License status of CRAN packages

(Subject: renamed as thread hijacked from the ParallelR thread ? --Dirk)

On 23 April 2009 at 14:44, Gabor Grothendieck wrote:
| Aside from R there are the add-on packages.
|
| A frequency table showing the licenses of the CRAN packages indicates
| that the all or almost all packages have some sort of free software license
| with GPL licenses being most common. (A few packages have restrictions
| to noncommercial use and that may conflict with GPL, not sure.) ? That is
| not to say that there are no other types of packages but any such packages
| are not on CRAN.

I fear that is not quite the case. ?There are quite a few packages like that.

On 23 April 2009 at 15:32, Gabor Grothendieck wrote:
| On Thu, Apr 23, 2009 at 3:08 PM, Dirk Eddelbuettel <edd at debian.org> wrote:
| >
| > (Subject: renamed as thread hijacked from the ParallelR thread ? --Dirk)
| >
| > On 23 April 2009 at 14:44, Gabor Grothendieck wrote:
| > | Aside from R there are the add-on packages.
| > |
| > | A frequency table showing the licenses of the CRAN packages indicates
| > | that the all or almost all packages have some sort of free software license
| > | with GPL licenses being most common. (A few packages have restrictions
| > | to noncommercial use and that may conflict with GPL, not sure.) ? That is
| > | not to say that there are no other types of packages but any such packages
| > | are not on CRAN.
| >
| > I fear that is not quite the case. ?There are quite a few packages like that.
|
| Not the case? ?My post included a list of all License fields from the
| DESCRIPTION file of every CRAN package so the list is definitive.

Correct me if I am wrong in the paragraph you kindly left standing above, you
seem to suggest that

? ? ? ?"all or almost all packages have some sort of free software license"

and that while non-free licenses may exist,

? ? ? ?"any such packages are not on CRAN".

I believe this statement to be false.

There are packages with restrictive licenese on CRAN. ?They were contained in
the list of licenses you assembled, and my point is that it is overly hard to
identify them (if one were to tty to avoid using these packages).

As a non-exhautive list with possible misclassifications, cran2deb currently
has these packasges as 'maybe not free' and does not build them:

? ? BARD,BayesDA,CoCo,ConvCalendar,FAiR,PTAk,RScaLAPACK,Rcsdp,SDDA,SGP,
? ? alphahull,ash,asypow,caMassClass,gpclib,mapproj,matlab,mclust,mclust02,
? ? mlbench,optmatch,rankreg,realized,rngwell19937,rtiff,rwt,scagnostics,
? ? sgeostat,spatialkernel,tlnise,xgobi

We are missing some recently added packages, and we may yet flag several from
the list above as free. Some may be listed because of non-free Depends:

But to take a concrete example, 'realized' is not something I am supposed to
install at work. ?Yet install.packages() currently has not way knowing that.

Are we approximately on the same page ?

Dirk

--
Three out of two people have difficulties with fractions.

On 23 April 2009 at 15:32, Gabor Grothendieck wrote:
| On Thu, Apr 23, 2009 at 3:08 PM, Dirk Eddelbuettel  
<edd at debian.org> wrote:
| >
| > (Subject: renamed as thread hijacked from the ParallelR thread    
--Dirk)
| >
| > On 23 April 2009 at 14:44, Gabor Grothendieck wrote:
| > | Aside from R there are the add-on packages.
| > |
| > | A frequency table showing the licenses of the CRAN packages  
indicates
| > | that the all or almost all packages have some sort of free  
software license
| > | with GPL licenses being most common. (A few packages have  
restrictions
| > | to noncommercial use and that may conflict with GPL, not  
sure.)   That is
| > | not to say that there are no other types of packages but any  
such packages
| > | are not on CRAN.
| >
| > I fear that is not quite the case.  There are quite a few  
packages like that.
|
| Not the case?  My post included a list of all License fields from  
the
| DESCRIPTION file of every CRAN package so the list is definitive.

Correct me if I am wrong in the paragraph you kindly left standing  
above, you
seem to suggest that

	"all or almost all packages have some sort of free software license"

and that while non-free licenses may exist,

	"any such packages are not on CRAN".

I believe this statement to be false.

There are packages with restrictive licenese on CRAN.  They were  
contained in
the list of licenses you assembled, and my point is that it is  
overly hard to
identify them (if one were to tty to avoid using these packages).

