Add licensing metadata, recommended LGPL-3.0, other licensing revisits (

#1318)

* New metadata comment: `// License: SPDX-License-Identifier-Here`,
required for everything in extensions.json. The names come from this
industry-standard list: https://spdx.org/licenses/
* LGPL-3.0 is now HIGHLY recommended instead of MIT but ultimately we'll
let authors choose (at least for now)
* I am assuming that extension authors wish for their things to remain
MIT unless they ask otherwise. If you do ask, I'll mark existing
extensions as `MIT AND LGPL-3.0` instead of `LGPL-3.0` because we can't
just ignore contributions by other people.
* Retroactively changing the license to something more restrictive is
not really possible, so this will just affect *future* changes
* Closes #1145 by
documenting that they are CC-BY-4.0

CONTRIBUTING.md

@@ -32,10 +32,6 @@ We're all volunteers who all have lives outside of Scratch extensions. Many have
 
 Every extension is also covered under [our bug bounty](https://github.com/TurboWarp/extensions/security/policy), so mindlessly merging things will have a direct impact on my wallet.
 
-## On AI language models
-
-**Generative AI language models like ChatGPT, Copilot, and Gemini DO NOT know how to write proper extensions for TurboWarp.** Remember that the ChatGPT knowledge cutoff is in 2021 while our extension system did not exist until late 2022, thus it *literally can't know*. Pull requests submitting extensions that are made by AI (it's really obvious) will be closed as invalid.
-
 ## Writing extensions
 
 Extension source code goes in the [`extensions`](extensions) folder. For example, an extension placed at `extensions/hello-world.js` would be accessible at [http://localhost:8000/hello-world.js](http://localhost:8000/hello-world.js) using our development server.
@@ -44,82 +40,65 @@ New extensions should be added in a user folder. You can name your folder anythi
 
 Extensions must be self-contained. All libraries and hardcoded resources should be embedded into the extension's JavaScript file. If you include minified code, please link where to find the unminified code and include a copy of the original license.
 
-## Website stuff
+## License
+
+**We are not lawyers. This is not legal advice.**
+
+Everything in this repository must be available under an open source license. You can use any license you want, but we **STRONGLY** recommend using the [GNU Lesser General Public License version 3](licenses/GPL-3.0.txt) for all new extensions.
+
+The following licenses are banned for being [incompatible the GPLv3](https://www.gnu.org/licenses/license-list.en.html), so do not use any code, images, etc. under them:
+
+ - Creative Commons Attribution-ShareAlike licenses prior to version 4.0
+   - This includes user-generated content on the Scratch website which [uses version 2.0](https://scratch.mit.edu/terms_of_use) of this license.
+   - This includes StackOverflow posts contributed before 2018-05-02 which [use several different versions](https://stackoverflow.com/help/licensing).
+ - Creative Commons Attribution-NoDerivs and similar "no derivatives" licenses
+ - Creative Commons Attribution-NonCommercial and similar "non commercial" or "personal use only" licenses
 
-To add an extension to the homepage, you need to add metadata comments at the very start of the extension's JavaScript, and add the extension's path (without .js) to `extensions/extensions.json`. The order of that list determines the order of the library. Don't worry about putting it in the right spot, we'll move it if we disagree.
+Once you choose a license for your extension, [find its SPDX identifier from this table](https://spdx.org/licenses/). The "FSF Free/Libre?" and "OSI Approved?" columns should both contain "Y".
 
-The header comments look like this:
+## Metadata
+
+All extensions should need a metadata comment at the *very* start of the file, before any code. We have a script that will read these, so to make sure it understands what you write, use this exact format:
 
 ```js
-// Name: Example Extension
+// Name: My Cool Extension
 // ID: extensionid
 // Description: Does a very cool thing. This must have punctuation at the end!
 // By: GarboMuffin <https://scratch.mit.edu/users/GarboMuffin/>
 // Original: TestMuffin
+// License: LGPL-3.0
 ```
 
