[META] Changes are required before it will be safe to assume code from Drupal.org's git repo is really GPLv2+ or GPLv2 compatible

I know this is going to be controversial, but the way licensing issues are being handled on D.O. has gotten so ridiculous it is no longer safe to assume that code you are downloading from Drupal.org is GPLv2+ or GPLv2 compatible. We've made a lot of progress making the Packaging Whitelist licensing policies much easier to understand, but what do we say to a developer who is told they can't add a library to their .make when other developers just commit the same files directly to git?

So now that I've publicly stated what most people who follow the Webmaster, Infrastructure, and Whitelist queue already know, what can be done about it?

The biggest change should be to consistently enforce the policies we already have. As a community, we are failing. I understand that no one has time to police all the code committed to git, but the current Webmasters don't act on licensing issues when they are reported. According to https://drupal.org/licensing/faq#q14 users are told to...

Please file an issue in the Webmasters issue queue (specify "Licensing problem" for the component) and we will look into the matter.

It really doesn't seem like anyone has ever known what to do with clear violations of the policies. When you look at https://drupal.org/project/issues/webmasters?status=All&component=Licensing, there are several reports of non-GPLv2 or non-GPLv2 compatible licensed code committed to git and nothing ever seems to happen. In some cases, the issues have existed for years and the modules are now used by thousands of sites.

#722554: flowplayer module includes Flash player protected with GPL 3 licence
#241881: Pageear/Curlypage GPL violation

Developers who follow the rules or ask for exceptions get nowhere slowly:

#2010902: Asking for exception so that Source Sans Pro font can be added to core
#2139273: Allow GPL Friendly Font Licenses
#1720156: Required permission to upload the 3rd party libraries to Drupal.org

Developers like who just commit something that isn't GPLv2+ or GPLv2 compatible can just continue to do it in project after project:

#2153121: Font Awesome is not GPL compatible and must be removed from git
#2153271: Font Awesome is not GPL compatible and must be removed from git

The only response from @themebrain has been to #2153139: Unpublish Distributions with Forks of Core < 7.32 which is where he creates even more issues by recommitting code from dozens of projects and third party libraries. I really thought that the way @themebrain ignored the licensing policies and committed thousands of redundant files from 3rd party libraries and Drupal.org project (including versions of core with security issues) would result in a quick response, but > 30 days later and there is no change to the projects. Releases are still published and users can still download code that isn't GPLv2+ or GPLv2-compatible from Drupal.org.

I had to go back to 2010 to find an example of an issue that resulted in someone actually removing files when the developer didn't respond to a licensing issue themselves.

I'm willing to help with this, but I think we need to establish some clear steps for what should happen after a violation is identified before taking action on any of the current issues.

Is there a document that describes what is supposed to happen when licensing issues are reported?
How long do you give a project maintainer to respond?
If they refuse to remove the files or add files they've been told are a licensing violation, what happens next?
Who has the final say on legal licensing questions if the developer disagrees with the interpretation of GPL compatibility?
Does the 3rd party code policy even matter any more?
Do we need to wipe all records of a file from git or is simply unpublishing the project's releases and posting a note to the project page enough?
If the project maintainers refuse to address a licensing issue, does everyone with permission to maintain a project lose their git privileges, only the person who made the offending commit, only the project node's owner?

I recently reopened #1245534: Using a third party library in mytinytodo. In that case the developer asked about GPLv3, was clearly told no, then when ahead and committed files w/ a GPLv3 license anyway. The response is that we again have to ask, so what do we do about this? The developer now says that the GPLv3 licensed files will eventually be re-licensed by the original author as GPLv2+. How long do we wait for a license to be changed? Is it OK to leave the Apache 2.0 licensed Bootstrap files in projects if we know future versions of that library will be licensed as MIT or do any files from versions of Bootstrap that aren't licensed properly need to be removed?

I personally think there should be changes to the strict GPLv2+ or GPLv2-compatible policies for distributions and fonts, but until/unless that happen the licensing policies need to be enforced consistently if we want to continue telling people that what they download from Drupal.org is GPLv2+ or GPLv2-compatible.