Update ED2 licence

[mpaiao]

Description

The previous licence (CC-BY-4.0) turns out not to be ideal for softwares.

Based on the feedback we got so far, my suggestion is to go with Apache 2.0, which is rather permissive. If anyone sees this as a problem, or is more versed in licences than I am, please let me know your thoughts on it.

I am making this PR a draft one because if we go with Apache 2.0, we may want to go through every file and add the suggestions listed at the end of the licence itself. I am happy to do it if people are onboard with it.

Collaborators

@Aariq @apourmok @ashiklom @aswann @crollinson @dmedvigy @larsonej @LMurphy186232 @Lo-hatch @manfredo89 @mdietze @mrjohnston @nmlevine @pmoorcroft @robkooper @xiangtaoxu

Types of changes

• Hot fix (emergential bug fix to make ED2 run again)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (fix or feature that would cause existing functionality to change)

Changes in Settings, Input Files or Output Files

• This feature requires changes in ED2IN
• This feature requires changes in the XML parameter file
• This feature requires changes in other input files
• This feature will change output files

Expectation of Answer Changes:

• No changes expected (bit-for-bit compatibility)
• Changes expected with specific configurations (see details below)
• Changes expected in all simulations (see details below)

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• ED2 Wiki update:

Testing :

• All new and existing tests passed.

[ashiklom]

Switching from creative commons to a proper software license is good.

But I would think very carefully about choosing GPLv3 specifically. It's a "copyleft"/"viral" license, which means that any code someone else distributes that includes ED2 in any way also has to be distributed under a GPLv3 license. In strictly open source settings, this is OK (albeit somewhat annoying, and may still discourage uptake). But it becomes a significant problem for (1) private/commercial settings (e.g., if a C credit estimation company wants to distribute a proprietary methodology that uses ED2, they will be forced to distribute that entire methodology with a GPLv3 license, not just the ED2 part); and (2) US government settings (US government cannot put copyright usage restrictions/conditions on its products; GPLv3 is a usage condition. At NASA, we were always advised not to include GPLv3 licensed software in anything we published for this reason).

There are good principled reasons to insist on GPLv3 and its copyleft provisions. But you should be aware that these principles will come at the cost of implicitly discouraging (or, in some cases, outright preventing) certain organizations from using ED2. At a minimum, having some GPLv3 licensed software as part of a software release package will complicate the software release/copyright/IP assignment process because it requires more careful consideration of the license implications. I personally would be somewhat less inclined to use a GPLv3-licensed ED2 for my work, not because I personally object to the clauses but because I don't want to run afoul of my employer (Yale's) lawyers in case they insist on using a different license for the work (remember, in the US, technically, universities own the IP of their professors, so they generally have the rights to assert such things...though, in practice, they rarely do).

There are plenty of solid alternative options for open source licenses that don't have these copyleft provisions. Apache 2.0 is typically my go-to license, because of its explicit patent clauses; it was also the license of choice at NASA (besides NASA's weird custom open source license that developers always disliked). BSD-3 is another solid choice, though I would think carefully about the promotion clause -- you may actually want promotion even without explicitly granting permission. MIT is the lowest friction option while still having universal recognition.

[mrjohnston]

I'm totally fine with whatever license you choose. Thanks for asking.

[Lo-hatch]

I agree. Thanks for asking.

[mpaiao]

Many thanks for the insights @ashiklom! I don't have strong opinions on which specific open licence to use, so if there is a restriction to use GPLv3 (especially if NASA advises against it), I am totally fine considering a different one that is less strict but still is a broadly recognised open-source licence.

Maybe we should go with Apache 2.0 then.

[ashiklom]

Apache 2.0, BSD-3, and MIT all have broadly similar (and good!) open source protections. The key differences/niches are (my editorial -- obviously, don't treat as formal legal advice):

• Apache 2.0 --- has explicit protections related to patents. If someone adds a feature to ED2 (e.g., new crop submodel), and then gets a patent for their approach, and then tries to sue ED2 for patent infringement, Apache 2.0 explicitly protects the project itself and all users of the project against that, because under Apache 2.0, contributors automatically grant a patent license related to their contributions to the software and all its users. In other licenses, this is only implicit (and therefore subject to legal interpretation). This is why lawyers typically like Apache 2.0.

• BSD-3 --- the third clause says users can't use the source for promotion. E.g., You can't promote your product as "Powered by ED2" unless you get explicit permission. Whether or not you want this depends on how much you value more people saying "Powered by ED2" vs. worrying about the "wrong" people/groups tarnishing ED2's good name by saying their thing is powered by ED2.

• MIT --- neither of these things. It's basically "do whatever you want, as long as the ED2 bits remain explicitly MIT-licensed." The simplest choice, but also fewer explicit protections.

I don't have particularly strong opinions about any of these. The reason I prefer Apache 2.0 is that the lawyers I've interacted with seem to prefer it, and I don't like arguing with lawyers 😉

[xiangtaoxu]

Thanks, Alexey. Super helpful information! I feel Apache 2.0 is a good choice for a community-based open-source model for legal protection. BSD-3 might not be necessary since the codes does not belong to any single institution.

[robkooper]

Agree with the change in license that the ED team picks. That being said as @ashiklom points out I tend to avoid GPLv3 licenses and like the Apache license because of the explicit patent rule.

[crollinson]

Like others, I agree with changing the license to whatever those more experienced in these things think is best!

[mpaiao]

Thanks everyone for the reply and inputs! I will update the pull request and switch it to Apache 2.0, but will wait to hear from a few others before I make it ready for review and merge it.

[LMurphy186232]

I don't believe there are implications for me on license choice, so I am fine with any of these.

[Aariq]

Fine with me, Apache is a better choice than GPL, IMO. With GPL, pecan.ED2 would possibly also have to adopt GPL if it bundles any ED2 code when built.

[ashiklom]

Missing year and copyright holder. Without this, the license is invalid.

The year should be this year. Copyright owner is either you personally or your institution, depending on your institution's policies about such things.

[mpaiao]

Thanks @ashiklom! I will edit it. However, before I do, there is a more general question, who is the copyright owner of a community model? To be honest, I checked with AI what to do in this case and it suggested using "The ED2 Contributors" and defining what we mean by this in file CONTRIBUTORS.md‎. But I don't know if this is a valid thing.

This would be my preference, but I don't know if this is legally acceptable. If we ought to list one person, then I think it should be either @pmoorcroft or @dmedvigy, because they started ED2. With the same logic, if we list one institution, then Harvard University, because ED2 was conceived there.

[Aariq]

I think if you say the copyright holders are "ED2 Authors" or "ED2 Contributors" then you need to list them somewhere, e.g. in a DESCRIPTION file.

[mpaiao]

Thanks @Aariq, I had created the CONTRIBUTORS.md file. I can list everyone, but we must make sure to keep it up to date as new contributions come.

[aswann]

The license change is fine with me!