Review dependency licenses
kawa-kokosowa opened this issue · comments
I think the time has come where we need to review the licenses used in dependencies for Hypatia.
I'm primarily thinking about Pygame, here is the license, I'm worried there may be some incompatibility with the Hypatia license http://www.pygame.org/LGPL i try to read this but then I 😪
I'd really like it if someone went through the licenses for our dependency and enumerated what's required of us for compliance. Some things to keep in mind:
- Hypatia will always have a permissive MIT-style-license.
- Hypatia will allow people to make commercial closed-source games
The big one is Pygame's license (LGPL-2.1). The website TL;DR Legal has a summary of the LGPL-2.1 license
Please report back with findings
Pygame LGPL-2.1
From https://tldrlegal.com/license/gnu-lesser-general-public-license-v2.1-(lgpl-2.1) it seems we must figure out:
- What exactly is sublicensing in this context, and how does it affect us, considering we want to use our
LICENSEand allow people to, for example, distribute closed-source, commercial games on Steam - "You must either include the original source code or link clearly to a way to obtain it." Okay, so does this mean that Hypatia need only link to Pygame's website, or does this mean that anyone who uses Hypatia will also need to link to Pygame somewhere? "Clearly", how apparent does the link have to be?
- "Include copyright: Describes whether the original copyright must be retained." Does this mean we need to keep the Pygame license handy somewhere in the repo? What implications does this have for commercial, closed-source game devs?
- "Disclose source: If the software is statically linked (i.e. compiled into) your work, you must release object code or source code such that the user can modify the library. If otherwise (dynamically linked), you must make the source for the library available." God, does this mean that everyone who uses Hypatia/pygame must release their source code and that closed source isn't allowed, or this solely concerning Pygame as the library in question or...
- "Include notice: Give prominent notice with each copy of your work that the LGPL'd software is being used. So we need to make the pygame license available and give "prominent notice" (WTF does that mean) that we're using Pygame?
Leaving the LGPL license aside, the other deps have other things to consider:
The BSD license (py-enum34) requires us to at least put the license somewhere (in docs and a credits thingy in the code, that's what Apple and Android do).
The PIL standard license (py-Pillow) says:
By obtaining, using, and/or copying this software and/or its associated documentation, you agree that you have read, understood, and will comply with the following terms and conditions:
Permission to use, copy, modify, and distribute this software and its associated documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appears in all copies, and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of Secret Labs AB or the author not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission.
Which is slightly different from the MIT license Hypatia uses. But it's the same thing, we put it in a credits section of the code and the docs, and we're fine.
Legal requirements aside, a "Credits" document is always a good idea anyway.
I was thinking more of like somewhere in an options menu in game there's a "credits" button that listed the licenses. But a credits document is good too.
Ah. Yeah an in-game credits is a good idea too, and in some situations legally required---watch the ending credits for a modern video game sometime, which I know 99% of people skip if possible, heh.
I have no problem with helping promote the software we depend on. :) Just as long as it doesn't feel intrusive to the user.
Pygame needs the attention honestly.
Status update? I'll increase the bounty later.