Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add copyrights to cpython continued support work #11

Open
wants to merge 2 commits into
base: 2.7
Choose a base branch
from
Open

Add copyrights to cpython continued support work #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8a32bf0
add NEWS for ActiveState releases
Apr 6, 2021
d83347b
Add ActiveState copyright to modified files
Apr 6, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions LICENSE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,54 @@ direction to make these releases possible.
B. TERMS AND CONDITIONS FOR ACCESSING OR OTHERWISE USING PYTHON
===============================================================

ACTIVESTATE LICENSE AGREEMENT FOR PYTHON 2.7 GREATER THAN 2.7.18
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this just renaming the PSF license?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, renaming and changing the company name. I wanted the license type to remain identical to python3

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok let me just verify we are ok with effectively a 'custom' OS license name type. Should be ok but will verify.

----------------------------------------------------------------

1. This LICENSE AGREEMENT is between ActiveState Software Inc. ("ActiveState"),
and the Individual or Organization ("Licensee") accessing and otherwise using
this software ("Python") in source or binary form and its associated
documentation.

2. Subject to the terms and conditions of this License Agreement, ActiveState
hereby grants Licensee a nonexclusive, royalty-free, world-wide license to
reproduce, analyze, test, perform and/or display publicly, prepare derivative
works, distribute, and otherwise use Python alone or in any derivative version,
provided, however, that ActiveState's License Agreement and ActiveState's
notice of copyright, i.e., "Copyright (c) 2020, 2021 ActiveState Software Inc.;
All Rights Reserved" are retained in Python alone or in any derivative version
prepared by Licensee.

3. In the event Licensee prepares a derivative work that is based on
or incorporates Python or any part thereof, and wants to make
the derivative work available to others as provided herein, then
Licensee hereby agrees to include in any such work a brief summary of
the changes made to Python.

4. ActiveState is making Python available to Licensee on an "AS IS"
basis. ActiveState MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR
IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, ActiveState MAKES NO AND
DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS
FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT
INFRINGE ANY THIRD PARTY RIGHTS.

5. ActiveState SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON
FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS
A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON,
OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.

6. This License Agreement will automatically terminate upon a material
breach of its terms and conditions.

7. Nothing in this License Agreement shall be deemed to create any
relationship of agency, partnership, or joint venture between ActiveState and
Licensee. This License Agreement does not grant permission to use ActiveState
trademarks or trade name in a trademark sense to endorse or promote
products or services of Licensee, or any third party.

8. By copying, installing or otherwise using Python, Licensee
agrees to be bound by the terms and conditions of this License
Agreement.

PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2
--------------------------------------------

Expand Down
4 changes: 4 additions & 0 deletions Lib/cgi.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
#! /usr/local/bin/python

# Copyright (C) 2021 ActiveState Software Inc.
# cgi is licensed under the PSFLv2 License.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a bit confusing to add our own custom PSFLv2 license and then say that this file is licensed under the PSFLv2. Do we mean the actual PSFLv2 (which is between the PSF and the Licensee), or we do mean between us and the Licensee?

Also, damn the PSF for not making a templatable license!

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am in unclear territory with making this license. I went with PSFL as I thought a big part of the new platform was to not dual-license these languages. But I don't know anyone else who has customized the PSFL like this before. It is certainly used by the community, but unmodified. Often, as in the popular matplotlib, the full text isn't even bothered to be copied over. The license on any of their distributions is just "PSF".

Would "ActiveState's PSFLv2 License" be more accurate? Or just "the ActiveState License" to avoid confusion? (although readers of just these files won't know what and 'ActiveState License' is)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

First an aside ... saying "PSFLv2 License" is redundantly redundant, since the "L" in "PSFL" stands for License.

And back on topic ...

If other people use the PSFL for new works as is but they are not representing the PSF, I don't see how that use is legally valid or enforceable. The license starts with this text:

This LICENSE AGREEMENT is between the Python Software Foundation ("PSF"), and the Individual or Organization ("Licensee") accessing and otherwise using Python 3.9.4 software in source or binary form and its associated documentation.

