5 ms·

Does NPM require packages to use a license compatible with their asserting an irrevocable license to distribute said package? How is this verified? EDIT BELOW

Does NPM require packages to use a license compatible with their asserting an irrevocable license to distribute said package? How is this verified? EDIT BELOW I see some responses (three as of this writing) that quote their terms, and I want to clarify: I know what their terms state, but if those terms are incompatible with the license of the content being distributed, the terms would not be enforceable, or at the very least, would require mandatory arbitration (itself a clause hostile to the individuals accepting these terms) to invalidate. I guess it boils down to: Did attorneys actually vet these terms and practices, or are they banking on the collective generosity and "FOSS spirit" of the community to protect them from litigation?

bsimpson 11y ago
There is a license field in package.json. If you use npm init to generate that file, it will validate the option you choose against a list of known licenses. So far as I know, if you write your own package.json, there is no requirement to have a license field. Even if you use npm init, you can choose "UNLICENSED". I don't know off the top of my head if they have anything in their terms of use about the rights to permanently distribute published copies; I only know what the tooling enforces.
kibwen 11y ago
That's covered by their terms of service, quoted in the OP: "Your Content belongs to you. You decide whether and how to license it. But at a minimum, you license npm to provide Your Content to users of npm Services when you share Your Content. That special license allows npm to copy, publish, and analyze Your Content, and to share its analyses with others." Services like this have to account for such rights in their terms of service, because distribution is a minefield even for properly-licensed packages. For example, the MIT license covers only "this software and associated documentation files", which AFAICT means that if you have e.g. a screenshot in your repo then conceivably you could request a DMCA takedown on anyone distributing your repo. Likewise GPL doesn't cover anything but code, not even documentation (you're expected to remember to explicitly use the GNU Free Documentation License to cover that). IANAL, so I'd be happy if someone who was would chime in with any corrections.
- ajdlinux 11y ago
  Since when did the GPL not cover non-code artifacts? The FSF's view at http://www.gnu.org/licenses/gpl-faq.en.html#GPLOtherThanSoftware http://www.gnu.org/licenses/gpl-faq.en.html#GPLOtherThanSoft...: "You can apply the GPL to any kind of work, as long as it is clear what constitutes the “source code” for the work. The GPL defines this as the preferred form of the work for making changes in it. However, for manuals and textbooks, or more generally any sort of work that is meant to teach a subject, we recommend using the GFDL rather than the GPL."
joeyespo 11y ago
It appears that by publishing, you accept their terms in allowing them to distribute the package [1]. They also say they won't run the code directly (although they may analyze it), which might sidestep certain license issues. My guess is that it's no different than posting it on your own website and having the Internet Archive back it up. (IANAL. Just doing my best to interpret their policy.) [1]: https://github.com/npm/policies/pull/43/files https://github.com/npm/policies/pull/43/files
kibwen 11y ago
Responding to your edit: the OP mentions that lawyers were indeed involved in drafting these terms: "These lines are the result of a clarification that we asked our lawyer to make for the purposes of making this policy as understandable as possible. You can see that in this PR." The linked PR is https://github.com/npm/policies/pull/43/ https://github.com/npm/policies/pull/43/
- spdustin 11y ago
  I don't mean to sound so cynical, but anyone can say "our lawyer". When we wanted to make a change to our own agreements for our training services, our attorney said that any reference to an agreement or license must be styled in a way that makes it "official" (I'm paraphrasing here). Saying "you license npm to provide Your Content" and then referring to it as "npm's special license" is unclear, and thus difficult to enforce, when it's not called a "special license" in the first place, or styled something like "But at a minimum, you license npm to provide Your Content to users of npm Services when you share Your Content ("Special License")." Really, it should've read "You hereby grant npm, Inc. a worldwide, non-exclusive, royalty-free, sublicenseable and transferable license to use, reproduce, distribute, and display Your Content in connection with the services and web sites owned or operated by npm, Inc., its successors and its affiliates." I think I'll suggest that in a PR.
  - steveklabnik 11y ago
    The author of that PR is literally npm's laywer, https://kemitchell.com/cv.html https://kemitchell.com/cv.html > The University of Texas School of Law, Juris Doctor with Honors > State Bar of California, Attorney Member
    - spdustin 11y ago
      I stand corrected. I also submitted a PR that, since he's an attorney, can be evaluated for legal enforceability. I think it more clearly specifies the rights granted to npm, and is a nearly verbatim quote from the terms of a consulting agreement we've used with some clients in the past where we are hosting materials they create.
kbenson 11y ago
If it's out content you are uploading, you have the right to license it however you like in addition to the license you release publicly with. For example, there is nothing stopping you as the owner of GPL software from also selling commercial licenses. As such, requiring that NPM is provided specific capabilities does not conflict with any license, so long as the owner of the code is the one uploading it. Put another way, the license you ship with your code for usage by end users is not necessarily the entirety of the license NPM is bound by if you use their service. There's nothing really special about this, dual licensing is used all the time.

