License of libnvidia-container unclear

[stefan-hdt]

Hello,

I was just looking at this oss project and saw that there are two different license statements. Both the BSD-3-Clause and the Apache-2.0 seem to be applicable depending on which license information you pick:

BSD-3-Clause: https://github.com/NVIDIA/libnvidia-container/blob/master/README.md and https://github.com/NVIDIA/libnvidia-container/blob/master/NOTICE

Apache-2.0: https://github.com/NVIDIA/libnvidia-container/blob/master/LICENSE

Which license shall be applicable? If there has been a relicensing to Apache-2.0, when was this relicening done (starting from which version)?

A client of mine wants to use this project and does not know which license to follow.

Thanks a lot!

Stefan

[ubuntuyeah]

Rights Under BSD-3-Clause License

Copyright Retention: The original authors retain the copyright to the code.
Credit Requirement: Anyone who redistributes the code, even in a modified form, must include the original copyright notice, list of conditions, and the disclaimer.
Freedom to Modify: The proprietors have the freedom to modify the code and redistribute it under a different license, as long as the original copyright notice and disclaimer are retained.

Rights Under Apache-2.0 License

Copyright Retention: As with BSD-3-Clause, the original authors maintain the copyright.
Patent Grant: The license explicitly provides a grant of any patent rights held by the contributors, to the users.
Change Notification: If the code is modified and then redistributed, the changes must be stated.
Trademark Rights: The Apache-2.0 license often includes a clause that disallows the use of the names, trademarks, or other identifiers of the project or contributors without explicit permission.

Legal Precedents Affecting Proprietors' Rights

Enforceability: Both BSD and Apache licenses have generally been upheld in legal disputes, which provides proprietors some confidence in the enforceability of their terms.
Dual Licensing: Legal precedents allow for dual licensing, where a project can be offered under more than one license type, although this can create complexities.
License Transition: Changing the license of a project generally requires the agreement of all contributors or the removal of contributions from those who do not agree, as established in various legal cases.

Was relicensed to Apache 2.0 adding the patent grant, so unlikely to go back...

https://github.com/NVIDIA/libnvidia-container/commits/main/LICENSE

[ubuntuyeah]

65827fe

Update license clause to reflect actual licensing

Update spec file license to reflect current state

Several parts of libnvidia-container (and dependencies) are not BSD-licensed,
or are ambiguously-licensed. This updates the spec file to reflect current
state, including some comments so the reasoning isn't lost. If #74 is
resolved, this may change. :)

• elftoolchain is licensed under BSD-3-Clause
  https://github.com/elftoolchain/elftoolchain#copyright-and-license
• libnvidia-container is licensed under apache-2.0
  https://github.com/NVIDIA/libnvidia-container/blob/master/LICENSE
• libnvidia-container includes the GLPv3 license
  https://github.com/NVIDIA/libnvidia-container/blob/master/COPYING
• libnvidia-container includes the LGPLv3 license
  https://github.com/NVIDIA/libnvidia-container/blob/master/COPYING.LESSER
• nvidia-modprobe is licensed under GPLv2
  https://github.com/NVIDIA/nvidia-modprobe/blob/master/COPYING
• several (14) nvidia-modprobe files contain the MIT license header
  https://github.com/NVIDIA/nvidia-modprobe/blob/master/utils.mk

Signed-off-by: Danny Sauer dsauer@suse.com

[ubuntuyeah]

This is a duplicate of #74

From there: To make this more complicated, the list from @paroque28 is not exhaustive. A scan via fossa found the following licenses:

GPL-3.0-ONLY (COPYING)
LGPL-3.0-ONLY (COPYING.LESSER)
LGPL-3.0-OR-LATER (src/elftool.[c,h], NOTICE)
BSD-3-CLAUSE (the spec file)
APACHE-2.0 (declared license, LICENSE, mk/docker.mk)

To me it looks like putting LGPL-3.0-ONLY into COPYING.LESSER is an oversight, as it is explicitly noted that it applies when this library is linked against libelf.

Unfortunately I am afraid that this is all that we can do, the rest of the licensing is something that @RenaudWasTaken and NVIDIA must fix.

[github-actions]

This issue is stale because it has been open 90 days with no activity. This issue will be closed in 30 days unless new comments are made or the stale label is removed. To skip these checks, apply the "lifecycle/frozen" label.

[lahwaacz]

I don't think this issue should ever go stale. Please add the lifecycle/frozen label, or better yet, solve the issue 😅