Clearing up project licensing

[FranciscoPombal]

Currently, some important aspects about qBittorrent's licensing are not as clear as they should be. We must resolve this in order to ensure we can continue working smoothly with external dependencies such as Qt without any licensing troubles or ambiguities.

Additional context: refer to the discussion about licensing brought up in #14452.

Here is the proposed solution; further explanatory notes about each step are detailed further down.

Steps to clear up the current licensing

• 1. Verify that all source files have included the "GPLv2 or later" license header from the very beginning, and that there was no COPYING or similar file introduced before all other source files that contradicts the "GPLv2 or later" licensing . This is a necessary prerequisite for all of the following steps.

• 2. Add a LICENSE.txt file to the top-level with the following contents:

  one line to give the program's name and an idea of what it does.
  Copyright (C) yyyy  name of author
  
  This program is free software; you can redistribute it and/or
  modify it under the terms of the GNU General Public License
  as published by the Free Software Foundation; either version 2
  of the License, or (at your option) any later version.
  
  This program is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  GNU General Public License for more details.
  
  You should have received a copy of the GNU General Public License
  along with this program; if not, write to the Free Software
  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

  Where one line to give the program's name and an idea of what it does. should be replaced by qBittorrent - a BitTorrent client, name of author by the qBittorrent project contributors and yyyy by the current year (the latter should obviously be updated periodically).

• 3. Figure out if anything related to OpenSSL licensing needs to be appended(or prepended?) to this LICENSE.txt file, and do that if it's needed.

• 4. Delete the license-related headers in each source file.

Notes about each step

1. _
   • For anyone willing to tackle this, here is a proposed method:
     • Start at any recent master commit, and record the commit hash.
     • Scan the git history of each file creation/deletion/rename, and note whether or not the files included the "GPLv2 or later" license header on their creation.
     • Create a list/table with results for each file
     • Note if the COPYING or similar licensing related files were introduced before or after any source file with the "GPLv2 or later" license header. This is important because the current COPYING file implies GPLv2 only. If it was introduced before anything else, I think we're screwed. If not, then it amounts to an invalid license change anyway, so we're good.
   • If we fail this step, then the whole effort to clear up the project's licensing and make sure that there is no problem with using Qt and migrating to Qt6 can become significantly more complex, and we'll need to reevaluate our options.
2. _
   • The template is copied verbatim from https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html. All that's required to correctly license the project with GPLv2 or later is to include this header at least once in the repo (in our case, in the proposed LICENSE.txt file), with the placeholders replaced with the appropriate values, as suggested.
   • For the rare case where someone may want to relinquish their copyright, we could advise them to make a commit appending something like this to the LICENSE.txt: John Smith <john.smith@example.com> relinquishes their copyright over files x, y and z on 2020-01-01. That way, the qBittorrent project contributors remains an accurate author attribution.
3. Nothing noteworthy
4. _
   • The GPL recommends, but does not require, that the header to be included in each source file. IMO we should not include the header in every file, it is redundant; many other GPL-licensed projects go this route. It is the responsibility of users who copy the project's source files standalone to include an appropriate licensing notice themselves. The copyright notice in the current headers is inaccurate, as it does not include every copyright holder in most cases. Placing the qBittorrent project contributors as the copyright holder in the top-level file solves this issue and makes it so that we don't have to worry about this in the future. The specific names/identities of the contributors are recorded in the repository metadata.

Miscellaneous

• Not everything in this repository is a source file licensed under some sort of GPL license. Of the top of my head, I remember some icons have other licenses. We need to figure out how that fits into the picture. Perhaps a few more sections will need to be added to LICENSE.txt, specifically mentioning those files and the license that applies to them. That would also probably warrant a name change from LICENSE.txt to LICENSES.txt.

---

Please comment below with further suggestions and your findings. This post will be edited as-needed based on the discussion below.

[glassez]

• Note if the COPYING or similar licensing related files were introduced before or after any source file with the "GPLv2 or later" license header. This is important because the current COPYING file implies GPLv2 only. If it was introduced before anything else, I think we're screwed.

This is not true.
The copyright owner can distribute his product under any conditions that he pleases, and change these conditions whenever he wants. So even if the COPYING file (with GPLv2 only in it) appeared earlier, and then GPLv2 and above appeared in all the other files, then it may be a case of re-licensing by the copyright holder himself (he just forgot to update COPYING to follow the new conditions).

[glassez]

LICENSE file is expected to contain a license but not only mention of license. Why not put the proposed text in COPYING?

[sledgehammer999]

For license clarification see PR #14575

I made this offline before reading the new comments here.

[glassez]

https://www.gnu.org/licenses/gpl-faq.en.html#NoticeInSourceFile

[sledgehammer999]

https://www.gnu.org/licenses/gpl-faq.en.html#NoticeInSourceFile

Yeah, I agree with what they're saying. I pretty much had come to the same conclusion. Each file should have it's own notice for the reasons stated in that link.