-Remember, this has to be the *very first* thing in the JS file. `Name`, `Description`, and `ID` are required. Make sure that `ID` exactly matches what you return in `getInfo()`. You can have zero or more `By` and `Original`. Put credit links in `<angled brackets>` if you have one. It must point to a Scratch user profile. This metadata is parsed by a script to generate the website and extension library. It tries to be pretty loose, but don't deviate too far. You must use `//`, not `/* */`.
+You must use line comments; block comments `/* */` will not work. These fields are **REQUIRED**:
+
+ - `Name` will appear on the website. It should be similar to the name returned by getInfo().
+ - `ID` should be identical to the id returned by getInfo().
+ - `Description` will appear on the website.
+ - `License` describes the license that the extension's code is under. It should be a valid [SPDX license](https://spdx.org/licenses/) expression. (use `LGPL-3.0` if you are unsure)
+
+`By` is optionally used to credit the author of the extension (you!). `Original` is used if the extension is based on or ported from somewhere else. They both use the same format of `Name` or `Name <https://scratch.mit.edu/users/username>`. Links to places other than Scratch are not allowed at this time. You can repeat both of these as many times as needed, just add another `// By: ...` comment after.
+
+In addition to `// License: ...`, you can also add a larger block comment with more information if you want to.
+
+## Website stuff
+
+Add your extension's path (without `extensions/` and without `.js`) to `extensions/extensions.json`. The order of that list determines the order of the library. Don't worry about putting it in the right spot, we'll move it if we disagree.
 
-New extensions do not *need* images, but they are highly encouraged. Save the image in the `images` folder with the same folder name and file name (but different file extension) as the extension's source code. For example, if your extension is located in `extensions/TestMuffin/fetch.js`, save the image as `images/TestMuffin/fetch.svg` or `images/TestMuffin/fetch.png`. The homepage generator will detect it automatically. Images are displayed in a 2:1 aspect ratio. SVG (preferred), PNG, or JPG are accepted. PNG or JPG should be 600x300 in resolution. Please add proper attribution to `images/README.md` for *any* resources that were not made by you.
+New extensions do not *need* images, but they are encouraged. Save the image in the `images` folder with the same folder name and file name (but different file extension) as the extension's source code. For example, if your extension is located in `extensions/TestMuffin/fetch.js`, save the image as `images/TestMuffin/fetch.svg` or `images/TestMuffin/fetch.png`. The homepage generator will detect it automatically. Images are displayed in a 2:1 aspect ratio. SVG (preferred), PNG, or JPG are accepted. PNG or JPG should be 600x300 in resolution. Please add proper attribution to `images/README.md` for *any* resources that were not made by you. The resulting image must be licensed under the [GNU General Public License version 3](licenses/GPL-3.0.txt).
 
 Most extensions shouldn't need external documentation -- it should be obvious what to do just by looking at the blocks. That said, some do need more explanation. Documentation is written in markdown and placed in the `docs` folder with a similar layout to images. For example, documentation for `extensions/TestMuffin/fetch.js` would be saved as `docs/TestMuffin/fetch.md`. Our version of markdown is slightly extended to allow rendering [scratchblocks](https://scratchblocks.github.io/). Just look at the existing documentation for syntax examples. It's not a perfect experience: block colors have to be manually copied, and icons aren't supported, but it's better than what we had before. Once you put your markdown there, you can set a `docsURI` like `https://extensions.turbowarp.org/TestMuffin/fetch`.
 
 Static resources such as example resources used by extensions go in the `website` folder.
 
 ## Banned APIs
 
-(subject to change)
+Don't use these:
 
  - `eval()`
  - `new Function()`
  - untrusted or remote `<script>` or `<iframe>`
  - other arbitrary JS/CSS/HTML evaluation
 
