Re: [PATCH 0/4] faster SHA-1 collision detection

[Junio C Hamano <gitster@pobox.com>]

"D. Ben Knoble" <ben.knoble@gmail.com> writes:

> The sha1collisiondetection submodule and the sha1dc code (extracted
> from that submodule's upstream, if I'm reading 28dc98e343 (sha1dc: add
> collision-detecting sha1 implementation, 2017-03-16) correctly?) are
> MIT licensed, too, so there is some precedent for Git here. I skimmed
> what I could find of the original threads:
>
> - https://lore.kernel.org/git/20170223195753.ppsat2gwd3jq22by@sigill.intra.peff.net/
> - https://lore.kernel.org/git/?q=sha1dc%3A+add+collision-detecting+sha1+implementation
>
> but I didn't see a discussion of licensing at that time. Perhaps the
> idea is that we are clear that such code carries a different license
> from Git?
>
> Anyway, I suppose the fair thing would then be for Scott's code to be
> MIT (and/or Apache2), in which case it would need similar
> clarifications? (Or are we prepared to take the stance that de nouveau
> code based on existing code can be license-washed, in this case to
> GPL-2?)
>
> Interestingly, Gentoo claims Git's license is only GPL-2, but I think
> they compile in the sha1dc code since it's the default in meson.
> Should we be claiming the Git package (with sha1dc) is actually GPL-2
> and MIT?

In the abov, Gentoo's mention is about "Git package" as a whole.
Git package as a whole can be distributed under GPLv2 only.

MIT, BSD-2 or BSD-3 are permissive and essentially says "you can do
whatever you want with the code (including combining with other code
or making it proprietary), as long as you keep our copyright notice,
keep our disclaimer, and (in the case of BSD-3) do not use our names
for endorsement".  Specifically, they do not forbid us from
incorporating their ware into our project that is licensed
differently, as long as we honor their licensing terms on the source
files we got from them.

Because we have mixed "permissive" code into GPLv2 code to form a
single "work based on the Program", GPLv2 Section 2(b) dictates that
the entire combined work must be distributed under the terms of the
GPLv2 (and again, the permissiveness of "other" licenses is what
allows us to do so).  You cannot distribute the finished binary or
the combined sources under a permissive license, because doing so
would violate the GPLv2's copyleft requirement.

The original "permissively licensed" files (and any modifications
made purely to those files) still maintain their original copyright
headers and original "permissive" license text.  This is because the
original copyright holder of the code granted a license to use their
files under the original "permissive" licensing terms, which
requires us to keep their copyright notice.  We do not own the
copyright to the original "permissive" code.  We are only licensed
to use them.  So we have no legal authority to strip these
"permissive" licenses or unilaterally "relicense" those files into
GPLv2.

So to answer your question in the last sentence, we should say "Git
package as a whole is GPLv2 only, but parts are borrowed from
copyright holders who licensed them under different terms, and these
parts can be used under these different parts.  For example, sha1dc
can be copied from our source tree to your non GPLv2 project as long
as you honor their MIT license".