As a non-exhautive list with possible misclassifications, cran2deb  
currently
has these packasges as 'maybe not free' and does not build them:

     
BARD,BayesDA,CoCo,ConvCalendar,FAiR,PTAk,RScaLAPACK,Rcsdp,SDDA,SGP,
     
alphahull 
,ash,asypow,caMassClass,gpclib,mapproj,matlab,mclust,mclust02,
     
mlbench,optmatch,rankreg,realized,rngwell19937,rtiff,rwt,scagnostics,
    sgeostat,spatialkernel,tlnise,xgobi

We are missing some recently added packages, and we may yet flag  
several from
the list above as free. Some may be listed because of non-free  
Depends:

But to take a concrete example, 'realized' is not something I am  
supposed to
install at work.  Yet install.packages() currently has not way  
knowing that.

Are we approximately on the same page ?

Dirk

On Apr 23, 2009, at 3:02 PM, Dirk Eddelbuettel wrote:

On 23 April 2009 at 15:32, Gabor Grothendieck wrote:
| On Thu, Apr 23, 2009 at 3:08 PM, Dirk Eddelbuettel <edd at debian.org>
wrote:
| >
| > (Subject: renamed as thread hijacked from the ParallelR thread
--Dirk)
| >
| > On 23 April 2009 at 14:44, Gabor Grothendieck wrote:
| > | Aside from R there are the add-on packages.
| > |
| > | A frequency table showing the licenses of the CRAN packages
indicates
| > | that the all or almost all packages have some sort of free software
license
| > | with GPL licenses being most common. (A few packages have
restrictions
| > | to noncommercial use and that may conflict with GPL, not sure.)
That is
| > | not to say that there are no other types of packages but any such
packages
| > | are not on CRAN.
| >
| > I fear that is not quite the case. ?There are quite a few packages
like that.
|
| Not the case? ?My post included a list of all License fields from the
| DESCRIPTION file of every CRAN package so the list is definitive.

Correct me if I am wrong in the paragraph you kindly left standing above,
you
seem to suggest that

? ? ? ?"all or almost all packages have some sort of free software
license"

and that while non-free licenses may exist,

? ? ? ?"any such packages are not on CRAN".

I believe this statement to be false.

There are packages with restrictive licenese on CRAN. ?They were contained
in
the list of licenses you assembled, and my point is that it is overly hard
to
identify them (if one were to tty to avoid using these packages).

As a non-exhautive list with possible misclassifications, cran2deb
currently
has these packasges as 'maybe not free' and does not build them:

? ?BARD,BayesDA,CoCo,ConvCalendar,FAiR,PTAk,RScaLAPACK,Rcsdp,SDDA,SGP,
? ?alphahull,ash,asypow,caMassClass,gpclib,mapproj,matlab,mclust,mclust02,
? ?mlbench,optmatch,rankreg,realized,rngwell19937,rtiff,rwt,scagnostics,
? ?sgeostat,spatialkernel,tlnise,xgobi

We are missing some recently added packages, and we may yet flag several
from
the list above as free. Some may be listed because of non-free Depends:

But to take a concrete example, 'realized' is not something I am supposed
to
install at work. ?Yet install.packages() currently has not way knowing
that.

Are we approximately on the same page ?

Dirk

There is a list of acceptable entries that are defined as part of the specs
in R-exts (see page 4). Perhaps this needs to be "tightened" a bit, at least
in so far as packages passing R CMD check for the purpose of inclusion on
CRAN. That would include perhaps altering the ability to use the 'file
LICENSE' option, which at present leaves the door wide open for non-standard
approaches. It may also have to check for DEPENDS and whether they too are
on CRAN and passed the appropriate license checks.

Packages that fail this check should not be included on CRAN and the package
author would then be obligated to find other distribution resources or
contact the CRAN maintainers to advocate that their licensing schema should
be acceptable.

Then the end user can at least have some comfort in knowing that anything
they get from CRAN comes under a compatible license for general use without
restriction. They would have to intentionally use other sources for packages
that fail the CRAN requirements.

If other distribution venues, such as Debian/Ubuntu/Fedora elect to tighten
those restrictions even further when making .debs or RPMs available, then
that is a decision that they get to make and end users will need to be aware
of those as well. Albeit I don't envision the aforementioned Linux distros
including packages that should be a problem for most end users relative to
usage restrictions given their own license review processes.