-## License
-
-**We are not lawyers. This is not legal advice.**
-
-The source code of the extension and any libraries it uses must be available under a **permissive** open source license that is compatible with the [GNU General Public License version 3](licenses/GPL-3.0.txt). This allows us to include it in TurboWarp Desktop and allows the packager to include it in packaged projects. If you're unsure, use our default: the [MIT License](licenses/MIT.txt). For this to be legally possible, either you must have written the entire extension yourself or have permission to use all of its components under a compatible open source license.
-
-If you use the default MIT license as we recommend, you don't need to add a comment (you can if you want to, though). If you wish to use a different license, leave a comment at the top of the file. For example, if you prefer Apache 2.0, add a comment like the one below.
-
-```js
-// (Remember: You don't need to include this if you just use the default license!)
-/*!
- * Copyright 2023 Your Name Here
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-```
-
-Update the copyright year and name appropriately. Pseudonyms are accepted. Add a copy of the full plain text version of the license in the `licenses` folder if it isn't already in there. You should use `/*!` instead of `/*` for license comments so that JavaScript minifiers won't remove it.
-
-Extension images in the [images](images) directory are instead licensed under the [GNU General Public version 3](licenses/GPL-3.0.txt).
-
-## Banned licenses
-
-You **MUST** avoid using any code or images under these licenses as we believe they are incompatible with the GPLv3:
-
- - Creative Commons Attribution-ShareAlike licenses prior to version 4.0
-   - This includes user-generated content on the Scratch website which [uses version 2.0](https://scratch.mit.edu/terms_of_use) of this license.
-   - This includes StackOverflow posts contributed before 2018-05-02 which [use several different versions](https://stackoverflow.com/help/licensing).
- - Creative Commons Attribution-NoDerivs and similar "no derivatives" licenses
- - Creative Commons Attribution-NonCommercial and similar "non commercial" licenses
- - This list is non-comprehensive
- - More information: https://www.gnu.org/licenses/license-list.en.html
-
-We take licenses very seriously. License violations are one of the few things that can force us to break project compatibility.
-
 ## Type checking
 
 If you use our development server, TypeScript aware editors such as Visual Studio Code will give you smart autocomplete suggestions for most Scratch and extension APIs based on [@turbowarp/types](https://github.com/TurboWarp/types) and [@turbowarp/types-tw](https://github.com/TurboWarp/types-tw). Note that these types are not perfect; some methods are missing or incorrect. Please report any issues you find.

README.md

@@ -10,6 +10,10 @@ See [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## License
 
-By default, files in this repository are licensed under the [MIT License](licenses/MIT.txt). However, there are exceptions. Files that are under a different license will have a license header at the top of their code or in an adjacent README file.
+Extensions (in the `extensions` folder) will have a comment at the top of the file describing the license for the code. In the past [MIT](./licenses/MIT.txt) was the default, however now [LGPL-3.0](./licenses/LGPL-3.0.txt) is recommended. Some extensions may contain a mix of both.
 
-All images in the "images" folder are licensed under the [GNU General Public License version 3](licenses/GPL-3.0.txt). See [images/README.md](images/README.md) for attribution information for each image.
+Sample projects (in the `samples` folder) are licensed under [CC-BY 4.0](./licenses/CC-BY-4.0.txt).
+
+Everything else, such as the extension images, development server, and website, are licensed under the [GNU General Public License version 3](licenses/GPL-3.0.txt).
+
+See [images/README.md](images/README.md) for attribution information for each image.

development/builder.js

@@ -207,6 +207,22 @@ class ExtensionFile extends BuildFile {
       );
     }
 
+    if (!metadata.license) {
+      throw new Error(
+        "Missing // License: -- We recommend using // License: LGPL-3.0"
+      );
+    }
+
+    const spdxParser = require("spdx-expression-parse");
+    try {
+      // Don't care about the result -- just see if it parses.
+      spdxParser(metadata.license);
+    } catch (e) {
+      throw new Error(
+        `${metadata.license} is not a valid SPDX license. Did you typo it? It is case sensitive. We recommend using // License: LGPL-3.0`
+      );
+    }
+
     for (const person of [...metadata.by, ...metadata.original]) {
       if (!person.name) {
         throw new Error("Person is missing name");

development/parse-extension-metadata.js

@@ -20,6 +20,7 @@ class Extension {
     this.id = "";
     this.name = "";
     this.description = "";
+    this.license = "";
     /** @type {Person[]} */
     this.by = [];
     /** @type {Person[]} */
@@ -89,6 +90,9 @@ const parseMetadata = (extensionCode) => {
       case "description":
         metadata.description = value;
         break;
+      case "license":
+        metadata.license = value;
+        break;
       case "by":
         metadata.by.push(parsePerson(value));
         break;

extensions/-SIPC-/consoles.js

@@ -2,6 +2,7 @@
 // ID: sipcconsole
 // Description: Blocks that interact with the JavaScript console built in to your browser's developer tools.
 // By: -SIPC-
+// License: MIT
 