So by definition, only the PSF can apply this license (as is) to anything. If I were to try to use it for my code, it couldn't possibly be legally valid, because I am not in a legal position to make binding agreements between the PSF and the Licensee.

So given that, I don't think it's possible for us to claim copyright on a file and then say it's under the PSFLv2. Saying "ActiveState's PSFLv2" makes more sense.

But let me throw yet another spanner into the works. What is the license of the PSFLv2 license text? Can we make a derivative version? That's not something we can just assume. Some licenses are themselves licensed in a way that forbids derivatives! For example, the various (L)GPL licenses all say something like this:

Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.

Absent an explicit copyright statement, the PSFLv2 copyright is (presumably) owned by the PSF, and we are not free to make a derivative version without their permission.

And there's several other issues too!

First, the PSFLv2 has this text:

Subject to the terms and conditions of this License Agreement, PSF hereby grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce, analyze, test, perform and/or display publicly, prepare derivative works, distribute, and otherwise use Python alone or in any derivative version, provided, however, that PSF's License Agreement and PSF's notice of copyright, i.e., "Copyright (c) 2001, 2002, 2003, 2004, 2005, 2006 Python Software Foundation; All Rights Reserved" are retained in Python alone or in any derivative version prepared by Licensee.

IANAL, but my reading of this is that the PSF is claiming copyright on all derivative works, and I'm not sure if we can add our own copyright notice as well.

Even if we can add it, the copyright statement as written implies that we are the sole copyright holder for each of these files. Unless we (re)wrote this from scratch, that is incorrect. We can only claim copyright for some parts of the code (or maybe none at all, if I'm reading the PSFLv2 correctly). So if we're adding a copyright header we need to spell out other copyright holders too.

But hey, we have a new corporate counsel. I think it'd be good to get Ron involved, since as I mentioned, IANAL.

@rawktron ^

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All great points. My couple quick thoughts:

  1. Re: Copyright notices, yes, that is correct, if we are adding our copyright to cover our segments the original copyright/license info also has to be present. Usually this is already the case. If it's not, then we either need to add it, OR, not add ours.
  2. If we are renaming this license, we have to include the original license as well (as the PSF one does with its older versions) — so we can't just replace it, we have to amend it. It's not totally clear whether their license allows that — I don't see anything disallowing it — but this is where we'd need legal approval.

We probably should get this vetted by legal — but at a minimum we need to do the above 2 things. As discussed we should probably not gate our 2.7.18.4 release on getting this resolved, but hold it for the next one. The 'list of changes' portions discussed need to be broken out and included though to be in compliance with the license.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will open a new PR with just the "add NEWS for ActiveState releases" commit but keep this one open to discuss copyrights. It won't cause any merge conflicts when the other work is ready.

  1. The PSFL is not included in any of the source files. The only time copyrights are included in source files is when the work was not originally for the cpython project (https://github.com/ActiveState/cpython/blob/2.7/Lib/logging/__init__.py#L1 as an example). Its not hard to add the PSFL as an additional comment when we go to add and ActiveState license, but that will always be required.
  2. All of the original licenses remain untouched in LICENSE including the original PSFL.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found this today, which reenforces that other projects use the PSFL, but also does not provide a template for new projects, or a standard header https://spdx.org/licenses/PSF-2.0.html

# See the file LICENSE for details.

# NOTE: the above "/usr/local/bin/python" is NOT a mistake. It is
# intentionally NOT "/usr/bin/env python". On many systems
# (e.g. Solaris), /usr/local/bin is not in $PATH as passed to CGI
Expand Down
4 changes: 4 additions & 0 deletions Lib/ctypes/test/test_parameters.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
# Copyright (C) 2021 ActiveState Software Inc.
# test_parameters is licensed under the PSFLv2 License.
# See the file LICENSE for details.

import unittest, sys
from ctypes.test import need_symbol
import test.support
Expand Down
4 changes: 4 additions & 0 deletions Lib/httplib.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
# Copyright (C) 2020 ActiveState Software Inc.
# httplib is licensed under the PSFLv2 License.
# See the file LICENSE for details.

r"""HTTP/1.1 client library

<intro stuff goes here>
Expand Down
4 changes: 4 additions & 0 deletions Lib/test/multibytecodec_support.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
# Copyright (C) 2020 ActiveState Software Inc.
# multibytecodec_support is licensed under the PSFLv2 License.
# See the file LICENSE for details.

