BSD-3-Clause with uncommon placeholders?

[wismann]

I just checked the NuGet provided BSD-3-Clause license against the version from spdx.org

https://licenses.nuget.org/BSD-3-Clause
https://spdx.org/licenses/BSD-3-Clause.html

Notable differences:
1.
SPDX:

3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote [...]

NuGet:

3. _____ be used to endorse or promote [...]

I think the generic wording is common and sufficient. There is no way on earth to fill this blank implicitly.

SPDX:

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" [...]
IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE [...]

NuGet:

THIS SOFTWARE IS PROVIDED BY _____ "AS IS" [...]
IN NO EVENT SHALL _____ BE LIABLE [...]

I think the generic wording is common and sufficient. No need for placeholders.

SPDX:

[...] AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES [...]

NuGet:

[...] AND ANY _____ OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES [...]

This placeholder does not make any sense to me.

Questions:

1. What is the source for the NuGet version of this license?
2. Is it necessary and/or advised to differ with the license text from most other sources?

[joelverhagen]

Great questions @wismann!

What is the source for the NuGet version of this license?

We use the JSON details files in here: https://github.com/spdx/license-list-data/tree/main/json/details. It's a manual process to fetch and process the files into our deployable directory here, and then another step to deploy them to licenses.nuget.org: https://github.com/NuGet/NuGet.Licenses/tree/main/src/NuGet.Licenses/App_Data/Licenses

Is it necessary and/or advised to differ with the license text from most other sources?

For these differences, it seems like we replace entire placeholders in the SPDX details JSON with ____. For example, this placeholder metadata in the BSD-3-Clause JSON <<var;name=\"bullet\";original=\"3.\";match=\".{0,20}\">> <<var;name=\"organizationClause3\";original=\"Neither the name of the copyright holder nor the names of its contributors may\";match=\"(The name of.+may not)|(Neither the name of.+nor the names of its contributors may)\">> gets replaced with ____.

It seems like we could take the original value instead of ____ but I am not certain right now since it seems there are several alternative words also included in the placeholder which we would be ignoring. We'll probably need to involve our internal legal counsel.

Thanks for bringing this to our attention!

[joelverhagen]

I've created a tracking issue here: NuGet/NuGetGallery#9344

[wismann]

Thank you for the fast reply and for considering a change here.
Having looked at the template originals I kind of see the reason why you would want to take the template version and replace fields with blanks instead of taking the text versions directly as they contain all kinds of textual placeholders like AUTHOR, YEAR and such.
I think the source material is not in the right condition to neither use it as a template nor to remove all placeholders without having strange effects like the one I saw.
Somebody should create real templates for license files (where you really have a finite set of variables) and don't misuse the templating for keeping alternate, equally valid text versions in one file. Its a mess.

[joelverhagen]

We talked internally and we are going to try including the original placeholder values, in a different color (like the SPDX website). For the top 10 used licenses on NuGet.org the original placeholder values look reasonable. If we hear from users about a situation where the placeholder is confusing/problematic, we can make fix-ups on a case-by-case basis or even pursue a data fix on the SPDX side (although I have never done that before).

Somebody should create real templates for license files (where you really have a finite set of variables) and don't misuse the templating for keeping alternate, equally valid text versions in one file. Its a mess.

Yes, I see it the same way. I think SPDX is the best we (as the OSS community) have. So I want to pursue quality in SPDX data in hopes that it will be that perfect data source we all want in the future. It already has served us quite well so I think we're not far off.

[joelverhagen]

Hey @wismann, I just wanted to give you a status update. We've updated licenses.nuget.org to show the full license text, including placeholder text. We've opted to use a similar style as the SPDX website:
https://licenses.nuget.org/BSD-3-Clause

The only remaining work I see is to improve the documentation page (https://learn.microsoft.com/en-us/nuget/nuget-org/licenses.nuget.org) to clarify what the different styles mean. I'll be working on that soon but I think we're already in a much better place.

Thanks so much for bringing this to our attention!

[pombredanne]

FYI, the texts from SPDX were never meant to be used as a reference text outside of SPDX homepage. There is unfortunately no such thing as a single BSD-3-Clause license text, instead there are over 500 significant known variations in the wild (I track 540+ in ScanCode).

Even for stable license text like Apache-2.0, the SPDX text is damaged, and only meant to be user to display that https://spdx.org/licenses/Apache-2.0.html HTML page, nothing else. It contains SPDX-specific parts that have nothing to do with providing a proper license text in NuGet IMHO.

See also:

• Investigate Definition and Notice Discrepancies in Integration Tests clearlydefined/operations#153 (comment)