Wrong license

[stefan6419846]

It seems like your package is claiming the wrong license: The original nose implementation is subject to LGPL-2.1-only as far as I can see (https://github.com/nose-devs/nose/blob/master/lgpl.txt), but you are distributing your version as MIT.

Apparently, you reuse most of the original code in your fork and thus are forced to make your version available as LGPL-2.1-only as well (see §2 of the LPGL-2.1 license text, especially §2c). (In theory, §3 allows you to choose GPL-2.0 or any later GPL version as well, but this would mean an even stronger copyleft variant.)

[mdmintz]

According to https://stackoverflow.com/a/5610965/7058266, the code can have an MIT license.

Additionally, frameworks such as pytest have used nose code: https://github.com/search?q=repo%3Apytest-dev%2Fpytest%20nose&type=code, and pytest has an MIT License: https://github.com/pytest-dev/pytest/blob/4546d5445aaefe6a03957db028c263521dfb5c4b/doc/en/license.rst#L6

If there are any objections to pynose having an MIT License going forward, those should be made by one of the members of https://github.com/nose-devs.

[stefan6419846]

According to https://stackoverflow.com/a/5610965/7058266, the code can have an MIT license.

This is more about license compatibility (dependencies of your code, your code as a dependency, embedding third-party code into your code), not about modifying existing licensed code. AFAIK you used the original nose code as a whole and just applied some modifications to make it compatible with recent Python versions most of the time. Summarizing your interpretation of this topic, one could simply eliminate any copyleft effect of copyleft licenses by just changing some lines of the code - if this really would be the case, no company would have forbid licenses with strong copyleft anymore, which does not make sense.

Additionally, frameworks such as pytest have used nose code: https://github.com/search?q=repo%3Apytest-dev%2Fpytest%20nose&type=code, and pytest has an MIT License: https://github.com/pytest-dev/pytest/blob/4546d5445aaefe6a03957db028c263521dfb5c4b/doc/en/license.rst#L6

If they really use nose code, this would be an issue as well. As far as I can see from the search results, they only are about providing a nose compatibility layer?

If there are any objections to pynose having an MIT License going forward, those should be made by one of the members of https://github.com/nose-devs.

IANAL, but: While the original developers are the ones which could take legal actions, anyone can point out such issues - which I did as I consider your current approach wrong from a license compliance perspective.

[mdmintz]

Lots of nose made its way into pytest (MIT License). Some of it is just renamed methods to provide support for converting old nose scripts into pytest scripts: https://github.com/pytest-dev/nose2pytest

Another thing: GitHub never recognized the original nose license, as it doesn't appear in the original repo's information section. GitHub does recognize the MIT License for pynose:

Since developers use that information to determine the license of a repo without having to go through all the files, that's another reason why pynose can have the MIT License.

Based on all those things, (and any information listed previously), it's safe for pynose to use the MIT License.

[stefan6419846]

Lots of nose made its way into pytest (MIT License). Some of it is just renamed methods to provide support for converting old nose scripts into pytest scripts: https://github.com/pytest-dev/nose2pytest

Sorry, but I still consider this wrong unless you are able to provide actual evidence. Nevertheless, this is unrelated to pynose. nose2pytest is just some migration helper which does not seem to really use nose internals, but is a standalone tool with an original idea - new/original code can use whatever license the author wants in most of the cases.

Another thing: GitHub never recognized the original nose license, as it doesn't appear in the original repo's information section. GitHub does recognize the MIT License for pynose:

GitHub is rather strict within its parser and sometimes even wrong for slightly modified license texts. nose states the "GNU LGPL" in its metadata, thus showing the intent of the developers on which license applies: https://github.com/nose-devs/nose/blob/7c26ad1e6b7d308cafa328ad34736d34028c122a/setup.py#L106 https://github.com/nose-devs/nose/blob/7c26ad1e6b7d308cafa328ad34736d34028c122a/setup.py#L116 This is what is being rendered on PyPI as well: https://pypi.org/project/nose/

https://github.com/nose-devs/nose/blob/master/lgpl.txt just provides some basic clarification that at least LGPL-2.1 is meant here, although still not explicitly stating LPGL-2.1-only or LGPL-2.1-or-later, thus we have to assume LGPL-2.1-only.

Since developers use that information to determine the license of a repo without having to go through all the files, that's another reason why pynose can have the MIT License.

This is a generalization which does not hold true. While it might be a first hint, the package metadata (license field and trove classifiers) are much more reliable in most of the cases. For final reliable results, scanning all source code files and looking for suspicious files/comments manually usually is required.

