Clarify (Decide?) License

I think it would be good to clarify under which License Briar Mailbox is published. Currently GitLab says: "No License. All Rights Reserved" Without a Free Software License it might not be Free Software (as per definition of the Free Software Foundation) in some countries. I could be missing something though.

changed the description

changed the description

Since the mailbox might be run on servers, too, I'd propose to use the AGPLv3 instead of Briar's usual GPLv3.

Since the mailbox might be run on servers, too, I'd propose to use the AGPLv3 instead of Briar's usual GPLv3.

I agree, I'd also like it to be distributed under the AGPLv3 preferably with the or-any-later-version exception. It is not up to me though as it is not my code.

changed milestone to %Mailbox

added Sponsor 6 label

added T: task label

Since the mailbox might be run on servers, too, I'd propose to use the AGPLv3 instead of Briar's usual GPLv3.

Sounds good to me. I think this is probably a decision for the board, and we should take into account whether any of the critical dependencies (database, HTTP server) would constrain our choice of licenses.

added Mailbox label

added Weight: 3 label

assigned to @grote

changed due date to December 13, 2021

I used the Gradle-License-Report plugin to get a list of all licenses that our dependencies currently use.

• mailbox-core: All use The Apache Software License, Version 2.0, exceptions:
  • com.h2database: MPL 2.0 or EPL 1.0
  • org.briarproject.jtorctl: BSD-3-clause
  • org.slf4j.slf4j-api: MIT
• mailbox-android: All use The Apache Software License, Version 2.0
• mailbox-cli: All use The Apache Software License, Version 2.0, exceptions:
  • ch.qos.logback.*: LGPL-2.1 or Eclipse Public License - v 1.0

So for license compatibility with AGPLv3, we need to consider the exceptions.

MPL 2.0

https://www.mozilla.org/en-US/MPL/2.0/Revision-FAQ/

MPL 2.0 contains explicit provisions for distribution alongside GPL- and LGPL-licensed code.

https://www.mozilla.org/en-US/MPL/2.0/

1.12.

“Secondary License” means either the GNU General Public License, Version 2.0, the GNU Lesser General Public License, Version 2.1, the GNU Affero General Public License, Version 3.0, or any later versions of those licenses.

3.3

permits You to additionally distribute such Covered Software under the terms of such Secondary License(s), so that the recipient of the Larger Work may, at their option, further distribute the Covered Software under the terms of either this License or such Secondary License(s).

Which reads to me as if we would need to publish under MPL-2.0 as well!?

Mozilla has a dedicated document about combining MPL-2.0 with GPL (without the A): https://www.mozilla.org/en-US/MPL/2.0/combining-mpl-and-gpl/

MPL's Section 3.3 allows distribution of the combined work (the "Larger Work") subject to the terms of both licenses, as long as certain conditions are met.

which again says "both licenses". However it reads on:

In the simplest case, the developer combines unmodified MPL-licensed files into a project with (L)GPL-licensed files to create a Larger Work, and seeks to distribute the resulting combination under the terms of the (L)GPL.

In this case, Section 3.3 of the MPL permits the individual files to be distributed as part of the Larger Work, with no further changes required. The developer may simply leave the file untouched, with all notices intact.

So maybe it is just about the license of the includes MPL files and not the license of the larger work itself? This would explain, why MPL-2 is typically considered "compatible" with (A)GPLv3.

EPL 1.0

Claimed to be incompatible with AGPL here: https://www.dyne.org/agpl-epl-licence-incompatibility/

However, we can use MPL 2.0 instead as this looks better and H2 is dual-licensed, so we can choose.

BSD-3-clause

Should be fine with AGPL.

MIT

Should be fine with AGPL.

LGPL-2.1

I couldn't really find official information on this specific subject, but considering it is a non-copyleft license from the same family, I'd hope it is fine to combine with AGPLv3.

---

So if the MPL issue does not force us to license the mailbox under MPL-2.0 as well, I think we can give it an AGPLv3-or-later license.

The MPL-2.0 issue seems to be cleared up by https://www.gnu.org/licenses/license-list.en.html#MPL-2.0

you may make a “Larger Work” that combines that work with work under those GNU licenses. When you do, section 3.3 gives you permission to distribute the MPL-covered work under the terms of the same GNU licenses, with one condition: you must make sure that the files that were originally under the MPL are still available under the MPL's terms as well.

So as suspected and hoped it is only important that the MPL files stay under MPL still.

mentioned in merge request !47 (merged)

added S: in code review label

mentioned in commit 5564fa15

closed with merge request !47 (merged)