 (function (Scratch) {
   "use strict";

extensions/-SIPC-/time.js

@@ -3,6 +3,7 @@
 // Description: Blocks for times, dates, and time zones.
 // By: -SIPC-
 // By: SharkPool <https://scratch.mit.edu/users/DemonX5/>
+// License: MIT
 
 // If you're curious, the default dates are from the first commits of forkphorus & TurboWarp:
 // https://github.com/forkphorus/forkphorus/commit/632d3432a8a98abd627b1309f6c85f47dcc6d428

extensions/0832/rxFS2.js

@@ -2,6 +2,7 @@
 // ID: 0832rxfs2
 // Description: Blocks for interacting with a virtual in-memory filesystem.
 // By: 0832
+// License: MIT
 
 /*!
  * Made by 0832

extensions/Alestore/nfcwarp.js

@@ -3,6 +3,7 @@
 // Description: Allows reading data from NFC (NDEF) devices. Only works in Chrome on Android.
 // By: Alestore Games <https://scratch.mit.edu/users/aleb2005/>
 // Context: NFC stands for "Near-field communication". Ideally check a real phone in your language to see how they translated it.
+// License: MIT
 
 (function (Scratch) {
   "use strict";

extensions/CST1229/zip.js

@@ -2,6 +2,7 @@
 // ID: cst1229zip
 // Description: Create and edit .zip format files, including .sb3 files.
 // By: CST1229 <https://scratch.mit.edu/users/CST1229/>
+// License: MIT
 
 (function (Scratch) {
   "use strict";

extensions/Clay/htmlEncode.js

@@ -2,6 +2,7 @@
 // ID: clayhtmlencode
 // Description: Escape untrusted text to safely include in HTML.
 // By: ClaytonTDM
+// License: MIT
 
 (function (Scratch) {
   "use strict";

extensions/CubesterYT/WindowControls.js

@@ -3,6 +3,7 @@
 // Description: Move, resize, rename the window, enter fullscreen, get screen size, and more.
 // By: CubesterYT <https://scratch.mit.edu/users/CubesterYT/>
 // Original: BlueDome77
+// License: MIT
 
 // Version V.1.0.0
 

extensions/DNin/wake-lock.js

@@ -2,6 +2,7 @@
 // ID: dninwakelock
 // Description: Prevent the computer from falling asleep.
 // By: D-ScratchNinja <https://scratch.mit.edu/users/D-ScratchNinja/>
+// License: MIT
 
 (function (Scratch) {
   "use strict";

extensions/DT/cameracontrols.js

@@ -2,6 +2,7 @@
 // ID: DTcameracontrols
 // Description: Move the visible part of the stage.
 // By: DT
+// License: MIT
 
 ((Scratch) => {
   "use strict";

extensions/JeremyGamer13/tween.js

@@ -2,6 +2,7 @@
 // ID: jeremygamerTweening
 // Description: Easing methods for smooth animations.
 // By: JeremyGamer13 <https://scratch.mit.edu/users/JeremyGamer13/>
+// License: MIT
 
 (function (Scratch) {
   "use strict";

extensions/Lily/AllMenus.js

@@ -2,6 +2,7 @@
 // ID: lmsAllMenus
 // Description: Special category with every menu from every Scratch category and extensions.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
+// License: MIT AND LGPL-3.0
 
 (function (Scratch) {
   "use strict";

extensions/Lily/Assets.js

@@ -1,6 +1,7 @@
 // Name: Asset Manager
 // ID: lmsAssets
 // Description: Add, remove, and get data from various types of assets.
+// License: MIT AND LGPL-3.0
 
