Switch from CC0 to MIT and Apache 2.0 licenses

[PyvesB]

This PR aims at finally rolling out the changes discussed in #3664. Other related PRs: #3736 and badges/squint#1.

Summarising my understanding of where we're at: after getting input from @espadrine, the original author of this project, @paulmelnikow proposed dual-licensing the project under both the MIT and Apache 2.0 licenses in #3664 (comment). Both @calebcartwright and @PyvesB are on board with the proposal, having added their 👍🏻. Worth noting that this dual licensing approach is also what we've rolled out in Shields-adjacent projects in the meantime, for example squint.

In this instance, I've labeled the copyright holder as Copyright Thaddée Tyl and contributors, to align with package.json entries which also list him as the author of the project.

As a side note, Paul had suggested adding a note about the history of the license in the README. Given we've now got a blog capability, I've instead leveraged that and written a short article, which feels like a more appropriate way of communicating the change to our users.

Amongst the current maintainers listed in the README, we're missing input from @jNullj. He's the only other active maintainer alongside me, I'm adding the needs-discussion label and treating his approval as a requirement for moving ahead with this change.

[github-actions]

	Messages
📖	✨ Thanks for your contribution to Shields, @PyvesB!
📖	Thanks for contributing to our documentation. We ❤️ our documentarians!

Generated by 🚫 dangerJS against 6b0814b

[paulmelnikow]

Thanks for pushing this forward. I think it's fine to mention Thaddée's name, though I'd like to be listed too as I at one point rewrote much of this project. Otherwise this looks good to me!

[PyvesB]

@chris48s would you like a mention as well?

[chris48s]

I feel like what goes in the licence document is more about "who is entitled to assert intellectual property rights over this thing" than "who gets credit for doing the work". As such, I'm not really bothered about being mentioned here. Probably simplifies things if I am not. Thanks though

[paulmelnikow]

Yea, agree it's more about acknowledgement.

The other person who has written a lot of code in this codebase is @calebcartwright.

[jNullj]

I think its a good change but what about compatibility with existing dependencies?
Using this table and looking at our package-lock.json I notice some incompatibilities.
Here is a summary of license-checker (next comment) you can see we have some CC0 & Unlicense that are not compatible...

[jNullj]

npx license-checker --summary

├─ MIT: 1746
├─ Apache-2.0: 112
├─ ISC: 110
├─ BSD-3-Clause: 62
├─ MIT-0: 58
├─ BSD-2-Clause: 33
├─ BlueOak-1.0.0: 8
├─ (MIT OR CC0-1.0): 8
├─ CC0-1.0: 6
├─ MIT*: 5
├─ Unlicense: 3
├─ (WTFPL OR MIT): 2
├─ Python-2.0: 1
├─ CC-BY-4.0: 1
├─ LGPL-3.0*: 1
├─ (AFL-2.1 OR BSD-3-Clause): 1
├─ MPL-1.1: 1
├─ Custom: https://github.com/dominictarr/event-stream: 1
├─ Public Domain: 1
├─ Custom: http://nodejs.org/api/stream.html: 1
├─ Apache*: 1
├─ (BSD-3-Clause OR GPL-2.0): 1
├─ MIT,Apache2: 1
├─ BSD*: 1
├─ (BSD-2-Clause OR MIT OR Apache-2.0): 1
├─ UNLICENSED: 1
├─ (BSD-2-Clause OR WTFPL): 1
├─ CC-BY-3.0: 1
└─ 0BSD: 1

[PyvesB]

My understanding was that we could use CC0/unlicense packages in an MIT or Apache project. I'm no lawyer, but what makes you say this is not the case?

[jNullj]

I might be wrong, im not a lawyer, i doubt we have one in the repo.
Aren't we obligated to the most permissive license or is it the other way around? We can use more permissive dependency then what we use as it gives us permission for more uses?
I gave it some more reading and it seems you could if you avoid conflicting requirements. In that case, CC0 for example should not cause an issue as it may allow us to use it for our MIT needs without restrictions.
This topic is very confusing.

Should we look at tools to manage that?

I could sum it like this, I prefer the new dual license, im just not sure how licenses should be managed project wise for compatibility.
Considering im not an expert for compatibility, my comment might not be very relevant here about the specifics of what we can or can't use.

[paulmelnikow]

If we might be violating a copyleft dependency, it would be by hosting a SaaS without providing the source code (which we don't) and such dependencies would be GPLv3 / AGPL which I'm not seeing in the list above.

Regardless it's an orthogonal question to the one here, which is the license to the Shields source.

If Chris doesn't want to be mentioned here, fine, though let's see if we can get Caleb's thoughts.

[jNullj]

Yea, I got off topic.
The changes proposed look good, And the re-license sounds like a good idea.

[rettinghaus]

You cannot change from a CC0 license, because with putting something under it you

overtly, fully, permanently, irrevocably and unconditionally waive, abandon, and surrender all of Affirmer's Copyright and Related Rights and associated claims

It is not possible to take it back.

[paulmelnikow]

This isn't about taking back what's already been published, it's about setting new terms under which future versions are published.

[rettinghaus]

Still, the CC0 license applied to every single file and every line in it permanently and irrevocably. You may put new code under a different license, but not the existing files. You would have to remove everything and write it again from scratch.

[paulmelnikow]

When something is in the public domain, you can do anything you want with it.

[PyvesB]

Similar to what Paul shared, we essentially fall under what I indicated in the blog:

This change means that new revisions of Shields will now be considered copyrighted work that builds upon and modifies the public domain code from earlier versions.