Clarify license scope and add third-party notices - #509
Open
gdevenyi wants to merge 1 commit into
Open
Conversation
The RABIES license is the Academic Public License, which limits use to non-commercial settings. RABIES ships alongside GPL and Apache-2.0 tools and non-commercial FSL, and the published container image redistributes all of them. APL clause 3 says that independent sections distributed as part of a package reliant on the Program must go out under the unmodified terms of this License. Read literally, that asserts the APL over the bundled GPL tools, which GPLv2 section 6 and GPLv3 section 10 forbid. The mere aggregation paragraph is the escape, but the image shipped only the APL file, with nothing to say the bundled tools keep their own terms. RABIES starts every external tool as a separate program through the shell. It links none of them into its own process, and every Python dependency is permissive. The aggregation holds; it only needed to be stated. Changes: - LICENSE and README.md: state that the APL covers the RABIES source code only. - THIRD_PARTY_NOTICES.md: list each bundled component, its license and its corresponding source. For the GPL binaries this satisfies GPLv3 section 6(d). AFNI relicensed on 2026-05-12 to public domain plus CC-BY-4.0, but src/niml/niml_md5.c is GPL-2.0-or-later and links into libmri, so the AFNI binaries stay a combined GPL work. The "or later" term lets us elect v3 and use 6(d) for everything. - Dockerfile: ship the notices file, and record the AFNI build in /AFNI_VERSION. The tarball URL carries no version, so 6(d) source correspondence needs the build recorded. - MANIFEST.in: ship the license files that the sdist dropped. Published rabies-0.6.1.tar.gz carried modified Apache-2.0 ICA-AROMA sources without mod_ICA_AROMA/license.md, which Apache-2.0 clause 4(a) requires. - setup.py: the license field wants a name, not a path. - CITATION.cff: add license-url. The CFF 1.2.0 license key is a strict SPDX enum, so the APL cannot go there. Still open, and not fixable here: the pinned optimized_antsMultivariateTemplateConstruction fork and simpleitk_timeseries_motion_correction both carry no license, and the DSURQE atlas is re-hosted without recorded consent from TCP/MICe. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G7y6AsLKDpgUfudksoHnXp
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The RABIES license is the Academic Public License (APL), which limits use to non-commercial settings. RABIES ships alongside GPL and Apache-2.0 tools and non-commercial FSL, and the published container image redistributes all of them.
APL clause 3 says that independent sections distributed as part of a package reliant on the Program must go out under "the unmodified terms of this License". Read literally, that asserts the APL over the bundled GPL tools — which GPLv2 §6 and GPLv3 §10 forbid, and which would terminate our right to distribute them. The mere-aggregation paragraph right after is the escape, but the image shipped only the APL file with nothing to say the bundled tools keep their own terms.
The aggregation itself is sound. RABIES starts every external tool as a separate program through the shell (
rabies/preprocess_pkg/utils.py:178,scripts/preprocess_scripts/structural-preprocessing.sh:139), links none of them into its own process, and every Python dependency is permissive. It only needed to be stated.What changed
LICENSE,README.md— state that the APL covers the RABIES source code only. This is the load-bearing change: it is what keeps the mere-aggregation position credible.THIRD_PARTY_NOTICES.md(new) — each bundled component, its license, and its corresponding source. For the GPL binaries this satisfies GPLv3 §6(d), so no three-year written offer is needed.Dockerfile— ship the notices file, and record the AFNI build in/AFNI_VERSION. The AFNI tarball URL carries no version, so §6(d) source correspondence needs the build recorded at build time.MANIFEST.in— ship the license files the sdist was dropping.setup.py— thelicensefield wants a name, not a path.CITATION.cff— addlicense-url. The CFF 1.2.0licensekey is a strict SPDX enum, so the APL cannot go there.On AFNI
AFNI relicensed on 2026-05-12: the NIH-authored majority is US public domain and the MCW portions are CC-BY-4.0. But AFNI's own
LICENSE.txtlistssrc/niml/niml_md5.cas GPL-2.0-or-later,src/Makefile.INCLUDE:2640putsniml_md5.oinNIML_OBJS, and:2776-2782links those intolibmri— thelibmri.sowe extract. The four AFNI binaries are therefore a combined work under GPL-2.0-or-later.The "or later" term lets us elect v3, which puts AFNI, minc-toolkit and GNU parallel all under §6(d). That is why this collapses to one notices file. GPLv3 §8 also cures past non-compliance for the v3 works once the notices land.
Verification
Built the sdist locally. It now carries
THIRD_PARTY_NOTICES.md,minc-toolkit-extras/LICENSE, andrabies/confound_correction_pkg/mod_ICA_AROMA/license.md— the Apache-2.0 text that was missing from the publishedrabies-0.6.1.tar.gz, which Apache-2.0 clause 4(a) requires.The Dockerfile change is not build-tested.
3dDespike -vershould work with onlylibmri.sopresent and is guarded with a fallback, but the PR build will confirm.Also checked and found clean: FSL redistribution is compliant. I pulled both conda packages —
fsl-baseships a top-levelLICENCE.FSLand 77 source files,fsl-melodicships 31 source files includingmelodic.cc. All three FSL redistribution conditions hold.Still open — not fixable in this repo
Gab-D-G/optimized_antsMultivariateTemplateConstruction(pinned atf12e6dc) has no license file, and we redistributemodelbuild.shandmodelbuild_averager.pyfrom it in both the sdist and the image. The CoBrALab upstream does carry the APL, but the fork is 6 commits ahead (COM initiation, winsorize, trimmed mean, the averager script), so repointing would lose functionality. Copy the APL into the fork, or upstream those commits. TheMANIFEST.inline is already in place for when the file exists.Gab-D-G/simpleitk_timeseries_motion_correction(pinned at8cc2b03) has no license file and nolicensefield in itspyproject.toml. It is a mandatory dependency baked into the image.scripts/install_DSURQE.sh:31-35, forced at line 57) and baked into the image. MICe terms require prior written consent for republication. Worth asking MICe to put an explicit license next to the atlas files.Items 1 and 2 are the two highest-severity findings and are a two-file change each.
This PR reflects an engineering review of the stated license terms, not legal advice.
🤖 Generated with Claude Code
https://claude.ai/code/session_01G7y6AsLKDpgUfudksoHnXp