While I am not aware of any studies about the quality of the autodected licenses of GitHub (my observations only showed that quite some cases do not show any and sometimes it tends to be wrong), actual studies have shown that quite some packages tend to have incomplete license declarations - including cases where the actual licenses imply a copyleft effect, while the package itself does not declare one (which I consider pynose an example of as well).

Based on all those things, (and any information listed previously), it's safe for pynose to use the MIT License.

As explained in this and the previous comment, the MIT license is wrong here and indicates false facts for everyone trying to ensure that pynose is used in a license-compliant manner.

[mdmintz]

I'll wait for a member of https://github.com/nose-devs to request a license change here (if that's what they want).

nose is their repo... They should get to decide if a change is warranted. They've been made aware of the fork in https://github.com/nose-devs/nose/issues.

In the meantime, pynose will hold onto the MIT License. Their original license states (https://github.com/nose-devs/nose/blob/master/lgpl.txt): "we offer you this license, which gives you legal permission to copy, distribute and/or **modify** the library." Consider it modified. It also states: "if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others." I've stated very clearly at the top of the README that pynose is an updated version of nose.

[stefan6419846]

If I would treat my contracts and other legal agreements like you treat license texts, which are some sort of legal agreement as well, I would get into trouble rather quickly. With your approach, I could resolve all license-related headaches, including strong copyleft effects, with some small packaging overhead - you would not need extensive guidelines in this case and could quickly discontinue any license scanning and efforts like OpenChain.

I consider it rather unlikely that some of the group members will get in touch with you about this as eight years after the last commit and with nose2 being a massive revamp with a less restrictive license (actually due to user request) and I do not think that the corresponding issues are monitored sufficiently. There does not seem to be any evidence that all contributors of nose agreed to this change as well.

Due to not using nose (any more), this does not affect me, and I just wanted to point out this oddity which can cause unexpected issues due to a possibly hidden copyleft effect. Our opinions/interpretations contradict each other and as long as I do not start including pynose as a dependency, I see no further advantages of continuing to argue with you about this.

[stefan6419846]

Having a look at PyPI projects which have a requirement on pynose, it seems like usage there is rather limited luckily:

• DDFacet (optional for testing)
• gwlf-e (optional for testing)
• kbve (hard dependency, but unused?)
• lockable (optional for testing)
• montblanc (hard dependency)
• nose-launchable (hard dependency)
• pytest-lockable (optional for testing)
• seleniumbase (hard dependency, by the author of pynose)

This seems to match https://github.com/mdmintz/pynose/network/dependents?dependent_type=PACKAGE as well.

Data retrieval

I just did a basic query against the SQLite3 database provided at https://github.com/pypi-data/pypi-json-data:

sqlite> .open pypi-data.sqlite
sqlite> .mode csv
sqlite> .output pynose_usage.csv
sqlite> SELECT name, version, home_page, license, requires_dist FROM projects WHERE requires_dist LIKE '%pynose%' ORDER BY name, version;

[kytta]

Their original license states: "we offer you this license, which gives you legal permission to copy, distribute and/or **modify** the library."

@mdmintz mind you, this is the preamble that you've cited here, which is in no way a replacement for the actual licence. The LGPL does not allow you to do what you're doing now.

The SO answer that you link in your first comment takes Section 1 into account:

You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.

(Emphasis mine) This means that, if you would use nose as a dependency (e.g. by doing pip install), you are free to do so, as long as you re-distribute the code freely and verbatim.

Consider it modified. It also states: [...]

Again, it's still the preamble. Yes, you are modifying nose's source code. This is where Section 2 comes in:

You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:

[...]

c) You must cause the whole of the work to be licensed at no
charge to all third parties _under the terms of this License_.

[...]

These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, [...]

(Emphasis mine) As such, even if you consider 5%, 10%, 50% of code to be coming from you, your whole work has to be licensed under LGPL 2.1. What you could do is to do a fork of nose (with example name nose2), which should be licenced under the LGPL, and then include it as a (verbatim) dependency of pynose, which would then consist of your work only, which you'd be free to license as you wish.

I've stated very clearly at the top of the README that pynose is an updated version of nose.

This is good, but this does not satisfy all of Section 2 requirements.

---

Another thing: GitHub never recognized the original nose license, as it doesn't appear in the original repo's information section. GitHub does recognize the MIT License for pynose

Since developers use that information to determine the license of a repo without having to go through all the files, that's another reason why pynose can have the MIT License.

Based on all those things, (and any information listed previously), it's safe for pynose to use the MIT License.

