[arch-dev-public] Mongodb and SSPL

[Morten Linderud]

Yo!

As probably some of you have realized, there is a discussion regarding mongodb
and the relicense from AGPLv3 to SSPLv1. RedHat has dropped it from their
repository[1], and Debian is assumed to follow suit[2]. This is mostly due SSPL
not being considered a free-license. It is currently being reviewed by OSI for
inclusion, but it is not looking bright currently[3]. The OSI discussion is for
SSPLv2, but it's my understanding that they are essentially the same license
with some fixups.

Obviously, we don't care about the license being free nor OSI compliant. We only
care if we are allowed to redistribute or not.

Link to the current license text as of mongodb release 4.0.5:

    https://github.com/mongodb/mongo/blob/r4.0.5/LICENSE-Community.txt

There is nothing in the SSPLv1 license text that prohibits us from distributing
mongodb. There are however special requirements in the license we have to abide
if we want to distribute modified source code.

Currently the PKGBUILD does a few sed's in the source to build it. I believe
this constitutes as modified source code under "0. Definitions".

    To “modify” a work means to copy from or adapt all or part of the work in
    a fashion requiring copyright permission, other than the making of an
    exact copy. The resulting work is called a “modified version” of the
    earlier work or a work “based on” the earlier work.

Under section "5. Conveying Modified Source Versions" the most relevant part for
us is section "a)".

    a) The work must carry prominent notices stating that you modified it,
    and giving a relevant date.

Which means we need to give some heads-up that the source is changed.

The next section is "6. Conveying Non-Source Forms" where I am unsure what
applies to us. One way to distribute the modified source is required, where 5
possible options are listed. I think "d)" fits us, where we can host a source
package on `source.archlinux.org`. But I'm frankly a bit unsure what the entire
paragraph entails for us. Some more input on this section would be great.

The bugreport FS#61394 is already submitted requesting a license change from
AGPLv3 to SSPLv1, so we should probably figure this out before changing the
license appropriately[5]?

-- 
Morten Linderud
PGP: 9C02FF419FECBE16

[1]: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8-beta/html/8.0_beta_release_notes/new-features#web_servers_databases_dynamic_languages_2
[2]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=915537#15
[3]: https://opensource.org/LicenseReview122018
[4]: https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/mongodb#n46
[5]: https://bugs.archlinux.org/task/61394 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-dev-public/attachments/20190116/f79a620d/attachment.asc>