The project contains tens of thousands mentions in various formats of
various licenses in various formats.
I did what I could, but there certainly is a space for improvement.
I hope the following description of my steps may serve as a solid
justification of my findings.
=========== =========== ===========
=========== =========== ===========
GPL & LGPL
There is a difference between "GPL-2.0-only" and "GPL-2.0-or-later"
https://spdx.org/licenses/GPL-2.0-only.htmlhttps://spdx.org/licenses/GPL-2.0-or-later.html
I understood that the license text is identical (I've ran 'diff' on top of them to verify)
and the difference is decided by the license header present in the files containing the code itself.
This "*-only" and "*-or-later" differenciation simmilar in other versions of GPL and LGLP
I like GREP. SO here we go:
\# This command is supposed to:
\# - find all occurrences of the string "Public License"
\# - prefixed by "GNU", "Lesser", "Library", "General", each word is optional (to match both GPL and LGPL and all variants of how people write them)
\# - while every word can have any number of any white characters - including newlines - between them (to match text wrapped between lines)
\# - all of that followed by string "version" (to only match text mentioning the specific version)
\# - with any characters between the first part and the "version" string
\# - followed by a digit (to exclude any result not talking about a concrete version specifically, e.g. text around string "from time to time" in the GPL licenses)
\# - match 3 more characters (so we catch the whole version number)
\# - but the "version" string and number must occur no later than any dot "." or double newline (to only match text inside the license texts or license headers, but not code)
\# Once found,
\# - and match everything until dot or double newline (for further parsing of the strings "or later" etc)
\# - replace any newline with space (" "), so the whole above match (as well s everything else) is put on a single line
\# - replace string in the variable DIR_NAME with the same string prepended by newline, so each result is on a separate line
❯ export DIR_NAME="mysql-8.4.6"
❯ export TMPFILE=$(mktemp)
❯ grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r "${DIR_NAME}" | sed ':a;N;$!ba;s/\n/ /g' | sed "s|${DIR_NAME}/|\n${DIR_NAME}/|g" > ${TMPFILE}
The resulting file contains 17894 results.
=========== =========== ===========
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 3" | tee >(wc -l)
retuns 10 results, from which:
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 3" | grep -i --binary-files=text -e " lesser" -e " library" | tee >(wc -l)
0 is LGPL
and
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 3" | grep -v -i --binary-files=text -e " lesser" -e " library" | tee >(wc -l)
10 is GPL
and
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 3" | grep -i --binary-files=text -e "later" -e " or" | tee >(wc -l)
10 results "GPL-3.0-or-later"
and
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 3" | grep -i --binary-files=text -e "later" -e " or" | tee >(wc -l)
0 results "GPL-3.0-only"
=========== =========== ===========
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 2" | tee >(wc -l)
retuns 17879 results, from which:
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 2" | grep -i --binary-files=text -e " lesser" -e " library" | tee >(wc -l)
15 is LGPL
and
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 2" | grep -v -i --binary-files=text -e " lesser" -e " library" | tee >(wc -l)
17864 is GPL
and
=========== =========== ===========
❯ cat ${TMPFILE} | grep -i --binary-files=text -e "version 2" | grep -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2[ ,;\<]" -e "version 2.0" | tee >(wc -l)
12 is LGPL 2.0
and
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 2" | grep -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2[ ,;\<]" -e "version 2.0" | grep -i --binary-files=text -e "later" -e " or " | tee >(wc -l)
0 is "LGPL-2.0-or-later"
and
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 2" | grep -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2[ ,;\<]" -e "version 2.0" | grep -v -i --binary-files=text -e "later" -e " or " | tee >(wc -l)
12 is "LGPL-2.0-only"
and
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 2" | grep -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2\.[^0]" | tee >(wc -l)
3 is LGPL 2.1
and
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 2" | grep -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2\.[^0]" | grep -i --binary-files=text -e "later" -e " or " | tee >(wc -l)
2 is "LGPL-2.1-or-later"
both findings are in the 'LICENSE' file.
However that doesn't necessiraly interests me, as the 'LICENSE' file is a list of just potential licenses.
and
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 2" | grep -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2\.[^0]" | grep -v -i --binary-files=text -e "later" -e " or " | tee >(wc -l)
1 is "LGPL-2.1-only"
the finding is in the 'LICENSE' file.
=========== =========== ===========
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 2" | grep -v -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2[ ,;\<]" -e "version 2.[0\s]" -e "version 2.\s" | tee >(wc -l)
17862 is GPL 2.0
and
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 2" | grep -v -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2[ ,;\<]" -e "version 2.[0\s]" -e "version 2.\s" | grep -i --binary-files=text -e "later" -e " or " | tee >(wc -l)
33 is "GPL-2.0-or-later"
found in:
extra/gperftools/
extra/libbacktrace/
router/
and
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 2" | grep -v -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2[ ,;\<]" -e "version 2.[0\s]" -e "version 2.\s" | grep -v -i --binary-files=text -e "later" -e " or " | tee >(wc -l)
17829 is "GPL-2.0-only"
~190 unique files with the FOSS 1.0 exception
~9500 unique files without it
and
❯ cat ${TMPFILE} | grep -i --binary-files=text "version 2" | grep -v -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2\.[123456789]" | tee >(wc -l)
2 GPL 2.1
weird ... GPL 2.1 doesn't exists, only LGPL 2.1 does
and by examining the files, both are false positives, as the text matched was: "The OpenLDAP Public License Version 2.8, 17 August 2003"
=========== =========== ===========
These were the GPL-family licenses.
