[flashrom] What's the intended license for flashrom?

[Nico Huber]

On 29.01.2018 23:12, Carl-Daniel Hailfinger wrote:
> Hi Nico,
> 
> On 27.01.2018 15:49, Nico Huber wrote:
>> Hi Stefan,
>>
>> On 26.01.2018 23:43, Stefan Tauner wrote:
>>> On Fri, 26 Jan 2018 18:51:46 +0100
>>> Nico Huber <nico.h at gmx.de> wrote:
>>>
>>>> Hi folks,
>>>>
>>>> I've just noticed that most of flashrom is licensed under GPLv2 + any
>>>> later version, while about a third of the code base is GPLv2 only.
>>>> I wonder if that is intentional, or if any of the license headers was
>>>> just copy pasted and spread too much?
>>> Hi,
>>>
>>> using GPLv2 code in a GPLv2+ project is perfectly fine:
>>> https://www.gnu.org/licenses/gpl-faq.en.html#compat-matrix-footnote-2
>> of course. But given that people ask from time to time about libflashrom
>> GPLv2 might not be the only license involved.
>>
>>> Not sure about the "spread factor" but there are certainly *some* parts
>>> that are GPLv2 so there is not much incentive to look further IMHO...
>> Not to completely unify the licensing, no. But flashrom is rather
>> flexible concerning what is build into the binary. So we could still
>> strive to make it GPLv2+ in its core or something.
>>
>> Also, I am wondering if I should encourage contributors that add new
>> files to make it GPLv2+ or not.
> 
> 
> The decision to have parts of flashrom licensed unter GPLv2-only was a
> response to some external people wanting to add GPLv3+ code to the code
> base (or create a GPLv3/GPLv3+ fork for purely political reasons) many
> years ago. That would have made flashrom unusable for GPLv2-only
> projects, which would have been a bad thing for coreboot.
> Back then, I had asked RMS for advice on how to prevent a hostile GPLv3+
> takeover of a GPLv2+ codebase, and he told me that this was impossible
> for GPLv2+ code. Due to that, we kept parts of flashrom licensed under
> GPLv2-only. Back then, there was no GPLv3+ licensed project which would
> have qualified as potential user of flashrom code, so there weren't any
> downsides to that licensing decision.

Thanks for the elaboration. It's good to know that it was intentional.

> The wave of "let's GPLv3 all the things" seems to mostly have subsided now.
> 
> The decision of the preferred license for new files is hard. I think
> both GPLv2 and GPLv2+ are reasonable at first glance, but I feel
> uncomforable deciding this without reassessing the situation in detail.

Well, when I discovered the current situation, my first thought was, omg
what license is fwupd under. Because Richard Hughes intends to use lib-
flashrom there. Fortunately, it's (L)GPLv2+. Second thought, what we do
at secunet with coreboot updates in the payload would be impossible with
GRUB and flashrom.

> 
> As Stefan said, with some parts of flashrom being GPLv2-only there is
> not much incentive to look further...

I don't see it that final. Code can be relicensed, or rewritten if we'd
decide that some parts or all flashrom should have a different license.

It depends much on how seriously we take libflashrom, IMHO. GPLv2+ might
make a lot more use cases possible.

Nico