<div dir="ltr">Van,<div><br></div><div>Let's please get more specific regarding blockchain, since that is the target of the customer.</div><div><br></div><div>Anna puts data in a blockchain, and her digital signature. She holds some right to this data.</div><div>Betty then processes the blockchain, adding data and her own digital signature. Because it's a blockchain, Betty's added data is necessarily derivative of Anna's.</div><div><br></div><div>Anna asks Betty for her data. What does Betty have to provide?</div><div><br></div><div>1. Only the data that Anna fed into the system.</div><div>2. The data that Anna fed into the system, and Betty's data which is derivative.</div><div>3. #2, plus the secret key that Betty used to manipulate Anna's data.</div><div><br></div><div>Note your definition of "Source Code":</div><div><br></div><div><span style="color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size:16px">o) “Source Code” means the form of the work preferred for making modifications, including any comments, design documentation, help materials, installation instructions, <b>cryptographic keys</b>, and any information reasonably necessary to compile the Source Code into Object Code <b>or Process User Data</b> using generated Object Code.</span> <br></div><div><br></div><div>Emphasis mine. Perhaps modulated by a comma, the definition of source code seems to include cryptographic keys used to process user data.</div><div><br></div><div> Thanks</div><div><br></div><div> Bruce</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, May 8, 2019 at 3:46 PM VanL <<a href="mailto:van.lindberg@gmail.com">van.lindberg@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hi Pam,</div><div><br></div><div>Reading through your hypothetical, you seem to get the big picture correct, but some of the details incorrect.</div><div><br></div><div>At a high level, would a website operator running a CAL-licensed storefront application have to provide a copy of the store-running source code to you? <b>Yes, they would. <br></b></div><div>Would a website operator also need to offer you a copy of your User Data (here your order information)? <b>Yes, they would.</b><br></div><div><b></b></div><div><b><br></b></div>To specifics:<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, May 8, 2019 at 5:01 PM Pamela Chestek <<a href="mailto:pamela@chesteklegal.com" target="_blank">pamela@chesteklegal.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
Assume that the CAL is used for front-end software. A website uses
the software for its website. Through a webform I order a gift that
is for my daughter, who lives at a different address. It appears to
me that, under the CAL:<br>
<br>
My daughter's name and address are "User Data," that is, they are
data that is input to the Work and my daughter, a third party, has a
Lawful Interest in the data.<br></div></blockquote><div><br></div><div>This is not quite correct. The information about the order is User Data, but it is <i>your</i> User Data, not your daughter's; your daughter is not a Recipient. (Note that <i>you</i> would have the ability to ask for your order data from the website.)<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
The website has Publicly Performed, that is, it has made an
interface available that is used for access to User Data, my
daughter's name and address. As a result, this interaction means that under 2.2.1 and 2.2.2 the
website has to provide me (the Recipient) with a copy of the source
code.<br></div></blockquote><div><br></div><div>Yes, they would need to provide you a copy of the source code. This is similar (in practice) to how AGPL web apps work. Technically, the AGPL only requires a link to download the source code of modified works, but compare the as-applied licensing for various AGPL web apps: <br></div><div><br></div><div> - <a href="https://owncloud.com/owncloud-agplv3-owncloud-commercial-license/" target="_blank">Owncloud</a>: "How does the AGPLv3 apply to those apps and any apps you write as extentions?<br>Very easily; every ownCloud app is treated as modified work because the code from the ownCloud core is always running in parallel of any such extensions." <br></div><div> <br></div><div> - <a href="https://www.processmaker.com/agplv3-license-and-bpm-open-source-license" target="_blank">Processmaker</a>: "Under the AGPL, you must release the complete source code for the application that is built with ProcessMaker, even if that application is running on a network server for SaaS or Cloud hosted purposes." (Compare <a href="https://www.razuna.org/whatisrazuna/licensing" target="_blank">Razuna</a>, who also use this phrasing).<br></div><div>
<div><br></div><div> - <a href="https://artifex.com/licensing/" target="_blank">Artifex</a>:
"Bottom line, if you distribute our software, or make the functionality
of the software available to users interacting with it remotely through
a computer network, you must share your source code." </div>
</div><div><br></div><div>Thanks,<br></div><div>Van<br></div><div bgcolor="#FFFFFF">
</div><br></div></div></div></div></div></div></div></div></div></div></div>
_______________________________________________<br>
License-review mailing list<br>
<a href="mailto:License-review@lists.opensource.org" target="_blank">License-review@lists.opensource.org</a><br>
<a href="http://lists.opensource.org/mailman/listinfo/license-review_lists.opensource.org" rel="noreferrer" target="_blank">http://lists.opensource.org/mailman/listinfo/license-review_lists.opensource.org</a><br>
</blockquote></div>