HTH,

Marc Schwartz

As a non-exhautive list with possible misclassifications, cran2deb currently
has these packasges as 'maybe not free' and does not build them:

     BARD,BayesDA,CoCo,ConvCalendar,FAiR,PTAk,RScaLAPACK,Rcsdp,SDDA,SGP,
     alphahull,ash,asypow,caMassClass,gpclib,mapproj,matlab,mclust,mclust02,
     mlbench,optmatch,rankreg,realized,rngwell19937,rtiff,rwt,scagnostics,
     sgeostat,spatialkernel,tlnise,xgobi

Dirk Eddelbuettel <edd <at> debian.org> writes:

As a non-exhautive list with possible misclassifications, cran2deb currently
has these packasges as 'maybe not free' and does not build them:

? ? ?BARD,BayesDA,CoCo,ConvCalendar,FAiR,PTAk,RScaLAPACK,Rcsdp,SDDA,SGP,
? ? ?alphahull,ash,asypow,caMassClass,gpclib,mapproj,matlab,mclust,mclust02,
? ? ?mlbench,optmatch,rankreg,realized,rngwell19937,rtiff,rwt,scagnostics,
? ? ?sgeostat,spatialkernel,tlnise,xgobi

Small point: FAiR is free. The file LICENSE thing just clarifies that most of
the code is AGPL but a couple files can't be included under the AGPL and are
plain GPL. As far as I can see, R does not give me the option of saying so in a
"standard" way, e.g. putting License: AGPL (>= 3) in the DESCRIPTION file would
only be 95% accurate and putting License: AGPL (>= 3) | GPL (>= 3) is misleading.

On Thu, Apr 23, 2009 at 4:59 PM, Ben Goodrich <goodrich at fas.harvard.edu> wrote:

Dirk Eddelbuettel <edd <at> debian.org> writes:

As a non-exhautive list with possible misclassifications, cran2deb currently
has these packasges as 'maybe not free' and does not build them:

     BARD,BayesDA,CoCo,ConvCalendar,FAiR,PTAk,RScaLAPACK,Rcsdp,SDDA,SGP,
     alphahull,ash,asypow,caMassClass,gpclib,mapproj,matlab,mclust,mclust02,
     mlbench,optmatch,rankreg,realized,rngwell19937,rtiff,rwt,scagnostics,
     sgeostat,spatialkernel,tlnise,xgobi

Small point: FAiR is free. The file LICENSE thing just clarifies that most of
the code is AGPL but a couple files can't be included under the AGPL and are
plain GPL. As far as I can see, R does not give me the option of saying so in a
"standard" way, e.g. putting License: AGPL (>= 3) in the DESCRIPTION file would
only be 95% accurate and putting License: AGPL (>= 3) | GPL (>= 3) is misleading.

How about "

License: AGPL except for 2 GPL files

Ben Goodrich writes:

Gabor Grothendieck wrote:

On Thu, Apr 23, 2009 at 4:59 PM, Ben Goodrich <goodrich at fas.harvard.edu> wrote:

Dirk Eddelbuettel <edd <at> debian.org> writes:

As a non-exhautive list with possible misclassifications, cran2deb currently
has these packasges as 'maybe not free' and does not build them:

BARD,BayesDA,CoCo,ConvCalendar,FAiR,PTAk,RScaLAPACK,Rcsdp,SDDA,SGP,
alphahull,ash,asypow,caMassClass,gpclib,mapproj,matlab,mclust,mclust02,
mlbench,optmatch,rankreg,realized,rngwell19937,rtiff,rwt,scagnostics,
sgeostat,spatialkernel,tlnise,xgobi

Small point: FAiR is free. The file LICENSE thing just clarifies that most of
the code is AGPL but a couple files can't be included under the AGPL and are
plain GPL. As far as I can see, R does not give me the option of saying so in a
"standard" way, e.g. putting License: AGPL (>= 3) in the DESCRIPTION file would
only be 95% accurate and putting License: AGPL (>= 3) | GPL (>= 3) is misleading.

How about "

License: AGPL except for 2 GPL files

If that would make anyone's life easier without making anyone else's
life harder, I would be happy to put that in the DESCRIPTION file.

I have been doing file LICENSE because it parses on

http://cran.r-project.org/web/packages/FAiR/index.html

and people can click to the LICENSE link to read the details if they
are interested. But maybe that is not optimal. Dirk?

Kjetil Halvorsen writes:

On Thu, Apr 23, 2009 at 4:59 PM, Ben Goodrich <goodrich at fas.harvard.edu>wrote:

Dirk Eddelbuettel <edd <at> debian.org> writes:

As a non-exhautive list with possible misclassifications, cran2deb

currently

has these packasges as 'maybe not free' and does not build them:

     BARD,BayesDA,CoCo,ConvCalendar,FAiR,PTAk,RScaLAPACK,Rcsdp,SDDA,SGP,

 BayesDA has
   License:       GPL version 2 or any later version

what is unclear about that?