This is utterly wrong. Whether pynose is allowed to use the MIT License is not (and never will be) determined by what GitHub is showing in its UI. It's a comfort feature, not legal advice. The licence can set via the accompanying documentation and/or metadata files; in other words, it's something that gets committed by the author on purpose, not something that some backend code infers from the file tree. GitHub does not recognize it because the file is not named "COPYING", but these facts do not make nose public domain. The licence of nose is defined in setup.py and somewhat in the changelog.

---

If there are any objections to pynose having an MIT License going forward, those should be made by one of the members of @nose-devs

True, but this does not allow you to use the MIT License in the hopes that others won't notice/won't care. If I steal your bicycle, and you don't tell the police about it, my actions would still be illegal, no matter if you're okay with it or not.

[mdmintz]

I've read your thread, @mgorny
https://social.treehouse.systems/@mgorny/112716339989172108

I see lies, hateful speech, and slander from you. Sometimes all in one comment.

It just sounds like you just don't want people to keep using nose (or any fork of nose, such as pynose, for that matter). Clearly it isn't dead, as companies are still using it. Lots of usage comes from private repos, which won't show up in the "Dependents" tab on GitHub. Most visitors to pynose are actually quite happy to see that someone stepped up to maintain nose for the next generation (via pynose). Even though there are more-advanced unit-testing frameworks available for Python, (such as pytest), nose still has a place in the world today. It's also not very polite to dictate to people which frameworks they can't use anymore. Maybe some people don't have the luxury of time to migrate tests from one framework to another, or they feel that their energy can be better spent elsewhere. Take your witch-hunt somewhere else.

[thesamesam]

In addition to the excellent points others have made, let me point out explicitly:

According to stackoverflow.com/a/5610965/7058266, the code can have an MIT license.

The answer you cite even says:

As far as distribution counts, you need to put the whole package under GPL. MIT code inside of the package will still be available under MIT whereas the GPL applies to the package as a whole if not limited by higher rights.

[eli-schwartz]

If there are any objections to pynose having an MIT License going forward, those should be made by one of the members of https://github.com/nose-devs.

Note that any person with code in nose that has been infringed by this fork, has the legal right to make a claim of infringement, not just project members of https://github.com/nose-devs (and indeed, the nose-devs project members could include people who only contributed to nose2, and have no copyright claims on nose, so the connection to project members is entirely off target).

[zougloub]

@mdmintz before you rightfully get publicly shamed and find your way in history books, you should to take some time to reflect, apologize and fix your mistakes; you may also obtain permission to relicense from the nose devs but that wouldn't make what you did right enough.

[mdmintz]

Be sure to read https://blog.jquery.com/2012/09/10/jquery-licensing-changes/ in full. One of many examples where a license could be switched over to MIT. The Free Software Foundation site confirms that the MIT License is a “lax, permissive non-copyleft free software license, compatible with the GNU GPL.

"Over time, more than 500 people have contributed to the projects currently managed by the jQuery Foundation."

The license was able to switch over from a GPL to MIT without the sign-off of the over 500 contributors to the project.

And I did state earlier in #16 (comment) that "If there are any objections to pynose having an MIT License going forward, those should be made by one of the members of https://github.com/nose-devs." ...meaning that I wasn't opposed to the idea in general, but so far I haven't seen Jason Pellerin show up to comment on this thread. No one said anything about pytest reusing nose code in places over its history (and pytest has an MIT License). An MIT License (https://en.wikipedia.org/wiki/MIT_License) is also in the best interest of most stakeholders involved in this. So far, it seems that most of the people in this thread who are against an MIT License are just trying to erase the legacy of nose (#16 (comment)).

pynose keeps the legacy of nose alive by making it available to the next generation of Python developers, who are unable to keep using the original nose because it is no longer functional on the latest versions of Python as it currently stands.

[thesamesam]

That was possible because of a CLA where copyright was assigned to the jQuery Foundation. Do you have a CLA signed by the majority of nose contributors assigning copyright to you?

[jubalfh]

@thesamesam and because jquery was dual licensed (GPL and MIT) at that point.

[eli-schwartz]

One of many examples where a license could be switched over to MIT.

The license was not switched over to MIT -- it was always MIT, and they took away the option to accept it under a dual license agreement as GPL.

It is not legal to relicense software without the agreement of the original authors (a CLA is a case where you acquire that legal agreement in advance, and, appropriately, a CLA is a legal document). There is no ambiguity here. You cannot rationalize your actions into being legal.

