Licence for tool source
frasertweedale opened this issue · comments
SPDX does not offer a general "public domain" declaration, and the concept of "public domain"
is legally problematic. See https://wiki.spdx.org/view/Legal_Team/Decisions/Dealing_with_Public_Domain_within_SPDX_Files
for an overview of the issues.
Therefore we should consider choosing a copyright licence for the tool source code. Most or all of our
current dependencies use BSD-3-Clause.
The advisories themselves can remain public domain.
Public domain is indeed problematic. For instance, it doesn't exist at all in some jurisdictions.
Isn't this what CC0 is created to address?
Here is some commentary on using CC0 for software:
- https://creativecommons.org/2011/04/15/using-cc0-for-public-domain-software/
- https://www.gnu.org/licenses/license-list.html#CC0
I'm comfortable with CC0. And so far you are the only author, so I guess CC0 it is :)
We can confirm it at the next meeting.
Well, the work is owned by my employer, the Haskell Foundation :-)
Putting on my HF ED hat, I think that either a BSD-style or CC0 is best. Let me puzzle a bit more over it - I want to weigh the surprise factor against the minimal additional liberality.
Google apparently does not like contributing to projects using CC0.
Decision: BSD-3-Clause
TODO:
- We need to clearly communicate to those who submit proofs of concept, vulnerability descriptions, etc that it'll be CC0
- The code license needs to be clear in the repo, as well as its separation from the content license