Kjetil

alphahull,ash,asypow,caMassClass,gpclib,mapproj,matlab,mclust,mclust02,

mlbench,optmatch,rankreg,realized,rngwell19937,rtiff,rwt,scagnostics,

     sgeostat,spatialkernel,tlnise,xgobi

Small point: FAiR is free. The file LICENSE thing just clarifies that most
of
the code is AGPL but a couple files can't be included under the AGPL and
are
plain GPL. As far as I can see, R does not give me the option of saying so
in a
"standard" way, e.g. putting License: AGPL (>= 3) in the DESCRIPTION file
would
only be 95% accurate and putting License: AGPL (>= 3) | GPL (>= 3) is
misleading.

Ben

	[[alternative HTML version deleted]]

AGPL, unfortunately, allows supplements, and hence cannot fully be
standardized.  We've been thinking about extending the current scheme to
indicate a base license plus supplements, but this is still work in
progress.

Kurt Hornik wrote:

AGPL, unfortunately, allows supplements, and hence cannot fully be
standardized. ?We've been thinking about extending the current scheme to
indicate a base license plus supplements, but this is still work in
progress.

This would be helpful. I would just reemphasize that a package that
includes some AGPL code and some GPL3 code is standard as far as the FSF
is concerned, e.g. from section 13 of the AGPL:

"Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU General Public License into a single combined
work, and to convey the resulting work. The terms of this License will
continue to apply to the part which is the covered work, but the work
with which it is combined will remain governed by version 3 of the GNU
General Public License."

So, I think that CRAN should at least have a canonical spec that covers
*this* situation. Other situations may be more complicated to handle
elegantly.

On Fri, Apr 24, 2009 at 11:44 AM, Ben Goodrich <goodrich at fas.harvard.edu 

wrote:
Kurt Hornik wrote:

AGPL, unfortunately, allows supplements, and hence cannot fully be
standardized.  We've been thinking about extending the current  
scheme to
indicate a base license plus supplements, but this is still work in
progress.

This would be helpful. I would just reemphasize that a package that
includes some AGPL code and some GPL3 code is standard as far as  
the FSF
is concerned, e.g. from section 13 of the AGPL:

"Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU General Public License into a single  
combined
work, and to convey the resulting work. The terms of this License  
will
continue to apply to the part which is the covered work, but the work
with which it is combined will remain governed by version 3 of the  
GNU
General Public License."

So, I think that CRAN should at least have a canonical spec that  
covers
*this* situation. Other situations may be more complicated to handle
elegantly.

Another possibility is to simply standardize the set of licenses  
that CRAN
supports.  GPL licenses (GPl-2, GPL-2.1, GPL-3, LGPL), MIT and
X11 already cover 98% of all packages on CRAN.   If there truly is an
advantage to the AGPL license perhaps a standard version could be  
offered
in the set.  Perhaps, for the 2% of packages that want a different  
license
a second repository could be made available.

Hi all,

I think for the common licences, we should also add BSD licence... for
example my pkg randtoolbox (which is currently with incompatible
licences) will probably be in a near future with the BSD licence.

Anyway I like the idea of two different repositories for GPL like
licensed pkg and other packages.

Christophe

Le 24 avr. 09 ? 18:20, Gabor Grothendieck a ?crit :

On Fri, Apr 24, 2009 at 11:44 AM, Ben Goodrich
<goodrich at fas.harvard.edu> wrote:

Kurt Hornik wrote:

AGPL, unfortunately, allows supplements, and hence cannot fully be
standardized.  We've been thinking about extending the current
scheme to
indicate a base license plus supplements, but this is still work in
progress.

This would be helpful. I would just reemphasize that a package that
includes some AGPL code and some GPL3 code is standard as far as the FSF
is concerned, e.g. from section 13 of the AGPL:

"Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU General Public License into a single combined
work, and to convey the resulting work. The terms of this License will
continue to apply to the part which is the covered work, but the work
with which it is combined will remain governed by version 3 of the GNU
General Public License."

So, I think that CRAN should at least have a canonical spec that covers
*this* situation. Other situations may be more complicated to handle
elegantly.

Another possibility is to simply standardize the set of licenses that
CRAN
supports.  GPL licenses (GPl-2, GPL-2.1, GPL-3, LGPL), MIT and
X11 already cover 98% of all packages on CRAN.   If there truly is an
advantage to the AGPL license perhaps a standard version could be offered
in the set.  Perhaps, for the 2% of packages that want a different
license
a second repository could be made available.

-- 
Christophe Dutang
Ph. D. student at ISFA, Lyon, France
website: http://dutangc.free.fr