[CXX-899] Update documentation of third-party licenses Created: 20/Apr/16  Updated: 21/Jun/16  Resolved: 27/May/16

Status: Closed
Project: C++ Driver
Component/s: None
Affects Version/s: None
Fix Version/s: legacy-1.1.2

Type: Bug Priority: Major - P3
Reporter: Giulio Paci Assignee: David Golden
Resolution: Done Votes: 0
Labels: legacy-cxx
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified


 Description   

Despite claiming to be release under Apache 2.0, this project includes code released under several other licenses.

  • custom license: src/mongo/util/scopeguard.h
    The license requires that the copyright notice and the permission notice "appear in supporting documentation". This is currently not the case. I suggest adding a COPYING file with all the licenses used and add that file to the documentation;
  • Affero GPL-3 with OpenSSL exception: src/mongo/base/compare_numbers.h
    If possible I suggest changing the license of this file to Apache 2.0. As I understand the license, including this file means that the project as a whole is released under Affero GPL-3;
  • public domain: src/third_party/tz/* src/third_party/murmurhash3/*
    If possible copyright owner should be contacted so that an alternative license is proposed. As far as I know "public domain" is not recognised in all the countries, and thus you maybe using software without any license there;
  • Zlib + not unclaimed changes: src/mongo/util/md5.*
    I guess these should be considered to be released under Apache 2.0, or Zlib, but an explicit note will benefit everybody;
  • Expat: src/third_party/restclient/*;
  • BSD-3-clause: src/third_party/gtest-1.7.0/*;
  • Public domain or Expat: src/third_party/jsoncpp/


 Comments   
Comment by Githook User [ 27/May/16 ]

Author:

{u'username': u'xdg', u'name': u'David Golden', u'email': u'xdg@xdg.me'}

Message: CXX-899 Update license information

This changes compare_numbers.h to the Apache 2 license for consistency
with the rest of the distribution.

All other third-party licenses have been consolidated into top-level
THIRD-PARTY-NOTICES file for better visibility.
Branch: legacy
https://github.com/mongodb/mongo-cxx-driver/commit/282861222446187a9fa4a38b7a141291810739b3

Comment by Giulio Paci [ 21/Apr/16 ]

Hi, thank you for your comment.
I currently do not have any big concerns about the above issues, as I am using this library only in an Affero GPL-3 licensed project (so having Affero GPL-3 files is not an issue for me). Expat and Zlib do allows to be used. I have already added a notice about the fact that scopeguard.h is used and about its license.

I am not sure how big is the issue about "Public Domain". I live in a country that is probably affected by some of the issues (for example in my country it is not possible to alienate the moral right to claim that you wrote the software in the first place), but I do not know if there are any other issues. Moreover I think it is unlikely that developers publishing code under Public Domain are then going to sue anybody for unlicensed usage of their software (unless they have planned to do so from the beginning, but this seems even more unlikely).

Zlib and md5: it is just a matter of you explicitly say which license you are going to use for your changes. I personally tend to release my changes with the same license of the software I am changing (or dual licensing them, especially if I think the original license is too restrictive).

Comment by Andrew Morrow (Inactive) [ 20/Apr/16 ]

Thanks for reporting these issues. I'll comment on a few of them here:

  • scopeguard.h: We can definitely add a COPYING file.
  • compare_numbers.h: This was a new file that came in from backport from the upstream server sources, and was not edited appropriately. We can easily change it.
  • public domain: I will need to look into what we should do here.
  • Zlib and md5: I will need to look into these more closely.

The remaining components are not actually used by the driver - only by the tests.

In general, the licensing situation for the legacy C++ driver is considerably muddled by its provenance - it derives from the MongoDB server sources.

If you have concerns about the above issues, I strongly recommend that you migrate to using the new C++11 driver if at all possible. It should be clear of the sort of issues you have identified above. We may need to add a COPYING file there for MNMLSTC and/or catch, but that should be it.

Generated at Wed Feb 07 22:00:43 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.