[jubalfh]

@mdmintz listen, this is really simple: you can't unilaterally change the terms of distribution of the code to a less restrictive license without agreement from the original copyright holders. you're now in breach of the LGPL terms, and the options you have are that either you get that approval from the original authors, or you restore LGPL-2.1 licensing, or, if you're unwilling to do the right thing, you will remove the repository.

[durin42]

Pointed here from another thread: you absolutely can not just relicense this, even on the say-so of members of the nose-devs org: you'd need to contact and get approval from all contributors of any code beyond de minimis fixes, which includes me.

Nobody contacted me, so this is definitely a license violation.

(I'm all of: a contributor to nose, have done license compliance enforcement at multiple companies, and participated in a relicensing effort for a significant OSS package. I know pretty well of what I speak here.)

[mdmintz]

Waiting to hear from the official nose people:

---

These are the official nose maintainers according to https://pypi.org/project/nose/

And this is the official nose author:

---

I would like to hear first what any of these 3 people have to say. Then we can resolve this.

[durin42]

You've missed my point: you don't need to hear from any of them, you just need to mark this as LGPL. You can't re-license it unilaterally, and neither can those three individuals.

For what it's worth I think it's a great thing to get nose working on newer Pythons for the benefit of its dependents.

[alerque]

So far, it seems that most of the people in this thread who are against an MIT License are just trying to erase the legacy of nose

This is totally orthogonal and almost laughably irrelevant. Anyone is welcome to keep the legacy alive and fork/maintain nose all they like, but they (and you) are legally bound to do so under the original licensing terms.

Waiting to hear from the official nose people:

This is also irrelevant. None of these people can legally make this change either. They would need to all three agree add well as contact every other contributor in the history of the project and either get them to sign of on the change or remove their contributions. Until that is done the answer is categorically "no, you cannot do this*. It must be reverted to LGPL. Do whatever modifications you like but you cannot relicense the project.

[jubalfh]

(note that the cavalier, for want of a less insulting word, attitude to licensing terms can be also visible in other author's package, pdbp. which started as a fork of pdbpp, with history erased, and no attribution to original authors given whatsoever, despite the original code being licensed under BSD 3-Clause. we may have a plagiarist here, folks. the original license was also, quite pointlessly, changed to MIT.)

[astatide]

Everyone should note that @kumar303 is one of the original nose maintainers. Downvoting him is not a sign of respect for nose or GitHub repo maintainers.

Proper respect should be given where deserved. For me, this is about showing respect for the large and very dedicated community of GitHub repo maintainers. Seems like there is another underlying issue going on, which may explain why some maintainers are being targeted disproportionally.

Hey, thanks for including me in that screenshot. Congratulations on finally actually acknowledging a single thing I've contributed or asked to in this thread.

You have avoided every opportunity to give any credit or proper attribution to the original maintainers except here, when forced to, by pointing out the license problems. You specifically avoid forking repos, despite the button being right there; you did NOT include the AUTHORS file; you put solely your name on the copyright. You want to talk about disrespect? Literally everyone here has tried to help you get your fork into compliance and you consistently argue against them and it's only until someone says something you can twist into being supportive that you call it "respect".

Why do you even WANT this licensed as MIT? Why have you gone so far out of your way to never link back to the original repo in MULTIPLE projects? You're disrespecting not just the authors but the open source movement itself. Ignoring my questions but passively showing my name in a screenshot and calling me "disrespectful" is far more disrespectful. Do you not like that my avatar is femme coded with pink hair? People here are trying to help you. You adding a couple lines to a bundle of stolen code doesn't make you a "maintainer", it makes you a plagiarist. Don't steal people's work and pollute the community then complain when the community is upset.

[eli-schwartz]

While I broadly agree with your comments about respect w.r.t. stripping out attribution....

Do you not like that my avatar is femme coded with pink hair?

Occam's Razor advocates that this comment is deconstructive and unhelpful and also, well, completely offtopic and inaccurate.

(It is possible I am missing context from outside of this ticket or any of the linked tickets; if that is the case then by all means please correct me.)

[mdmintz]

There's a lot of false accusations going on. I do acknowledge people's work.

Also, forking a repo a 100% legal, and encouraged. GitHub has a nice Fork button.

Also, maintainers lead busy lives (full-time jobs, multiple repos, etc), and don't always get around to fixes right away. Sometimes I myself have to wait a few months for a new release to be shipped in a repo I use. The big crowd of people that just showed up here only started coming a few days ago. And I did reach out to official maintainers for any clarification I needed. Give people some breathing room to get things done. As people can see, there's a lot that I work on, and that only includes public GitHub activity. People have day jobs too.

