[R-pkg-devel] Licenses

[Marc Schwartz]

On Oct 22, 2020, at 3:47 PM, Duncan Murdoch <murdoch.duncan using gmail.com> wrote:
> 
> On 22/10/2020 12:56 p.m., Marc Schwartz wrote:
>>> On Oct 22, 2020, at 12:12 PM, Duncan Murdoch <murdoch.duncan using gmail.com> wrote:
>>> 
>>> On 22/10/2020 11:55 a.m., Marc Schwartz wrote:
>>>>> On Oct 22, 2020, at 11:19 AM, Marc Schwartz <marc_schwartz using me.com> wrote:
>>>>> 
>>>>> On Oct 22, 2020, at 10:21 AM, Kevin R. Coombes <kevin.r.coombes using gmail.com> wrote:
>>>>>> 
>>>>>> Hi,
>>>>>> 
>>>>>> I am developing a package and getting a NOTE from R CMD check about licenses and ultimate dependencies on a restrictive license, which I can't figure out how to fix.
>>>>>> 
>>>>>> My package imports flowCore, which has an Artistic-2.0 license.
>>>>>> But flowCore imports cytolib, which has a license from the Fred Hutchinson Cancer Center that prohibits commercial use.
>>>>>> 
>>>>>> I tried using the same license as flowCore, but still get the NOTE. Does anyone know which licenses can be used to be compatible with the Fred Hutch license? Or can I just do what flowCore apparently does and ignore the NOTE?
>>>>>> 
>>>>>> Thanks,
>>>>>>  Kevin
>>>>> 
>>>>> 
>>>>> Hi Kevin,
>>>>> 
>>>>> I have not looked at BioC's licensing requirements, but presumably, they are ok with the non-commercial use restrictions placed on users of cytolib, thus also on flowCore.
>>>>> 
>>>>> If you want your package to be on CRAN, those restrictions on users are not allowed by CRAN's policy:
>>>>> 
>>>>> https://cran.r-project.org/web/packages/policies.html
>>>>> 
>>>>> "Such packages are not permitted to require (e.g., by specifying in ‘Depends’, ‘Imports’ or ‘LinkingTo’ fields) directly or indirectly a package or external software which restricts users or usage."
>>>>> 
>>>>> 
>>>>> Thus, you would seem to need to make a decision on hosting your package on CRAN, but without the need to import from flowCore/cytolib, or consider hosting your package on BioC, with the attendant restrictions on commercial use.
>>>>> 
>>>>> Regards,
>>>>> 
>>>>> Marc Schwartz
>>>> Well....
>>>> Now that I look at:
>>>>   https://svn.r-project.org/R/trunk/share/licenses/license.db
>>>> there are a few licenses listed there that do place restrictions on commercial use.
>>>> These include some Creative Commons Non-Commercial use variants and the ACM license.
>>>> Is the license DB file out of date, or is there an apparent conflict with the CRAN policy that I quoted above?
>>>> Anyone with an ability to comment?
>>> 
>>> Presumably CRAN would not accept the non-FOSS licenses that are listed in license.db, but R could still do computations on them, as described in ?library in the "Licenses" section.
>>> 
>>> Duncan Murdoch
>> Duncan,
>> That is a reasonable distinction.
>> However, upon searching CRAN with available.packages(), I came up with a list of packages that do include Non-Commercial restrictions, including CC BY-NC* and ACM licenses. There may be others that I missed visually scanning the output.
>> There also appear to be some conflicts/inconsistencies with the 'License_restricts_use' field entry and the 'License' field in some cases, where, for example, most that have "CC BY-NC-SA 4.0" as the license, have "NA" as the entry for restricted use, rather than "yes".
>> I am not going to list them here, as I don't want to pick on any particular package, but this does seem to point to an inconsistency between packages that are hosted on CRAN and the articulated policy...
> 
> Perhaps those packages were accepted before this became a policy, and now that others depend on them, it would be too disruptive to remove them, and users are warned via the 'License_restricts_use' field entry. Why does it sometimes contain errors?  That I don't know, other than blaming it on Murphy's Law.
> 
> Duncan Murdoch


Hi Duncan,

That seems a reasonable scenario.

Right now, the interpretation, without further clarification from CRAN, would be, it is ok for a package to be on CRAN with license based usage restrictions included (e.g. for non-commercial use), but a package on CRAN, irrespective of it's own license, cannot "interact" with other packages that do have restrictions...which seems inconsistent.

Back to the original question by Kevin, this would now seem to be even more confusing...

Kevin, you may need to send an e-mail to CRAN-submissions using R-project.org <mailto:CRAN-submissions using R-project.org> on the issue with your package, to get clarification on the current policy and recommendations for resolution. You might even want to include this thread (but don't cc: this list), so that they are aware, if not already, of the issues raised here.

If you do, please post back with an update.

Regards,

Marc


	[[alternative HTML version deleted]]