Copyright (C) yyyy name of author

I agree that this line isn't being in sync with the actual edits in a given file. The given file might be edited so much over the course of months/years that nothing remains from the original code and author.
So as name of author something like Copyright (C) yyyy qBittorrent contributors (use the git log for details)

OpenSSL: I think it is necessary to have that exception clause especially now that we use openssl directly in some code.

[glassez]

OpenSSL: I think it is necessary to have that exception clause especially now that we use openssl directly in some code.

If OpenSSL has GPL incompatible license then we should keep this exception clause.

[xavier2k6]

OpenSSL Licensing Info

https://www.openssl.org/source/license.html

https://www.openssl.org/source/license-openssl-ssleay.txt

https://www.openssl.org/source/OCB-patent-grant-OpenSSL.pdf

https://www.openssl.org/docs/faq.html#:~:text=Can%20I%20use%20OpenSSL%20with%20GPL%20software?

[FranciscoPombal]

@glassez @sledgehammer999

https://www.gnu.org/licenses/gpl-faq.en.html#NoticeInSourceFile

Yeah, I agree with what they're saying. I pretty much had come to the same conclusion. Each file should have it's own notice for the reasons stated in that link.

I disagree. Quoting from the link:

You should put a notice at the start of each source file, stating what license it carries, in order to avoid risk of the code's getting disconnected from its license. If your repository's README says that source file is under the GNU GPL, what happens if someone copies that file to another program? (...)

This a largely imaginary/irrelevant problem. Putting the notice at the start of each file doesn't prevent anyone from removing it if they want to anyway.
It's not our problem if others using qBittorrent code mess the licensing notice themselves in their code; they would be the ones liable and in legal trouble. As I have stated above:

It is the responsibility of users who copy the project's source files standalone to include an appropriate licensing notice themselves [either on the copied files' headers or somewhere else].

It's just super annoying to have to scroll past that header every time, and per the licence's terms, we only need to include the header once; as per the quoted link, including the header in every file is only a suggestion.

Adding a copyright notice and a license notice at the start of each source file is easy and makes such confusion unlikely.

Not sure what this "confusion" could be. This is excessive hand-holding. It's not like the due-diligence required for those who want to copy a project's code is complex. Step 1: Read the LICENSE/COPYING file or equivalent; Step 2: Done. It's not rocket science.

LICENSE file is expected to contain a license but not only mention of license. Why not put the proposed text in COPYING?

I think this expectation is not a good thing in general. I realize that it is common and many projects do it, but it's actually more important to include the header than the license. The full license text is implied by the header and is widely available elsewhere (again, if others want to read the full text, it's their responsibility to go find it and read it).

Plus, in some cases, such as ours, the header provides stronger clauses/guarantees than simply copy-pasting the full license text; the header makes it clear that qBittorrent is licensed under "GPLv2 or later".

Remember, the license simply states what you can do in this regard; what you actually end up doing depends on what you include in the header. Quoting from the GPLv2 license text (emphasis mine):

Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation.

I'm pretty sure that if we just had a copy paste of the GPLv2 as the LICENSE, GPLv2 only would be implied, and we wouldn't be able to specify the "or later" part later without approval from all copyright holders.

[sledgehammer999]

It's just super annoying to have to scroll past that header every time, and per the licence's terms, we only need to include the header once; as per the quoted link, including the header in every file is only a suggestion.

FYI, QtCreator autocollapses the license block from each source file opened. Are you using a different IDE?

BTW, from all this ordeal it became apparent to me that we also have to be careful of the following for the future: We can't use source from a GPL software that doesn't have an OpenSSL exception! Am I wrong in this interpretation?

[FranciscoPombal]

@sledgehammer999

FYI, QtCreator autocollapses the license block from each source file opened. Are you using a different IDE?

I don't have my editor setup to collapse any kind of comment by default. And we don't typically rely on using a specific IDE, right? I even recall in the past some code cleanups/refactors being rejected because whatever Chocobo1 is using doesn't have language intelligence capabilities/hovers, or at least they choose to not use them (I think giving up on those refactors/cleanups due to that is extreme, unlike the removal of the headers, which, as I've stated, poses no legal issue and makes us less dependent on a certain IDE/editor for comfortable editing). No reason to bloat these files with repeated headers. Of course, files with code from other projects should have the headers.

BTW, from all this ordeal it became apparent to me that we also have to be careful of the following for the future: We can't use source from a GPL software that doesn't have an OpenSSL exception! Am I wrong in this interpretation?

I don't think there is such a problem:

https://people.gnome.org/~markmc/openssl-and-the-gpl.html

Official SPDX link showing similar recommended template text:

https://spdx.org/licenses/openvpn-openssl-exception.html

As a side note, OpenSSL >= 3.0 is being re-licensed with the APL 2.0. Unfortunately, that too is not directly compatible with GPLv2, so we will still need the exception. See https://en.wikipedia.org/wiki/OpenSSL#Licensing and https://www.apache.org/licenses/GPL-compatibility.html