AND license in crossbeam_channel

[nical]

Hi, I see that in #419 issues with AND usage of licenses were at least partly addressed and the master branch now has a license expressed as MIT AND BSD-2-Clause OR Apache-2.0 AND BSD-2-Clause.

I'm opening this ticket in the context of adding a dependency to crossbeam channel in webrender, for use Firefox. We have to somewhat meticulous about licenses. I am not personally well versed in the topic, so I will mostly quote the feedback I got at the license approval review:

"MIT AND BSD-2-Clause" is somewhat reasonable, but that's only because there's vanishingly little difference between the MIT and BSD-2 licenses: MIT implies some freedoms BSD-2 is explicit about, and that's just about it. Using OR here would not change the situation here significantly.

"Apache-2.0 AND BSD-2-Clause" is a problematic construct: Apache 2.0 provides explicit patent liability protection and the BSD-2-clause explicitly says you get no such protection.

Quoting from the conclusion of the license approval review: "If we're going to pull this in while staying compliant with the licenses involved we should ask upstream to either pick one or "OR" two, and we definitely don't want to permit "AND" as an acceptable predicate in our licensing logic because that way lies madness."

What particular guarantees do you mean to express through the current license? would it be possible to simplify it into MIT OR Apache-2.0 OR BSD-2-Clause?

[ghost]

Details about the licensing situation in crossbeam-channel: https://github.com/crossbeam-rs/crossbeam/tree/master/crossbeam-channel#third-party-software

I think we should exclude tests and examples from the package file. In that case, a published crossbeam-channel crate would only contain:

• Bounded MPMC queue by Dmitry Vyukov, licensed under the Simplified BSD License and the Apache License, Version 2.0.

To clarify, we're not quite copy-pasting that queue implementation - while the core idea of the queue algorithm is the same, the actual implementation has evolved quite a bit.

What if the license was then simply Apache-2.0 AND BSD-2-Clause? Would that work?

cc @taiki-e @cuviper

[jrmuizel]

I don't think so, because that says patent protection is provided and that it's not provided.

[nical]

My understanding is that Apache-2.0 AND BSD-2-Clause is problematic at least because the two have contradicting stances on patent liability protection. you could OR them but AND is undefined territory where the two license disagree.
Is the resulting license explicitly providing patent liability protection, or is it explicitly saying you get no such protection? AND would require it to be both.

[ghost]

@dvyukov Do you think it would be possible to use your bounded MPMC queue under Apache-2.0 OR MIT here? This would be the easiest solution it seems, if you’re okay with that.

[dvyukov]

Well, algorithms are not copyright-able, so if you just type it in yourself, you can use any licence ;)
And you probably will need to re-type it for code style/api reasons. A mention of the original source would be nice, though.