hashicorp/yamux

Please consider using Apache2 license instead.

c4milo opened this issue · 7 comments

c4milo commented

MPL 2.0 requires everybody using this library to disclose source code. Apache2 would encourage more adoption.

mitchellh commented

This comment is not legal advice, but from what I've checked and double-checked with legal counsel multiple times is that linked code (dynamic or static) does not need to disclose source if the source file itself is not MPL.

That is: if you statically link Yamux into your app, then you're obligated to provide the source to Yamux, but not to your own proprietary (or separately licensed) code. You can find FAQ here: https://www.mozilla.org/MPL/2.0/FAQ.html

c4milo commented

That makes sense! Thanks @mitchellh for clarifying.

c4milo commented

@mitchellh based on MPL 2.0 you are missing the license header on each go file. If there is no header the license will supposedly be undefined for each individual file. There is a similar discussion over here: mozilla/persona#859 (this comment is not legal advice :P)

c4milo commented

All this legal stuff is such a pain in the butt.

mitchellh commented

Indeed. I"ll look into this.

c4milo commented

@mitchellh, FWIW, I wrote a small tool to help me manage licenses across all my projects, I hope it is useful for you too: https://github.com/c4milo/licentia

jbenet commented

@mitchellh the way the go community + tooling handle vendoring (usually copying source, not statically linking) may impact how the licenses apply.

FWIW, i recently forayed into all these legal questions. After much deliberation, we settled for either

  • (MIT or BSD) + the PATENTS grant file
  • APL2.0
    for all our code.

What is the patents grant file?

WebM, libjingle, libwebrtc, and other chromium parts all bear a PATENTS file

This seems to address the APL 2 / MPL patent grants in a multi-license way. (i.e. a separate patent grant)

It's becoming increasingly common to see MIT/BSD + the PATENTS file, which is much clearer and straight forward than either APL2 or MPL. At this point, the only reason i see for using the MPL is If you really want the code disclosure clause -- i.e. afraid people will keep modified versions of your code private. But do note that this clause makes it likely to be incompatible with many uses, significantly decreasing the reach of your library.

IANAL, TINLA, WTFBBQ