[astatide]

GitHub has a nice Fork button.

I am saying you literally do not use the fork button despite it being there, not that it's illegal to fork. And that acknowledgement is for one individual. In addition, this behavior is spread across multiple repos. Do you understand why this no longer appears to be in good faith? Yes, people are busy, and yes, people have day jobs. Part of your day job, as a developer, is to respect the attributions and licenses of the software you use and fork.

You specifically did NOT fork this from the nose repo, instead choosing to copy/paste/commit all of nose into your repo... without the AUTHORS file (and with the incorrect license). Multiple people have pointed this out to you. You instead deflect, constantly, even going so far as to delete this type of issue when it's raised in other repos you control. You see how that comes across as in bad faith?

[astatide]

Also, maintainers lead busy lives (full-time jobs, multiple repos, etc), and don't always get around to fixes right away.

It took you more effort to copy/paste/rm the AUTHORS file/commit/push nose into your repo than it would have to have forked it. You had a reason for it, whatever it is. And ensuring proper attribution is given isn't "a fix" that needs to be done, it's something that you should have automatically had as part of your workflow. Whatever your reason for "forking" this repo (and numerous others) in such an unusual way is, you should at least acknowledge it and say you will fix it, not giving some spiel about how you're busy as if everyone here isn't busy as well.

[mdmintz]

As I said before, I'm working on things. There were already multiple links to nose from the ReadMe, so clearly I wasn't trying to hide things.

[mdmintz]

PRs were merged. Up next, let's see if we can get these changes merged back into the original nose repo, which hasn't been touched since 2016. Find me a maintainer of https://github.com/nose-devs/nose that has write-access, and then we'll put a plan in motion to merge this in and ship a new release to PyPI for the original nose.

[mdmintz]

Today was certainly fun. I haven't done this much running around since... 🇮🇱

Remember to be respectful to GitHub repo maintainers. We lead busy lives.

[duxsco]

Remember to be respectful to GitHub repo maintainers.

“People do not win respect by insisting on the right to be respected. Respect is earned: that is what makes it respect.”

Source: The Home We Build Together, p. 61 (https://rabbisacks.org/quotes/respect-is-earned/)

[g7]

Remember to be respectful to GitHub repo maintainers. We lead busy lives.

Please be respectful to repo maintainers, their projects, and their chosen licenses. You got notified about this at the end of January. It's plenty of time, even for a busy person.

[ei-grad]

Literally everyone here has tried to help you get your fork into compliance

tried to help

There must be a better way to help, I believe.

@mdmintz cheers for your consistency and keeping pynose working with latest python versions.

[duxsco]

Literally everyone here has tried to help you get your fork into compliance

There must be a better way to help, I believe.

IMHO, the whole discussion wasn't about helping. It was about getting @mdmintz understand that a license violation exists. And, this is the first step. As this was so difficult and took so long, things got heated. The actual help to get the fork into compliance was provided by those involved in getting #30 as well as #32 done.

[ahzay]

I fail to see what the problem is, if he didn't change it to MIT, someone else would have. You're all being angry at the wrong person.

[hcm444]

@ahzay

I would like an explanation for this please.
5b7314a

[ahzay]

@hcm444

Listen sweetie, sometimes code changes licenses. Are you going to try and preserve the original license of every little piece of code. Things change owners all the time, that's just the reality of things. There's no sense directing all this anger and violence at the innocent victims that happen to be on the receiving end of this change. Do better.

[userappgate]

@ahzay can you point out to relevant legislation in any usa-aligned country where such a right exists?

I don't think @mdmintz is an innocent victim, and using alt accounts to defend yourself is a bit silly.

[JohnnyJayJay]

@ahzay can you point out to relevant legislation in any usa-aligned country where such a right exists?

Pretty sure that person is trolling/ragebaiting. No use engaging with that.

[ahzay]

can you point out to relevant legislation in any usa-aligned country where such a right exists?

Yes, now stop complaining. You're starting to look like an anti-semite.

[mdmintz]

Version 1.5.2 has been released to PyPI: https://pypi.org/project/pynose/1.5.2/
Hopefully everyone has calmed down. I see that things got a little out-of-hand based on the comments.
A post-mortem summarizing the event is available here: #36
Have a good night, everyone.

[JohnMH]

@mdmintz In the future, you may contact licensing@fsf.org for help with licensing questions relating to projects using GPL/LGPL. They'll be happy to point you in the right direction.