Fix copyright

[scp93ch]

The copyright statements I've seen say "Copyright the Spyderisk Authors" or something similar. Copyright needs to be assigned to a legal entity. In this case, I think it needs to be "University of Southampton IT Innovation Centre".

Separately I suppose, should there also be a LICENCE file in the root, and the licence referred to in the README?

[danshearer]

The choice is between "a singular legal entity", or, "individual authors hold copyright", where each author is a human and therefore a legal entity. The University of Southampton has in various ways indicated that they do not mind how copyright is handled, so we are relatively free to make a decision now, as we go through the process of open sourcing Spyderisk.

Current situation

At the moment, "The Spyderisk Authors" refers to the file AUTHORS.md although that should be made clearer. Over in system-modeller's LICENSE.md file we say:

As of 2023, the copyright of the code in all Spyderisk source trees is owned by either the individual authors, or, quite often, the University of Southampton

There is room for improvement in system-modeller too (although not as much) in the sense that the University of Southampton should be listed as one of the authors because not all of the authors are individually claiming copyright even if they were employed by Southampton when they wrote the code.

The options

Consolidation, as proposed

We could get all the contributions written to date by employees of Southampton to date and, after speaking to the authors, assign it like you say, Copyright University of Southampton. Assuming all authors agree, that would be nearly 100% of all code. The reason to do this is that if in the future someone wanted to pay mega-dollars and get all this lovely code closed source, just one person in Southampton could make that happen. (The code already published on GitHub would not become closed source, but any code copyright solely by Southampton could be given to Megacorp under any license they want, which today is pretty much all code.) This is the advantage and the peril of consolidating copyright, because equally Southampton could in that case re-license under say the GPL. As time goes by this will be less and less feasible, because the code will become inextricably entwined by contributions that have no reason to have "(c) Southampton" on it. But still, you are quite correct, this could be the decision today.

Individual ownership, as partly the case now

Alternatively, and just as legitimately, since Southampton appear to be happy with any correct copyright assignment, some or many of the individuals who have written the code could hold the copyright. The task of some theoretical copyright change then becomes a lot harder, because each individual has to be contacted and their agreement secured. This tends to mean that the licensing will remain Apache 2 in perpetuity, which arguably increases stability. As noted in system-modeller under the heading What about 3rd Party GPL code? there is a problem with combining Apache code with GPL code in the sense that the compatibility only goes in one direction. However even this case would not force a relicense away from Apache, merely some awkward explaining that Spyderisk as a whole is now distributed under the terms of the GPL.

Conclusion

You raise a valid point, and it needs to be addressed one way or another.

And regardless of how this is resolved, more clarity is needed in these metadocs.

[scp93ch]

University of Southampton regulations are not crystal clear on this. See clause 3.1.

[danshearer]

I believe I have made some progress on this today, hopefully by next week this will be resolved and all parts of the Spyderisk project can be updated accordingly. We shall see.