Just one additional bit of information on this topic.
The JSON format for the License data was upgraded a couple years back to reflect the state of the “other URL”. The implementation isn’t perfect as it relies on less than perfect pattern matching and sometimes firewalls get in the way if URL validation. But if you want to see that information, you can go to https://spdx.org/licenses/[license-id].json where [license-id] is the ID of the license. You’ll find a section “crossRef” which will have the URL plus the additional information including if we find a match to the license in the text. Here’s the output for the Unicode-TOU: "crossRef": [ { "match": "false", "url": "http://www.unicode.org/copyright.html";, "isValid": true, "isLive": true, "timestamp": "2023-02-17T20:57:00Z", "isWayBackLink": false, "order": 0 } ], "seeAlso": [ "http://www.unicode.org/copyright.html"; ], Best, Gary From: Spdx-legal@lists.spdx.org <Spdx-legal@lists.spdx.org> On Behalf Of Luis Villa Sent: Tuesday, February 21, 2023 12:26 PM To: jae...@jbb.de; Steve Winslow <swins...@gmail.com> Cc: Spdx-legal@lists.spdx.org Subject: Re: Unicode I wonder if (at least going forward) it makes sense to use an archival URL service like https://perma.cc/ to create a URL that preserves the relevant site at the time the license was added to the database? Social: @luis_in_br...@social.coop <https://social.coop/@luis_in_brief> ML news: openml.fyi <https://openml.fyi> On Feb 21, 2023 at 11:55 AM -0800, Steve Winslow <swins...@gmail.com <mailto:swins...@gmail.com> >, wrote: Whoops -- accidentally just sent this to Till, re-sending to the full list: = = = = = Hi Till, please see my thoughts inline below: On Tue, Feb 21, 2023 at 2:19 PM Till Jaeger via lists.spdx.org <http://lists.spdx.org> <jaeger=jbb...@lists.spdx.org <mailto:jbb...@lists.spdx.org> > wrote: Dear all, Sorry to bring this up again. 1. I suggest to correct the information on https://spdx.org/licenses/Unicode-TOU.html The link provided under "Other web pages for this license" points to a different text (http://www.unicode.org/copyright.html) than the one at https://spdx.org/licenses/Unicode-TOU.html. [SDW] From a quick search on the Internet Archive, that URL appears to have been the correct URL for that version of the website text at one point in time (at least as of July 2014: http://web.archive.org/web/20140704074106/http://www.unicode.org/copyright.html <http://web.archive.org/web/20140704074106/http:/www.unicode.org/copyright.html> ). The purpose of the "other URLs" section of each license is _not_ to be a now-current source for that license text, but rather to include URLs which may have been a source for it in the past (as they may be useful for scanning tools, human review, etc. when finding URLs embedded in source code). We don't remove inactive or no-longer-valid URLs because they may remain useful for identification purposes -- see https://github.com/spdx/license-list-XML/blob/main/DOCS/license-fields.md (section C) for one place where this is mentioned. It should be stated that the link points to a newer version of the TOU. [SDW] This could perhaps be added to the "Notes" for the Unicode-TOU license, but I'm a little hesitant to do so. For the reasons mentioned above, any of the "other URLs" for any license on the SPDX license list may be incorrect, and I don't think we go through to regularly re-confirm that any of them match the present text. Follow-up issue: Unicode files refer to http://www.unicode.org/copyright.html,i.e. as the most recent version of the text provided on that site (a kind of dynamic reference). So people may be confused if they take the text from the Unicode TOU instead of the most recent text. Any suggestions on how to deal with this problem? [SDW] I think this is a recurring issue when license stewards reuse old URLs to change the text of a license. https://www.gnu.org/licenses/gpl.html used to point to GPL-2.0 (see http://web.archive.org/web/20030207060604/https://www.gnu.org/licenses/gpl.html <http://web.archive.org/web/20030207060604/https:/www.gnu.org/licenses/gpl.html> ) until it later pointed to GPL-3.0 (see http://web.archive.org/web/20100210183622/https://www.gnu.org/licenses/gpl.html <http://web.archive.org/web/20100210183622/https:/www.gnu.org/licenses/gpl.html> ). That URL can show up in source code with the author's intent of it having referred to either version. No matter how we handle URLs on the SPDX License List, URLs at most _may_ be helpful for identifying a license, but frequently aren't going to be solely reliable in plenty of cases. 2. I suggest to correct the information on https://spdx.org/licenses/Unicode-DFS-2016.html The link provided under "Other web pages for this license" points to the TOU instead of the "UNICODE, INC. LICENSE AGREEMENT - DATA FILES AND SOFTWARE. [SDW] The "other URLs" link currently listed there -- http://www.unicode.org/copyright.html -- appear to have previously been a source for finding the Unicode-DFS-2016 license text. http://www.unicode.org/copyright.html as of August 2016 (http://web.archive.org/web/20160823201924/http://www.unicode.org/copyright.html <http://web.archive.org/web/20160823201924/http:/www.unicode.org/copyright.html> ) appears to have had Unicode-DFS-2016 as the license text in Exhibit 1 on that page. It should be stated that a newer version of this agreement is available at https://www.unicode.org/license.txt. [SDW] From a quick look, that does appear to be a valid URL containing the text for Unicode-DFS-2016 (though I haven't checked carefully to confirm it's a match). Assuming it is, I agree that https://www.unicode.org/license.txt could be added as an additional "other URL" for it. I see the problem with dynamic references on websites but SPDX shouldn't incorrect links. Of course, it would be nice to have SPDX identifiers for the most recent versions of the TOU and Unicode-DFS. Best, Till Am 31.10.22 um 12:20 schrieb Till Jaeger via lists.spdx.org <http://lists.spdx.org> : > Dear all, > > I'm wondering why https://spdx.org/licenses/Unicode-TOU.html is (still) > part of the license list. Could it be deprecated? > > 1. > First of all, the current text of the "Unicode® Copyright and Terms of > Use" is quite different from the text which is referenced at > https://spdx.org/licenses/Unicode-TOU.html (SPDX License Diff is very > helpful to show the differences - thanks again to Alan Tse). > > 2. > Sec. C.3 of the current version refers to the "Unicode Data Files and > Software License": > > "Further specifications of rights and restrictions pertaining to the use > of the Unicode DATA FILES and SOFTWARE can be found in the Unicode Data > Files and Software License." > > The "Unicode Data Files and Software License" > (https://www.unicode.org/license.txt) is similar but not identical to > "https://spdx.org/licenses/Unicode-DFS-2016.html";. > > 3. > To me it seems that the "Unicode® Copyright and Terms of Use" are more > or less ToU for a website and all redistributables are under "Unicode-DFS". > > 4. > Unicode modifies the "year" within the copyright notice from year to > year. The "Unicode Data Files and Software License" provides as follows: > > "this copyright and permission notice appear with all copies > of the Data Files or Software" > > Would this require to identify in which year the data and/or software > was copied from the Unicode website to use the license text with the > correct year? Would it be sufficient to use the most recent version of > the license text? Should this be reflected in the SPDX identifier? > > > Is there anybody with more background information who can give some > assistance? > > Best regards, > > Till > > > > > > > -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#3332): https://lists.spdx.org/g/Spdx-legal/message/3332 Mute This Topic: https://lists.spdx.org/mt/97116566/21656 Group Owner: spdx-legal+ow...@lists.spdx.org Unsubscribe: https://lists.spdx.org/g/Spdx-legal/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
