Re: Fwd: Musing: Convenience binaries and binary-only licenses

[Shane Curcuru <as...@shanecurcuru.org>]

Roman Shaposhnik wrote on 2/25/19 9:04 AM:
> On Mon, Feb 25, 2019 at 12:23 AM Hen <ba...@apache.org> wrote:
>> On Sun, Feb 24, 2019 at 1:03 PM Roman Shaposhnik <ro...@shaposhnik.org> wrote:
>>> On Sun, Feb 24, 2019 at 9:23 PM Hen <ba...@apache.org> wrote:
...snip...
>> I'm leaning (logic-wise) to the notion that Category B = Okay in Convenience Binaries, and that the field of use and binary only third party licenses would be fine in Convenience Binaries. Effectively that a convenience binary cares about whether we can distribute it, and whether it forces a undesired burden on the user, not whether it obeys OSD or places a burden on the user that they might be quite fine about. For example, including BCL in a Convenience Binary might be fine.
> 
> This is where the schizophrenic nature of our convenience binaries
> really kicks in. The trigger word for me is "user". Because there are
> two different user personas that have very different expectations on
> the IP management side of these binaries:
>     #1 a true end user using the binary as-is (e.g. somebody running a
> docker container or using a binary tarball)
>     #2 a downstream developer building a bigger product (e.g. somebody
> fetching ASF jars from from Maven central)
> 
> With category #1 I'm going to complete agree with your leaning. For
> Category #2 -- not so much.
> 
> Makes sense?

Yes, it does, especially when you look through the question from
different factors.

- We are a public charity.  Many "end" users simply want software at no
cost that does useful work.  Often, these people (or, typically, IT
staff at a company) simply download, configure, and run software.  They
may apply patches, but primarily focused internally.  Thus having
Category B code in the binary they're running or modifying for their own
use is not an issue.

However, many of these end users aren't sophisticated enough (in terms
of larger company processes) to be actively looking for and tracking
these Category B bits *if* they then decide to redistribute something on
top of it.

- We are community-led projects.  Developers who are *planning* to build
a product atop our code (with Category B binaries inside) *might* well
get tripped up by extra licensing concerns.  However typically if
they're technically adept enough (both engineering-wise and company
process-wise) to open up the Category B bits and modify them, then they
more likely have the organizational processes to understand the extra
license conditions they're unpacking when then unpack the Cat B bits.

I'm not quite sure how we should optimize our policies and recommended
practices for our projects.  On the other hand, since convenience
binaries aren't official ASF releases, how much does it matter?  8-/

-- 

- Shane
  Director & Member
  The Apache Software Foundation

---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org