# multibytecodec_support.py
# Common Unittest Routines for CJK codecs
#
Expand Down
4 changes: 4 additions & 0 deletions Lib/test/test_cgi.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
# Copyright (C) 2021 ActiveState Software Inc.
# test_cgi is licensed under the PSFLv2 License.
# See the file LICENSE for details.

from io import BytesIO
from test.test_support import run_unittest, check_warnings
import cgi
Expand Down
4 changes: 4 additions & 0 deletions Lib/test/test_tarfile.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
# Copyright (C) 2020 ActiveState Software Inc.
# test_tarfile is licensed under the PSFLv2 License.
# See the file LICENSE for details.

import sys
import os
import shutil
Expand Down
4 changes: 4 additions & 0 deletions Lib/test/test_urlparse.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
# Copyright (C) 2021 ActiveState Software Inc.
# test_urlparse is licensed under the PSFLv2 License.
# See the file LICENSE for details.

from test import test_support
import sys
import unicodedata
Expand Down
4 changes: 4 additions & 0 deletions Lib/urllib2.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
# Copyright (C) 2020 ActiveState Software Inc.
# urllib2 is licensed under the PSFLv2 License.
# See the file LICENSE for details.

"""An extensible library for opening URLs using a variety of protocols

The simplest way to use this module is to call the urlopen function,
Expand Down
4 changes: 4 additions & 0 deletions Lib/urlparse.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
# Copyright (C) 2021 ActiveState Software Inc.
# cgi is licensed under the PSFLv2 License.
# See the file LICENSE for details.

"""Parse (absolute and relative) URLs.

urlparse module is based upon the following RFC specifications.
Expand Down
7 changes: 7 additions & 0 deletions Misc/NEWS.d/2.7.18.1.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
.. bpo: 0
.. date: 2020-09-29
.. nonce: caft@D
.. release date: 2020-09-29
.. section: Library

Address CVE-2020-8492 in urllib2
21 changes: 21 additions & 0 deletions Misc/NEWS.d/2.7.18.2.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
.. bpo: 0
.. date: 2020-11-13
.. nonce: TRAK.h
.. release date: 2020-11-13
.. section: Library

Address CVE-2020-27619 in multibytecodec tests

.. bpo: 0
.. date: 2020-11-12
.. nonce: GEH1va
.. section: Library

Address CVE-2020-26116 in httplib

.. bpo: 0
.. date: 2020-11-03
.. nonce: TWAB9g
.. section: Library

Address CVE-2019-20907 in tarfile
7 changes: 7 additions & 0 deletions Misc/NEWS.d/2.7.18.3.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
.. bpo: 0
.. date: 2021-02-09
.. nonce: yic.vi
.. release date: 2021-02-09
.. section: Library

Address CVE-2021-3177 in ctypes
7 changes: 7 additions & 0 deletions Misc/NEWS.d/2.7.18.4.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
.. bpo: 0
.. date: 2021-04-05
.. nonce: dip*SU
.. release date: 2020-04-05
.. section: Library

Address CVE-2020-8492 in urlparse
6 changes: 6 additions & 0 deletions Modules/_ctypes/callproc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,9 @@
/*
* Copyright (C) 2021 ActiveState Software Inc.
* callproc is licensed under the PSFLv2 License.
* See the file LICENSE for details.
*/

/*****************************************************************
This file contains remnant Python 2.3 compatibility code that is no longer
strictly required.
Expand Down