License confusion

[hrieke]

Hi,

You have a minor licensing discrepancy here. The nuget package page states the license for "Microsoft.CodeAnalysis.CSharp.Scripting", release 2.9.0 and later is the "Microsoft .NET Library License"
https://www.nuget.org/packages/Microsoft.CodeAnalysis.CSharp.Scripting/2.9.0

Could you have someone on the nuget team correct the page? Thanks

[jmarolf]

This is intentional. The code on this repository is licenced under the Apache 2.0 license. The binaries that are built and signed by Microsoft are licensed under the Microsoft .NET Library license

[hrieke]

Thank you for your prompt reply, happy holidays!

The license text and readme should reflected that the binaries built by Microsoft are licensed under different terms than the source code.

Have a wonderful New Year's and a joyous 2019.

[danielcrenna]

This is intentional. The code on this repository is licenced under the Apache 2.0 license. The binaries that are built and signed by Microsoft are licensed under the Microsoft .NET Library license

@jmarolf

Can you provide any clarity around whether the .NET Library License is compatible with copyleft consumers? I don't see anything specific, since the clause specific to protections around leaking .NET code to copyleft is specifically for sources and not obj files, which this package exclusively contains (i.e. Distributables).

In other words, does the benefit of having the package signed by Microsoft make this (and other) similarly licensed libraries incompatible with projects that reference permissive dependencies (Apache, etc.) but are licensed under copyleft? If that's the case, do you expect copyleft projects to build the Apache-licensed code separately?

If that's the case, this is a fairly significant discrepancy that most will miss, with consequences.

[jmarolf]

@danielchalmers I am not a lawyer and so cannot give you any interpretation of the Microsoft .NET Library license.

do you expect copyleft projects to build the Apache-licensed code separately?

I am aware of other open source projects (such as RedHat) that build .NET from source for redistribution. I do not know if the only reason they do that is licensing, if it is easier for their infrastructure, or some other reason.

Adding @terrajobst to see if he has more information here.

[terrajobst]

I think we're moving to model where we use the same license for binary that we use for source. I'll start a mail thread.

[danielcrenna]

@terrajobst is that mail thread accessible via mailing list, or internal only?

[terrajobst]

We generally don’t have discussions with our lawyers in public, so internal only. However, we’ll of course publicize the result. As I said, there is no secret here: we intend to align licenses between source code and binary whenever possible. It’s harder to do when the binary includes different kind of source code (licensed under different OSS licenses or including proprietary code). However, I’m not aware where we’d do this for .NET Core as we build the binaries entirely out of an OSS repo.

[danielcrenna]

Thanks for the clarification, I appreciate it.

[CyrusNajmabadi]

@terrajobst anything more to do here? can this issue be closed out?

[jmarolf]

The licenses for both the binaries and the source have been unified to be MIT. I think this can be closed now.