 // TheShovel is so epic and cool and awesome
 

extensions/Lily/Cast.js

@@ -2,6 +2,7 @@
 // ID: lmsCast
 // Description: Convert values between types.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
+// License: MIT AND LGPL-3.0
 
 (function (Scratch) {
   "use strict";

extensions/Lily/ClonesPlus.js

@@ -2,6 +2,7 @@
 // ID: lmsclonesplus
 // Description: Expansion of Scratch's clone features.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
+// License: MIT AND LGPL-3.0
 
 (function (Scratch) {
   "use strict";

extensions/Lily/CommentBlocks.js

@@ -2,6 +2,7 @@
 // ID: lmscomments
 // Description: Annotate your scripts.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
+// License: MIT AND LGPL-3.0
 
 (function (Scratch) {
   "use strict";

extensions/Lily/HackedBlocks.js

@@ -3,6 +3,7 @@
 // Description: Various "hacked blocks" that work in Scratch but are not visible in the palette.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
 // By: pumpkinhasapatch
+// License: MIT AND LGPL-3.0
 
 (function (Scratch) {
   "use strict";

extensions/Lily/ListTools.js

@@ -2,6 +2,7 @@
 // ID: lmsListTools
 // Description: An assortment of new ways to interact with lists.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
+// License: MIT AND LGPL-3.0
 
 // (It's getting harder and harder to think of original descriptions now)
 

extensions/Lily/LooksPlus.js

@@ -2,6 +2,7 @@
 // ID: lmsLooksPlus
 // Description: Expands upon the looks category, allowing you to show/hide, get costume data and edit SVG skins on sprites.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
+// License: MIT AND LGPL-3.0
 
 (function (Scratch) {
   "use strict";

extensions/Lily/McUtils.js

@@ -3,6 +3,7 @@
 // Description: Helpful utilities for any fast food employee.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
 // Context: Joke extension based on McDonalds, a fast food chain.
+// License: MIT AND LGPL-3.0
 
 /*!
  * Credit to NexusKitten (NamelessCat) for the idea

extensions/Lily/MoreEvents.js

@@ -2,6 +2,7 @@
 // ID: lmsMoreEvents
 // Description: Start your scripts in new ways.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
+// License: MIT AND LGPL-3.0
 
 (function (Scratch) {
   "use strict";

extensions/Lily/MoreTimers.js

@@ -2,6 +2,7 @@
 // ID: lmsTimers
 // Description: Control several timers at once.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
+// License: MIT AND LGPL-3.0
 
 (function (Scratch) {
   "use strict";

extensions/Lily/Skins.js

@@ -2,6 +2,7 @@
 // ID: lmsSkins
 // Description: Have your sprites render as other images or costumes.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
+// License: MIT AND LGPL-3.0
 
 (function (Scratch) {
   "use strict";

extensions/Lily/SoundExpanded.js

@@ -2,6 +2,7 @@
 // Description: Adds more sound-related blocks.
 // ID: lmsSoundExpanded
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
+// License: MIT AND LGPL-3.0
 
 (function (Scratch) {
   "use strict";

extensions/Lily/TempVariables2.js

@@ -2,6 +2,7 @@
 // ID: lmsTempVars2
 // Description: Create disposable runtime or thread variables.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
+// License: MIT AND LGPL-3.0
 
 (function (Scratch) {
   "use strict";

extensions/Lily/Video.js

@@ -2,6 +2,7 @@
 // ID: lmsVideo
 // Description: Play videos from URLs.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
+// License: MIT AND LGPL-3.0
 
 // Attribution is not required, but greatly appreciated.
 

extensions/Lily/lmsutils.js

@@ -2,6 +2,7 @@
 // ID: lmsutilsblocks
 // Description: Previously called LMS Utilities.
 // By: LilyMakesThings <https://scratch.mit.edu/users/LilyMakesThings/>
+// License: MIT AND LGPL-3.0
 
 (function (Scratch) {
   "use strict";