bsimpson 11y ago

There is a license field in package.json. If you use npm init to generate that file, it will validate the option you choose against a list of known licenses. So far as I know, if you write your own package.json, there is no requirement to have a license field. Even if you use npm init, you can choose "UNLICENSED". I don't know off the top of my head if they have anything in their terms of use about the rights to permanently distribute published copies; I only know what the tooling enforces.

kibwen 11y ago

That's covered by their terms of service, quoted in the OP: "Your Content belongs to you. You decide whether and how to license it. But at a minimum, you license npm to provide Your Content to users of npm Services when you share Your Content. That special license allows npm to copy, publish, and analyze Your Content, and to share its analyses with others." Services like this have to account for such rights in their terms of service, because distribution is a minefield even for properly-licensed packages. For example, the MIT license covers only "this software and associated documentation files", which AFAICT means that if you have e.g. a screenshot in your repo then conceivably you could request a DMCA takedown on anyone distributing your repo. Likewise GPL doesn't cover anything but code, not even documentation (you're expected to remember to explicitly use the GNU Free Documentation License to cover that). IANAL, so I'd be happy if someone who was would chime in with any corrections.

ajdlinux 11y ago
Since when did the GPL not cover non-code artifacts? The FSF's view at http://www.gnu.org/licenses/gpl-faq.en.html#GPLOtherThanSoftware http://www.gnu.org/licenses/gpl-faq.en.html#GPLOtherThanSoft...: "You can apply the GPL to any kind of work, as long as it is clear what constitutes the “source code” for the work. The GPL defines this as the preferred form of the work for making changes in it. However, for manuals and textbooks, or more generally any sort of work that is meant to teach a subject, we recommend using the GFDL rather than the GPL."

joeyespo 11y ago

It appears that by publishing, you accept their terms in allowing them to distribute the package [1]. They also say they won't run the code directly (although they may analyze it), which might sidestep certain license issues. My guess is that it's no different than posting it on your own website and having the Internet Archive back it up. (IANAL. Just doing my best to interpret their policy.) [1]: https://github.com/npm/policies/pull/43/files https://github.com/npm/policies/pull/43/files

kibwen 11y ago

Responding to your edit: the OP mentions that lawyers were indeed involved in drafting these terms: "These lines are the result of a clarification that we asked our lawyer to make for the purposes of making this policy as understandable as possible. You can see that in this PR." The linked PR is https://github.com/npm/policies/pull/43/ https://github.com/npm/policies/pull/43/

spdustin 11y ago
I don't mean to sound so cynical, but anyone can say "our lawyer". When we wanted to make a change to our own agreements for our training services, our attorney said that any reference to an agreement or license must be styled in a way that makes it "official" (I'm paraphrasing here). Saying "you license npm to provide Your Content" and then referring to it as "npm's special license" is unclear, and thus difficult to enforce, when it's not called a "special license" in the first place, or styled something like "But at a minimum, you license npm to provide Your Content to users of npm Services when you share Your Content ("Special License")." Really, it should've read "You hereby grant npm, Inc. a worldwide, non-exclusive, royalty-free, sublicenseable and transferable license to use, reproduce, distribute, and display Your Content in connection with the services and web sites owned or operated by npm, Inc., its successors and its affiliates." I think I'll suggest that in a PR.
- steveklabnik 11y ago
  The author of that PR is literally npm's laywer, https://kemitchell.com/cv.html https://kemitchell.com/cv.html > The University of Texas School of Law, Juris Doctor with Honors > State Bar of California, Attorney Member
  - spdustin 11y ago
    I stand corrected. I also submitted a PR that, since he's an attorney, can be evaluated for legal enforceability. I think it more clearly specifies the rights granted to npm, and is a nearly verbatim quote from the terms of a consulting agreement we've used with some clients in the past where we are hosting materials they create.

kbenson 11y ago

If it's out content you are uploading, you have the right to license it however you like in addition to the license you release publicly with. For example, there is nothing stopping you as the owner of GPL software from also selling commercial licenses. As such, requiring that NPM is provided specific capabilities does not conflict with any license, so long as the owner of the code is the one uploading it. Put another way, the license you ship with your code for usage by end users is not necessarily the entirety of the license NPM is bound by if you use their service. There's nothing really special about this, dual licensing is used all the time.