licensing open-source-software
Fork published on NuGet confusing users / unlist request
<p>Recently I got an e-mail from a package maintainer asking me to unlist my fork of said package from NuGet due to my fork &quot;confusing nuget users&quot;.</p>
<p>I've never encountered a request like this before and as I have a few more forks like that I now wonder whether I'm doing something wrong and if I should unlist my other forks as well.</p>
<ul>
<li>source code of the original package (any my fork too) is available on GitHub</li>
<li>there is no LICENSE.md file but in the readme is a section stating:</li>
</ul>
<blockquote>
<p>This project is Copyright © 2021 XXX. Free for non-commercial use. For commercial use please contact the author.</p>
</blockquote>
<ul>
<li>clicking &quot;License Info&quot; on NuGet brings up Apache 2.0 license for both the original repo and the fork <em>(which is weird as the author is prohibitng commercial use in GitHub readme without a commercial license)</em></li>
<li>Me and my friends needed to use the package with a change (a minor one but still blocking our use cases)</li>
<li>I've opened a PR with said change and got no response from the maintainer</li>
<li>hence I've published my fork to NuGet</li>
<li>the original package is called <code>Package</code>, my fork was available as <code>Package-lof</code> (my handle, unlisted after I got the request)</li>
</ul>
<p>Am I legally required to comply with this request to unlist?</p>

<p><em>If</em> you have validly received a copy of the source code under the Apache-2.0 license, then you have the right to create and publish modifications – and you could not be asked to take your fork down.</p>
<p>But it is not at all clear that you received the software under the Apache-2.0 license. You state that the licensing information for the source code mentions that it is “Free for non-commercial use”. There are a number of problems with this:</p>
<ul>
<li>Permission to <em>use</em> a software does not necessarily imply permission to create <em>derivatives</em>, i.e. to modify the software.</li>
<li>What counts as <em>non-commercial</em> is quite unclear. All Open Source licenses allow commercial use. If you only had permission to non-commercial use, you definitely can't license the software to others under the Apache-2.0 license.</li>
<li>It may be necessary to distinguish between the license of the NuGet package and the license of the source code on GitHub. The original author can disallow commercial use of the source code, while still allowing commercial use via an Apache-2.0-covered NuGet binary.</li>
</ul>
<p>Thus, it is quite possible that the creation and/or publication of your forked package constitutes copyright infringement.</p>
<p>Given that this licensing status is unclear, and that you don't have a particularly convincing argument that you received the <em>source code</em> under the Apache-2.0 license, the safest approach would indeed be to take your NuGet package down. Nevertheless, you might have been allowed to create a modified package for your own non-commercial purposes – but sharing it under the Apache-2.0 license is a problem.</p>
<p>A somewhat safer route might have been to reverse-engineer the Apache-2.0 licensed NuGet package instead of using the source code that doesn't have a clear license, but now it's probably to late.</p>
<p>Without understanding further details about this project, I would:</p>
<ul>
<li>Unlist the forked NuGet package.</li>
<li>Make sure that the forked source code does not claim that the entire source code is Apache-2.0 covered (but at most, your own modifications).</li>
<li>Use some other mechanism to share the modified software with your friend for your non-commercial purposes.</li>
<li>In the future, stick to dependencies that are clearly and unambiguously licensed under an OSI-approved Open Source license, taking into account that not all licenses require the source code to be made available under the same terms.</li>
</ul>
<p>For background on dealing with projects with unclear licenses, consider reading <a href="https://opensource.stackexchange.com/questions/1720/what-can-i-assume-if-a-publicly-published-project-has-no-license">What can I assume if a publicly published project has no license?</a> on Open Source Stack Exchange. From the <a href="https://opensource.stackexchange.com/a/1721">answer by RubberDuck</a>:</p>
<blockquote>
<p>[…] In short, the only thing you can safely assume is that you have no rights to do anything at all with this code. In the particular case of GitHub, you can fork the repository and view the code, but nothing more.</p>
</blockquote>

<p>It would appear from your description that the author released this under a license &quot;Free for non-commercial use&quot; Or possibly under the <a href="https://www.apache.org/licenses/LICENSE-2.0" rel="nofollow noreferrer">Apache 2.0 license</a>. In either case you have the right to create and distribute derivative works, which is what a fork would be. The original author has no eight to demand that you unlist your fork, or even rename it.  However, if users are in fact being confused, offering to rename might be courteous.</p>
<p>The author has, if you have described the situation correctly, given up many of the copyright-based rights that s/he wpould otherwise retain.</p>
