[License-discuss] Retroactively specifying `-only` or `-or-later` for GPLv2 in an adopted project

[Rob Landley]

On 8/21/24 03:42, c.buhtz at posteo.jp wrote:
> Hello together,
> 
> My question in short: Is "GPLv2" by default "-only" or "-or-later" when 
> the suffix is not explicit specified?

It's unclear, but "only" is the safe option. The "or later" is essentially a
dual license, and merging a single commit anywhere in the history that's only
under one license means the result can technically only be distributed under the
terms of that one license. (Whether those commits can be retroactively "cleaned
out" is... complicated.)

Open source isn't joint copyright ownership, with breaks open, but a series of
derived works, which breaks closed. With joint ownership of a copyright, any of
the copyright holders can provide a license to the copyright. With derived
works, each separate copyright holder must compatibly license their contribution
or else you can't distribute the result. Thus it's really easy to lose dual
licenses, or for more permissive licenses to be replaced by more restrictive
"compatible subset" licenses. (But you can't discard ALL permission to
distribute or you can't distribute, which is where distribution in violation of
license terms comes in. As for what qualifies as "distribution"... it's
complicated.)

Busybox hit this back in 2006 when we found we'd historically merged some code
from linux-kernel sources that were GPLv2 only, and thus our "or later" either
needed a lot of careful study and pruning to even potentially reestablish, or it
needed to stay with "only". (We were looking into this both because we were
launching the first GPL enforcement suits on a historical backlog of reports I'd
inherited, known as the "hall of shame", and because GPLv3 was dropping out of
"Duke Nukem Forever / Gnu Hurd" eternal vaporware purgatory and actually looked
like it might finally become real. Which, sadly, it did.)

Note that "a lawyer", "copyright law", and "open source" is like "a programmer",
"a ruby programmer", and "ruby on rails using mruby on nommu ipv6-only with what
calls itself arm assembly acceleration but is actually thumb2". Don't just ask a
random lawyer how this stuff works, the domain expertise is near-fractal. (Last
paragraph's very handwavy explanation was from me coming up to speed on new
york's second circuit in the late 2000s, with bits of California's ninth circuit
and Texas' absolutely batshit fifth circuit, and then of course the "Federal
Circuit for Intellectual Property" which is ENTIRELY bullshit. I remember when
Harald Welte was doing German enforcement actions circa 2005 and learning about
inalienable author's rights, which was an entirely DIFFERENT way to sabotage the
concept of "public domain" than what we do in the states. And at the time the
law in China was "ha ha, no", but now it's a DIFFERENT kind of "ha ha, no". And
did you know that Japan's intellectual property law does not have the doctrine
of "fair use"?)

> I am a member of an upstream maintainer team that took over a project 
> [1] two years ago.
> The project itself is round about 15 years old. We are the third 
> generation of maintainers,
> and we lack contact with the earlier developers.
> 
> The project is licensed under "GPLv2" without explicit specified suffix 
> "-only" or "-or-later".

Assuming "only" is the safe option.

> This is stated on Microsoft GitHub, in the license file, and in the 
> header of each code file.
> However, only the standard GPLv2 text has been copied without 
> modification.
> I have no further information about the licensing.

Often there isn't any. You can go through the code's history and try to figure
out who is involved, and either contact them or remove their code, which I've
done on multiple occasions over the years:

https://busybox.net/~landley/forensics.txt

http://lists.landley.net/pipermail/toybox-landley.net/2011-November/012976.html

This isn't a question of "what do the license and the law say", this is a
question of "who are the copyright holders who might cause a stink"?

Of course to undermine THAT Bradley Kuhn is currently attempting to invent a
whole new legal theory that he personally has standing to sue everyone
everywhere over every open source license even if every single copyright holder
whose copyright the license is on tells him to take a hike. (And also in passing
that "privity of contract" isn't a thing.)

https://www.aoshearman.com/en/insights/vizio-ruling-offers-potential-precedent-on-source-code

As I said: actual lawyers. There's a minefield of zealots and rich people
working at cross purposes in a patchwork of conflicting legal jurisdictions...

If you're wondering why I don't GPL my code anymore when given a choice... yeah.

> If I understand this standard text correctly, it does not clearly 
> specify whether the
> project is "GPLv2-only" or "GPLv2-or-later". To my knowledge there are 
> no exclusive
> license texts to this two variants. This distinction would need to be 
> specified elsewhere.
> 
> How should one handle this if I cannot determine it with certainty, 
> especially since I
> cannot contact the previous authors? Are there any precedents for this?

Quite a few. They contradict, plus jurisdictional salad, changes over time,
people like Bradley who invent the law they want and argue for it in court
despite all precedent until they get lucky with a batty judge or the other side
runs out of money... (Ask me about Apple vs Franklin sometime. Foundational to
modern computer IP law, and CLEARLY a special case technicality that could
EASILY have been appealed but the result was what the big money wanted and
they'd ground away until they got it then stopped there.)

> Can I freely interpret the license and simply state that it is 
> "-or-later"?

If nobody objects, you can do anything you want. If they do object (at some
point in the future, no useful statute of limitations on this stuff last I
checked) then it gets messy and bespoke.

It's entirely possible you DO have a viable "or later" project, and it's
entirely possible nobody would ever DO anything about it if you didn't, and even
if they did it's entirely possible you'd win in court or at least be able to
talk them down. But I can't tell you that from here.

I do note that "GPLv3 only" is a license people who switched to it tend to
regret, such as Samba maintainer Jeremy Allison who explicitly lamented the
switch in https://archive.org/details/copyleftconf2020-allison

> In this case the project would be more flexible to contributions in the 
> future.

How so? You could accept the same set of patches, dropping the "or later" would
just affect who could take code FROM your project and put it into other
projects. If you merge GPLv3-only code into your project, you've also dropped
half the dual license.

> Are there any court rulings, guidelines, or recommendations from 
> advocacy
> groups (e.g., FSF, FSFE, OSSI, etc.) on this matter?

Alas "do your own research" (read a dozen blogs that all reference each other as
sources) works about as poorly with licensing as with vaccination. I worked with
a half-dozen different lawfirms over something like 25 years to become as badly
half-assed at it as I am, and the result of all that is I'd find a real lawyer
to book professional hours into doing an official write-up for you, and anything
short of that is "have fun storming the castle" territory.

Maybe ping https://softwarefreedom.org/services/ and see if they can either do
an opinion for your specific case, or recommend somebody to be YOUR lawyer in
this matter? Founded by a co-author of GPLv2 and GPLv3, if ANYBODY knows it's them.

Rob