libpng changes over the years

[jlovejoy]

see https://gitlab.com/fedora/legal/fedora-license-data/-/issues/296

http://www.libpng.org/pub/png/src/libpng-LICENSE.txt is the URL for both libpng-2.0 and Libpng

the first part/license:

• is a match to libpng-2.0 (and this is the URL is referenced in the SPDX entry) which was added for version 3.5 in 2019

the second part/license:

• SPDX added https://spdx.org/licenses/Libpng.html in 2010 for version 1.4 of the SPDX License List (see https://lists.spdx.org/g/spdx/message/236?p=%2C%2C%2C20%2C0%2C0%2C0%3A%3Acreated%2C%2Clibpng%2C20%2C2%2C0%2C22079229
• discussion of this at https://lists.spdx.org/g/spdx/topic/22079227#msg235
• SPDX added what existed on that same URL at that point in time. See https://web.archive.org/web/20101202114005/http://www.libpng.org/pub/png/src/libpng-LICENSE.txt

BUT over the years, various things were updated such as the list of names and references to version numbers (which would be replaceable by SPDX matching guidelines, but need markup added)
More substantial text changes occurred as well:

• Feb 2016: pnggroup/libpng@f78d1cd#diff-c693279643b8cd5d248172d9c22cb7cf4ed163a3c98c8a3f69c2717edd3eacb7
• Feb 2016: pnggroup/libpng@08bd765#diff-c693279643b8cd5d248172d9c22cb7cf4ed163a3c98c8a3f69c2717edd3eacb7
• July 2018: pnggroup/libpng@c36c09f

libpng-2.0 was added in Nov 2018, which also altered some of the text order, see pnggroup/libpng@e79085a

question is for SPDX now: should these various changes over the years be handled with markup or constitute a new license?

[Pizza-Ria]

Looking at the delta view, the most material change is a comment stating "Updated LICENSE to say files in the contrib directory are not necessarily under the libpng license, and that some makefiles have other copyright owners." But that is always true ... one can never assume that a top level license applies to other files in the tree. So, I'm inclined to say there aren't substantive differences in this latest version and it could be handled with markup.

[jlovejoy]

tried to discuss on 12/12 legal call, but my notes above were not sufficient, so will review again and revise

[swinslow]

@jlovejoy Unless there are particular edits you've got ready now, I'll move this to 3.27.0 and we can aim to tackle it quickly after the 3.26.0 release is out.

[jlovejoy]

adding more thorough time line, starting with:

1. Dec 2010 - SPDX added https://spdx.org/licenses/Libpng.html for version 1.4 of the SPDX License List (see https://lists.spdx.org/g/spdx/message/236 and discussion prior at https://lists.spdx.org/g/spdx/topic/22079227#msg235 - SPDX added what existed on the URL: http://www.libpng.org/pub/png/src/libpng-LICENSE.txt at that point in time.
2. Jan 2011 - PNG already had made updates to data and version number, see commit -
3. July 2015 - consolidated one of the notices and added some names (not substantive)
4. Feb 2016 - added 2 paragraphs re: "some files have other copyright owners" after list of names. Also removed some text at end re: png logo and added Trademark paragraph. Added Export Control paragraph
5. July 2018 - updates to export control paragraph.
6. Nov 2018 - libpng-2.0 added at top, trademark, OSI, and export parts removed

[jlovejoy]

It was too hard to try to explain in text, so I've made a PR, which is failing and I can't figure out why. I also have a Google doc with comments and color-coding of the various changes over the years.

Overall, there isn't much that has changed substantively, but... mixing acknowledgments in between license text is not optimal for trying to match (and find) the actual license text!

[jlovejoy]

oh, and there is probably more markup needed, but until I can figure out why it's failing, not worth adding more