EPL-2.0 and Clojars

[danielcompton]

Recently, the Eclipse Foundation have released the EPL-2.0. There are a few improvements from the EPL-1.0 that Clojure and most Clojure projects use:

1.4. What are the major changes between EPL-1.0 and EPL-2.0?

• The term of art is now referred to as "module" rather than "file";
• The choice of law provisions has been removed;
• The license is now suitable for scripting languages such as JavaScript; and
• The license now includes an option to add a secondary license for GPL-2.0+ compatibility.

Potentially the most interesting to many people is the ability to add a secondary license to allow GPL-2.0+ compatibility.

I've had some discussions on the EPL-discuss mailing list: http://dev.eclipse.org/mhonarc/lists//epl-discuss/msg00158.html, and there is much more detail in the EPL-2.0 FAQ. I would encourage anyone interested in this topic to read the FAQ. In the future Clojars and the Software Freedom Conservancy hopes to publish some plain english guidance for developers and library authors on this topic.

I've put a few abridged questions and answers that I think will answer people's most common questions. You should read the FAQ for the full context on this though.

Q: What is the impact of adding a secondary GPL license?
A: It is almost the same as dual licensing EPL/GPL

Q: How can I upgrade a project from EPL-1.0 to EPL-2.0?
A: The EPL allows new versions of the license to be adopted by projects with little work. A project can use the new version by simply updating the file headers and notices. It would be good practice to discuss this before relicensing though.

Q: How can I upgrade a project to EPL-2.0 with GPL secondary license?
A: You must gain permission from all copyright holders to re-license the content (Ed: Projects with a CLA would allow you to do this, as you have already gotten approval from contributors.)

Q: Some organizations do not use GPL-licensed content. What are the impacts of licensing a project with EPL-2.0 + GPL secondary license?
A: While the EPL-2.0 has a concept called "Secondary Licenses", should an adopter not want to use the Secondary License, then the entire construct can simply be ignored. The code can be consumed purely under the EPL-2.0 without any concerns.

There are a few key questions this poses for Clojars:

• Should Clojars itself relicense to EPL-2.0?
• Should Clojars relicense to EPL-2.0 + GPL secondary license?
• Should Clojars encourage projects to update to EPL-2.0?
• Should Clojars encourage projects to update to EPL-2.0 + GPL secondary license?

I'm not sure whether Clojars should be neutral on this subject, or even what neutrality fully means in this case.

The biggest challenge with relicensing to EPL-2.0 + GPL is that it requires permission from every contributor. In the past, relicensing Clojure projects has been quite labour intensive, as every contributor needs to reply "I agree" or similar on a mailing list thread of GitHub issue to give their approval. This is ok for a single project, but if we want to encourage lots of projects to migrate then this is going to become unmanageable for both contributors and maintainers to keep track of who has and hasn't given approval.

One idea I've had is for Clojars (or another party) to create a tool which allows maintainers to submit all of the projects they would like to relicense, and for contributors to agree to all of the relicensing requests (or some of the requests) in one place in one click. This would solve the MxN problem of getting approval and make the migration much more feasible.

What are people's thoughts on this?

[devurandom]

Note that there already exist legal / licensing / approval tools, like Phabricator's Legalpad, which could serve as a model or be integrated into the tool you envision. For an example of how the UI looks like, take a look at the upstream Phabricator instance.