gh-95649: Document that asyncio contains uvloop code

[aloisklink]

Some of the asyncio SSL changes in GH-31275 were taken from v0.16.0 of the uvloop project. In order to comply with the MIT license, we need to just need to document the copyright information.

Design decisions

How did I pick the files to add licensing info to?

I went through commit 13c10bf and added the # SPDX-FileCopyrightText: ... for changes to any file that has substantial code taken from https://github.com/MagicStack/uvloop/tree/v0.16.0.

The uvloop MIT license copyright text is Copyright (c) 2015-present MagicStack Inc. http://magic.io, so I changed it to Copyright (c) 2015-2021 MagicStack Inc. http://magic.io, as when 13c10bf was committed, the uvloop code was last modified in 2021.

Why did I use the # SPDX-... comment format?

Since there isn't yet a standard way to document licensing/copyright info (see python/devguide#928 for the issue tracking this), I've used the # SPDX-FileCopyrightText/# SPDX-License-Identifier format since that's the SPDX spec, which is the most common method of doing copyright/licensing information, used by Linux.

Normally, we should also add a # SPDX-FileCopyrightText: Copyright (c) 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023 Python Software Foundation; All Rights Reserved line, but then we'd have to update the line every year, and I think the LICENSE file already covers this.

Why is there no # Licensed to PSF under a Contributor Agreement. comment?

As raised in #95649, there's no information about whether the contributor actually had the rights to relicense this code under the PSF.

Personally, the changes in Lib/asyncio seem to come from uvloop code authored by either @asvetlov, or @MagicStack employees, so it should be pretty easy to relicense these files under the PSF, assuming @MagicStack approves. See https://github.com/MagicStack/uvloop/commits/v0.16.0/uvloop/sslproto.pyx (MagicStack/uvloop@ef29dab is by an author that isn't @MagicStack or @asvetlov, but that change is pretty trivial, so it should still be okay to relicense).

However, Lib/test/test_asyncio/test_ssl.py seems to have a bunch of different authors from uvloop. And since there doesn't seem to be a uvloop CLA, even if @MagicStack approves, I don't think we can relicense this file under the PSF.

• Issue: New asyncio ssl implementation is lacking license and origin information #95649

---

📚 Documentation preview 📚: https://cpython-previews--107536.org.readthedocs.build/

[ghost]

All commit authors signed the Contributor License Agreement.

[AA-Turner]

As prior art (just looking through Lib):

• http.cookies, logging, profile, pstats, sqlite3, tarfile include the full licence text in comments
• optparse and platform use a __copyright__ variable.

Given that code was incorporated here, perhaps the best route is instead to add the full uvloop licence to Doc/licence.rst with a note in that file about which modules use the uvloop code?

A

[AA-Turner]

(Adding the backport labels as whatever the end result is, the correct licence notices should exist in Python 3.11, where the change first appeared.)

[aloisklink]

Given that code was incorporated here, perhaps the best route is instead to add the full uvloop licence to Doc/licence.rst with a note in that file about which modules use the uvloop code?

Already done! Although, I've just linked to the asyncio module in general, instead of the specific asyncio.xxxx modules. See

cpython/Doc/license.rst

Lines 1045 to 1069 in efa45b0

	asyncio
	----------
	The :mod:`asyncio` module contains the following notice::
	Copyright (c) 2015-2021 MagicStack Inc. http://magic.io
	Permission is hereby granted, free of charge, to any person obtaining
	a copy of this software and associated documentation files (the
	"Software"), to deal in the Software without restriction, including
	without limitation the rights to use, copy, modify, merge, publish,
	distribute, sublicense, and/or sell copies of the Software, and to
	permit persons to whom the Software is furnished to do so, subject to
	the following conditions:
	The above copyright notice and this permission notice shall be
	included in all copies or substantial portions of the Software.
	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
	EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
	MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
	NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
	LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
	OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
	WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

As prior art [other modules] include the full licence text in comments

We still need some information in each individual file, since CPython's LICENSE file says "Some software incorporated into Python is under different licenses. The licenses are listed with code falling under that license." (and it's best practice to put licensing info in each file, especially when it's different from the rest of licenses).

But sticking the full license text in every file is very verbose and difficult to summarize. It's why the Linux kernel and lots of other OSS projects have switched to using the SPDX standard, so people can just write SPDX-License-Identifier: xxxx instead of having the full license text in the comments (see https://lwn.net/Articles/739183/). We still should have the full text of the license somewhere, but that's covered by the Doc/license.rst file.

---

FYI, I'm not a lawyer, so I'm just following what other projects do, like the Linux kernel.

I'm going to ping @tiran, since as the author of #95649 and python/devguide#928, they probably care the most about this subject.

[AA-Turner]

Thanks for the update -- I realise I was unclear, I had intended to ask why we don't only include the notice in Doc/license.rst, but you've addressed my concerns. One suggestion on wording for the text in license:

Thanks!
Adam

[AA-Turner]

Suggested change

	The :mod:`asyncio` module contains the following notice::
	Parts of the :mod:`asyncio` module are incorporated from uvloop 0.16,
	which is distributed under the MIT license::

[aloisklink]

Good idea! Changed in aloisklink@d5aee03 (I've also made the uvloop 0.16 text a hyperlink to https://github.com/MagicStack/uvloop/tree/v0.16.0)

[AA-Turner]

@aloisklink please may you resolve the conflicts?

A

[aloisklink]

@aloisklink please may you resolve the conflicts?

Fixed! Thanks for the reminder :)

Although, I guess this means that there may now be conflicts if we backport this to Python 3.11/Python 3.12.

[miss-islington-app]

Thanks @aloisklink for the PR, and @AA-Turner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12.
🐍🍒⛏🤖

[miss-islington-app]

Sorry, @aloisklink and @AA-Turner, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker dce30c9cbc212e5455e100f35ac6afeb30dfd23e 3.12

[miss-islington-app]

Sorry, @aloisklink and @AA-Turner, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker dce30c9cbc212e5455e100f35ac6afeb30dfd23e 3.11

[AA-Turner]

@aloisklink do you want to have a go at the backports?

A

[bedevere-app]

GH-114045 is a backport of this pull request to the 3.11 branch.

[bedevere-app]

GH-114046 is a backport of this pull request to the 3.12 branch.