License issue

[davidmarek]

Hi, in my company we use the https://clearlydefined.io project to automatically review licensing for any 3rd party libraries. Unfortunately, typing-extensions is labeled as OTHER there. See https://github.com/clearlydefined/curated-data/blob/master/curations/pypi/pypi/-/typing-extensions.yaml

Past tries to correct the license information in clearlydefined failed, because the LICENSE file in this repository doesn't match PSF-2.0 or Python-2.0 license as defined in SPDX. See for example clearlydefined/curated-data#20420

Could you clearly state what license this project uses and update the LICENSE to match the declared license?

[srittau]

The LICENSE file is basically a direct copy of the LICENSE file from the CPython repository, with one exception: The zero-clause BSD license for documentation is absent.

Apart from that, I don't think anyone here can give you a definitive answer, since all information should be present in the LICENSE file. If in doubt, please contact a lawyer.

[davidmarek]

When comparing the LICENSE with the CPython LICENSE it's clear it's a copy paste. Is there a special reason why this package needs to do that? It's confusing because the license talks about "this software (Python)". I checked some other projects (mypy, typeshed, pythondotorg) under python/ org and they usually have their own license.
Thanks for the info, it seems to me that this can't be easily resolved without lawyers :-(

[srittau]

Maybe @gvanrossum or @JukkaL have more insight into this.

[gvanrossum]

I dunno -- maybe @JelleZijlstra remembers what happened when typing_extensions was separated out from the typing repo?

The linked issues on clearlydefined are highly technical, I don't have time to look into that.

[srittau]

I believe we just copied over the LICENSE file from the typing repository. And that in turn seems to be copied from CPython.

[gvanrossum]

And the cpython license file occasionally gets updated. Perhaps re-copying the license file from cpython will resolve the OP's issue? @davidmarek What do you think?

[davidmarek]

I think that would help. CPython is marked as OTHER in the clearlydefined.io dataset but that's because the CPython license doesn't match what's in https://spdx.org/licenses/Python-2.0.html.
There's an open issue in SPDX to update the license text and it looks like that might be resolved soon.
The issue: spdx/license-list-XML#1200
PR with a new Python-2.0.1 license: spdx/license-list-XML#1549

If typing_extensions LICENSE matches CPython license, this issue should be resolved when the CPython license gets an id assigned in SPDX.

[gvanrossum]

I think there’s a PR out for that.

Nevertheless this seems to be more an issue with the tooling than a real concern.

[srittau]

We could possibly look into re-licensing this library. All of the code should be original by now, and not covered by some of the ancient licenses mentioned in the LICENSE file. That would mean:

• Setting up the CLA bot for this repository (we need to do this anyway).
• Getting all authors to agree to assign copyright to the PSF.
• Ask the PSF to relicense the library under a more modern license.