License issue since cftime split

[molinav]

Until version 1.4, the netCDF4-python library was released as a unique package including the cftime module, and the library was distributed with a license that resembles the Historical Permission Notice and Disclaimer (HPND) license (see https://opensource.org/licenses/HPND), which is very similar to the MIT license that was set recently in the upstream code.

Since version 1.4, the specific code for cftime was split into a separate repository (https://github.com/Unidata/cftime), and later cftime added a small portion of GPL code to handle the leap years in version 1.0.2. The inclusion of this code implies that cftime changed its license from HPND to GPL when this code snippet was added (as cftime would be considered a derivative work of this GPL snippet).

netCDF4-python is officially released currently using the MIT license, but since netCDF4-python has cftime as a dependency and cftime is released as GPL (as stated above), netCDF4-python would be considered a derivative work of cftime and therefore netCDF4-python can only have cftime as dependency if netCDF4-python is also released as GPL (note the difference with dynamic linking between GPL and LGPL).

I am not sure if the GPL license is intended for netCDF4-python, but I would assume it is not intended since netCDF4-python explicitly sets the license metadata as MIT in PyPI (https://pypi.org/project/netCDF4/1.5.5.1/). The current situation with the license may cause that people are downloading and using netCDF4-python thinking that the license is MIT but it actually inherits GPL from cftime, and this may be problematic for any project that is using netCDF4-python and that is not planned to be released as GPL.

At the moment, the only way to keep the old behaviour (HPND license/MIT-like license) is to:

• Keep netCDF4-python pinned in the requirements to < 1.4.
• Use a newer netCDF4-python, i.e. >= 1.4, but explicitly set the dependency cftime >= 1.0, < 1.0.2 in the requirements.

Possible solutions to the current license inconsistency would be:

• Update the netCDF4-python license to indicate that the package is GPL (probably not intended by the netCDF4-python developers).
• Request the cftime developers to replace the GPL snippet with equivalent code that has a license that is not propagated to derivative works.

[jswhit]

cftime uses some code that is derived from calcalcs that is GPL. Basically the calcalcs C code was translated to cython. I've asked the author of calcalcs if he is willing to change the license, but got no response.

[jswhit]

cftime really should only be an optional dependency. All that happens is the num2date, date2num and date2index functions are imported into the netCDF4 namespace (to preserve backwards compatibility from when they were part of the netCDF4 package). This import could be removed, or wrapped in a try/except block that issues a warning if the import fails.

EDIT: MFTime does use date2num.

[jswhit]

not sure making cftime optional by wrapping the import in a try/except really gets around the GPL issue though.

[jswhit]

Another option would be to remove the MFTime class which would eliminate the cftime dependency entirely.

[nbren12]

Just here to say that we ran into this issue as well. Maybe it would be worth throwing a license checker into the CI to catch this in the future.

[jswhit]

The next release of cftime will have the GPL'ed code replaced, and will be released under an MIT license (the same as netcdf4-python).

[jswhit]

cftime 1.4.0 is released under the same license as netcdf4-python, with no GPL