Hi,
For work, I was asked to deploy a TimescaleDB server and figured "bah,
that's C code, why isn't this in Debian!" I was about to file an RFP
when I tripped over the "unknown" license on their GitHub repository:
https://github.com/timescale/timescaledb/
I found that it's not actually licensed under an official, OSI-approved
free software license. A *part* of Timescale is licensed under
Apache-2.0, and that's fine, but a look at their LICENSE file:
https://github.com/timescale/timescaledb/blob/3c56d3ecebbf476293ff43ded142bc9e5087f6de/LICENSE
... which actually says:
All source code should have information at the beginning of its respective file
which specifies its licensing information.
* Outside of the "tsl" directory, source code in a given file is licensed
under the Apache License Version 2.0, unless otherwise noted (e.g., an
Apache-compatible license).
* Within the "tsl" folder, source code in a given file is licensed under the
Timescale License, unless otherwise noted.
When built, separate shared object files are generated for the Apache-licensed
source code and the Timescale-licensed source code. The shared object binaries
that contain `-tsl` in their name are licensed under the Timescale License.
Okay, so what's in that `tsl/` folder? there you have *another* LICENSE
file which is a custom license written specifically (presumably by
lawyers) for timescaleDB:
https://github.com/timescale/timescaledb/blob/3c56d3ecebbf476293ff43ded142bc9e5087f6de/tsl/LICENSE-TIMESCALE
I haven't read the entirety of it, but it's pretty clear to me that this
cannot be packaged in Debian at all, ever, under that license. Just
clause 2.2 (prohibiting use in "software-as-a-service") breaks clause 6
of the Debian free software guidelines. There's also limitations on modification and distribution, and (rather oddly I must say) a GPL-like contamination clause.
The SaaS clause looks a bit like the MongoDB-tyle of license (SSPL and friends), which the OSI hasn't actually made a formal decision on,
because MongoDB retracted their application:
https://opensource.org/LicenseReview032019
... but OSI actually made a *statement on that license explicitly saying
that it's not "open source":
https://opensource.org/sspl-not-open-source
No doubt the latter was previously discussed here, but I figured I would mention it for completeness's sake.
I should also state, for the record, that I am not a lawyer and the
above cannot, therefore, serve as legal advice.
Anyways, lots of fun, I almost have a headache now, but I figured I'd
drop this here because I haven't found a mention of TimescaleDB on any
Debian mailing list before. I figured I would save the trouble of future enthusiasts by sharing my research more broadly.
a.
PS: I don't think we'll use this at work, but you never know. Curious
folks can followup here:
https://gitlab.torproject.org/tpo/tpa/team/-/issues/40770
There's more juicy stuff regarding the way we can use Timescale at all ,
even if we disregard the "DFSG-style" discussion...
--
You can't get to the moon by climbing successively taller trees.
- Akin's Laws of Spacecraft Design
--=-=-Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCAAdFiEEexZCBNCWcjsBljWrPqHd3bJh2XsFAmKfeKAACgkQPqHd3bJh 2XvS8Qf9FKJG2KZYsL/D8SqfYlc3KNcgSDu2lg0sP9bYu4aSMCxMUEX3lyM4Qf2O auD9GEe8lCggyl9hFT9RYEfNCYK8KVXdnfSMizTr18ySMsGSmLMdrsJ3QU9yZ6t9 rQswy+ssj8rbjGuj1X+qezcrcY2tN/ZHdps7AKLryJxwAtYDuyZV01ZkIzcpBPPe hCVyD52jiOfHYqUDdvPcLQ2TJeCebt0gDUpDL9TrQqEq7Zg3pqmcPG1n9Gt81PG8 O8lYi1pLbLOVicYtmaxN5/aEP+vjgTgG1Mqt2KNOSXrmigdYEeNRDrB0nBO/2xxj LzxonF85Wi1UnnvVwpjsM2C0sVcJWQ==q2Un
-----END PGP SIGNATURE-----
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)