=========== =========== ===========
=========== =========== ===========
Now I tired a search that omits any GPL-family license to see what remained.
❯ grep -i licens -r "${DIR_NAME}/" | \
grep -v \
-e "// This source code is licensed under both the GPLv2 (found in the" \
-e "// COPYING file in the root directory) and Apache 2.0 License" \
-e "// (found in the LICENSE.Apache file in the root directory)." \
-e "// Use of this source code is governed by a BSD-style license that can be" \
-e "// found in the LICENSE file. See the AUTHORS file for names of contributors." \
-e "it under the terms of the GNU General Public License as published by" \
-e "the Free Software Foundation; version 2 of the License." \
-e "GNU General Public License for more details." \
-e "You should have received a copy of the GNU General Public License" \
-e "it under the terms of the GNU General Public License, version 2.0," \
-e "but not limited to OpenSSL) that is licensed under separate terms," \
-e "as designated in a particular file or component or in included license" \
-e "separately licensed software that they have included with MySQL." \
-e "GNU General Public License, version 2.0, for more details." \
-e "License as published by the Free Software Foundation; either" \
-e "version 2.1 of the License, or (at your option) any later version." \
-e "Lesser General Public License for more details." \
-e "License along with this library; if not, write to the Free Software" \
-e "License version 2.1 as published by the Free Software Foundation." \
-e "the terms of the GNU General Public License as published by the Free Software" \
-e "License along with this library; if not, write to the Free" \
-e "version 2 of the License, or (at your option) any later version." \
-e "Library General Public License for more details." \
-e "License along with this library; if not see <http://www.gnu.org/licenses>" \
-e "GNU General Public License, version 2.0" \
| grep -i "licens" > ${TMPFILE}
Which yelds 33132 results to go through.
This is tremendously attention demanding, and likely place for oversights.
I've managed to discover the following:
=========== =========== ===========
❯ cat ${TMPFILE} | grep -i -e "separately licensed software that they have either included with" | wc -l
9347
This is the Universal-FOSS-exception-1.0. I had to check which licenses are these exceptions connected to.
I found it connected to "GPL-2.0-only".
Around 190 "GPL-2.0-only" licensed files have the exception, while around 9500 "LGPL-2.0-only" licensed files does not have it.
I found that all "LGPL-2.0-only" license files also have the exception.
=========== =========== ===========
❯ cat ${TMPFILE} | grep -i -e "www.boost.org/LICENSE_" -e "See accompanying file LICENSE_1_0.txt" -e "Version 1.0. (See accompanying file" -e "accompanying file LICENSE_1_0.txt" -e "Boost Software License" -e "http://www.boost.org/users/license.html" | wc -l
21337
The "BSL-1.0" license
=========== =========== ===========
❯ cat ${TMPFILE} | grep -i -e "apache license"
mysql-8.4.6/storage/ndb/test/crund/src/META-INF/persistence.xml: to you under the Apache License, Version 2.0 (the
mysql-8.4.6/storage/ndb/test/crund/src/META-INF/persistence.xml: http://www.apache.org/licenses/LICENSE-2.0
The "Apache-2.0" licnese
=========== =========== ===========
❯ cat ${TMPFILE} | grep -v -i -e "www.boost.org/LICENSE_" -e "See accompanying file LICENSE_1_0.txt" -e "Version 1.0. (See accompanying file" -e "accompanying file LICENSE_1_0.txt" -e "Boost Software License" -e "http://www.boost.org/users/license.html" | grep -v -i -e "apache" | grep -e "MIT"
The "MIT" license
=========== =========== ===========
❯ cat ${TMPFILE} | grep -v -i -e "www.boost.org/LICENSE_" -e "See accompanying file LICENSE_1_0.txt" -e "Version 1.0. (See accompanying file" -e "accompanying file LICENSE_1_0.txt" -e "Boost Software License" -e "http://www.boost.org/users/license.html" | grep -v -i -e "apache" | grep -v -e "MIT" | grep -e "BSD"
The "BSD-2-Clause" License
=========== =========== ===========
❯ cat ${TMPFILE} | grep -v -i -e "www.boost.org/LICENSE_" -e "See accompanying file LICENSE_1_0.txt" -e "Version 1.0. (See accompanying file" -e "accompanying file LICENSE_1_0.txt" -e "Boost Software License" -e "http://www.boost.org/users/license.html" | grep -v -i -e "apache" | grep -v -e "MIT" | grep -i -e "dual license"
mysql-8.4.6/storage/innobase/ut/crc32.cc: Dual licensed under BSD license and GPLv2.
The "( GPL-2.0-only OR BSD-2-Clause )" license
=========== =========== ===========
I hope I caught all of the licenses.
If that's not the case, please contribute a fix or at least report a bug against this package so we can correct it.
Related: RHEL-104250
MySQL is distributed under GPL v2, but there are some licensing exceptions
that allow the client libraries to be linked with a non-GPL application,
so long as the application is under a license approved by Oracle.
For details see
'The Universal FOSS Exception, Version 1.0':
https://oss.oracle.com/licenses/universal-foss-exception/
A predecessor of that license exception is now deprecated 'FOSS License Exception':
http://www.mysql.com/about/legal/licensing/foss-exception/
Some innobase code from Percona and Google is under BSD license.
Some code related to test-suite is under LGPLv2.
a094014ba0