. I'll forward this question to them.

[BurntSushi]

It looks like there is also an open issue for Rust itself: rust-lang/rust#98116

[c-git]

I followed up with the Rust Foundation and put a excerpt from their response in rust-lang/rust#98116 (comment)