[ClusterLabs Developers] [booth][sbd] GPLv2.1+ clarification request

Tue Mar 22 18:18:20 UTC 2016

On Mon, Mar 21, 2016 at 10:03:12PM +0100, Jan Pokorný wrote:
> On 18/03/16 16:16 +0100, Lars Ellenberg wrote:
> > On Thu, Mar 17, 2016 at 07:12:19PM +0100, Dejan Muhamedagic wrote:
> >> Hi Jan,
> >> 
> >> On Thu, Mar 17, 2016 at 06:47:37PM +0100, Jan Pokorný wrote:
> >>> Hello all,
> >>> 
> >>> during latest reviews of packages building on core cluster
> >>> infrastructure, it turned out there is a frequented (viral?) issue
> >>> with source files declaring unusual licence: GPLv2.1+.
> >> 
> >> Yes, I'd say that it's all coming from a single source. I suspect
> >> that nobody's looking at the license, just copies another source
> >> file from the same project. Anyway, that's what I did in booth.
> >> 
> >> Who created the first file with this non-existent license is
> >> anybody's guess. It could probably be traced, but I doubt that
> >> it'd help in any way.
> > 
> > Actually it might.
> > 
> > I think that what happened was this:
> 
> Lars, many thanks for providing the following historical context.
> It seems to provide enough background to guide the interpretation
> of dubious license notices towards the original intentions.
> 
> Let me premise that from the new perspective, it might have been
> a bit preposterous trying to contact every and each (potential)
> licensor of the affected files (got a couple of bounces[*], anyway),
> just followed the transparency principle, turning them to stand-by
> should any coordination be required...
> I am sorry if you were looped in without solicitation, especially if
> neither project is of your interest anymore.
> 
> > in the early days of heartbeat, way back when,
> > source code got "batch tagged" with the license statement:
> > http://hg.linux-ha.org/heartbeat-STABLE_3_0/rev/4a67fde00b0b#l1.10
> > 2000/07/26 05:17:18
> > 
> > Most stuff got tagged with the LGPL 2.1.
> > 
> > Some time later, someone noticed that in some cases,
> > a "program" is not a "library", and tried to re-tag
> > e.g. "api_test.c" with the GPL 2,
> > but without properly taking the actual suggested GPL 2 stanza,
> > but by simply dropping "Lesser" and changing "library" to "software".
> > http://hg.linux-ha.org/heartbeat-STABLE_3_0/rev/bc508513c4dc#l2.10
> > 2000/08/31 05:23:36
> > 
> >  :-(
> 
> I was made aware of this is downright supported by LGPL 2.1 provision:
> 
>   3. You may opt to apply the terms of the ordinary GNU General Public
>   License instead of this License to a given copy of the Library. To do
>   this, you must alter all the notices that refer to this License, so
>   that they refer to the ordinary GNU General Public License, version
>   2, instead of to this License. (If a newer version than version 2 of
>   the ordinary GNU General Public License has appeared, then you can
>   specify that version instead if you wish.) Do not make any other
>   change in these notices.
> 
>   Once this change is made in a given copy, it is irreversible for that
>   copy, so the ordinary GNU General Public License applies to all
>   subsequent copies and derivative works made from that copy.
> 
>   This option is useful when you wish to copy part of the code of the
>   Library into a program that is not a library. 
> 
> So one might think this is just it's imperfect execution.
> 
> > Both changes predate the GPLv3 by seven years.
> 
> Hence the timeless, causation-ignorant, plain logic implication of GPLv3+
> cannot simply hold under the demonstrated reality-check.
> 
> > From there it propagated to ipfail.c and attrd.c, which both became
> > *the* template files to start from when writing daemons and extensions
> > using the API.
> > 
> > Developers quickly browse their "template",
> > their "auto-correct" filter reads "GPL 2",
> > which they are content with,
> > and in good faith they hack away.
> > 
> > I think it is safe to assume that any developer copying from there meant
> > to "stay in project" regarding the licensing.
> 
> Agreed on good will/no surprises being presumed in free software
> projects, leading to code being anything that really matters in such
> circles.  Licensing (and other) paper work is frequently played down
> to cargo cult minimum[**].  Unfortunately, a minor inaccuracy there
> can go 15+ years down the road unnoticed, as we can observe right now :-)
> 
> > So I move to change it to GPLv2+, for everything that is a "program",
> > and LGPLv2.1 for everything that may be viewed as a library.
> > 
> > At least that's how I will correct the wording in the
> > affected files in the heartbeat mercurial.
> 
> In the light of the presented historic excursion, that feels natural.
> 
> Assuming no licensors want to speak up, the question now stands:
> Is it the same conclusion that has been reached by booth and sbd
> package maintainers (Dejan and Andrew respectively, if I follow what's
> authoritative nowadays properly) and are these willing to act on it to
> prevent the mentioned ambiguous interpretation once forever?

Yes, that's all fine with me.

> I will be happy to provide actual patches,

Even better :)

> but that's not a decision
> for me to take.

Thanks,

Dejan

> 
> In fact, Andrew has already expressed his inclination:
> http://oss.clusterlabs.org/pipermail/developers/2016-March/000182.html
> 
> 
> Thanks for taking this seriously.
> 
> 
> [*] see the difference of CC field between original and this message
>     (if you know alternative contacts and think they might be
>     interested, please point them this thread out)
> [**] see also
> http://oss.clusterlabs.org/pipermail/users/2016-January/002104.html
> 
> -- 
> Jan (Poki)