Crate declares incorrect Apache/MIT license

[brson]

The source code in this crate is derivative of LLVM's compiler-rt, the license of which is declared correctly in LICENSE.TXT, but not in Cargo.toml, and is the NCSA license (similar to BSD).

Cargo.toml needs to be updated to declare the NCSA license, and then the Rust tidy file in deps.rs to declare it as either an exception or an acceptable permissive license.

Note that LLVM is in the process of relicensing to add a runtime exception to its code (which Rust lacks), and this crate will not obviously benefit from that relicensing since it was derived prior to the relicense.

cc rust-lang/rust#63232

[brson]

This crate also includes a Rust port of MUSL's libm: https://github.com/rust-lang-nursery/libm, which also seems to incorrectly be described as Apache/MIT.

[brson]

libm issue: rust-lang/libm#215

[brson]

Oh, actually, compiler-rt is NCSA/MIT, so this crate can declare just "MIT" or "MIT/NCSA" or "MIT or NCSA". It just can't add the option of alternately distributing under the apache license (I think).

[mati865]

LLVM has been relicensed to Apache 2.0 with LLVM exception.

[infinity0]

Please ignore my previous comments, I think they are obsolete and I have deleted them.

As I understand it, the files in src/** are all rust translations that do not appear in the original compiler-rt work, therefore it is a derivative work, which has been authorised by the license of compiler-rt at the time of derivation. Since it is a derivative work, the new copyright holders are free to chose a license for it, according to the restrictions of the original work (in this case there are no restrictions, either in NCSA/MIT/Apache), it does not have to be a copy of the old license. So it is fine to relicense as Apache/MIT.

[infinity0]

However, you should then remove all references to the compiler-rt licenses for clarity. Or perhaps include them for reference, but make it clear that it is the license of compiler-rt an external project, and not the license of this project.

TL; DR - the presence of LICENSE.TXT is confusing, either delete it or move the contents into README.md under a section called "history of the project" and "for reference, this is the old license of compiler-rt".

[silwol]

For the record, the Debian package got uploaded some time ago with a description of the copyright situation explained, and now was rejected by our FTP-Masters team again.

[silwol]

I took a look at the LICENSE.TXT file, and it includes hints to the CREDITS.TXT file, which is not present in this project, but in compiler-rt. Even if the license file distribution was fixed as suggested by MR #343, this would probably be rejected by our FTP-Masters team, so I think it would in fact be better to move the information into README.md as suggested by @infinity0.

[infinity0]

In case people can't be bothered reading the previous links, the TL;DR from the Debian copyright reviewers is that

• it's OK for the rust parts of the code to have a completely new license (in this case Apache/MIT), since it is a translation and the copyright holders of the original do not have copyright on the translation, as long as the relicensing is not prevented by the old license (and it is not, in this case)
• however, some comments are copied verbatim from the original, and so the original copyright holders have (retain) copyright on that, with the original license (a custom Sun license).

Makes sense to me, though ofc none of us are lawyers.

[Lokathor]

So to be extra clear, if we remove the comments but don't change the code at all that would be sufficient to use the standard MIT/Apache of other rust crates?

[infinity0]

That would be consistent with the position as I understand it of the Debian copyright reviewers, yes.

[silwol]

Is there anything we as debian-rust can do to support progress here? This is one of a few serious issues that have stalled the packaging efforts of Rust crates inside Debian nearly down to zero, and I would love to get it resolved.