[License-discuss] Intimacy in open source (SSPL and AGPL)

Tue Jan 22 20:31:50 UTC 2019

My e-mail isn’t adding reply bars.  I’m going to put my responses in blue, I apologize that this will likely impact readability for some members of the list.

From: License-discuss <license-discuss-bounces at lists.opensource.org> On Behalf Of Bruce Perens
Sent: Tuesday, January 22, 2019 10:53 AM
Subject: Re: [License-discuss] Intimacy in open source (SSPL and AGPL)

On Tue, Jan 22, 2019 at 10:21 AM Nicholas Matthew Neft Weinstock <nweinsto at qti.qualcomm.com<mailto:nweinsto at qti.qualcomm.com>> wrote:

On Sunday the 13th, Lukas discussed the idea that “intimate” communication is in regards to distributing Corresponding Source, so the license must mean that “anything needed to run the software” must also be released under (A)GPLv3.  He effectively suggests that if a GPLv3 application is developed so that it cannot run without a given library, the library must also be released under (A)GPLv3.

The complete and corresponding source code must include whatever is needed to build and install the program with all functionality of the hardware enabled as it was in the binary conveyed by the manufacturer. This doesn't mean you have to license libraries under a GNU license, just that they are available in a form which is compatible with the GNU license. There is the system libraries exception, etc. And if you are GPL-shy and naive, you can license the necessary tools under a permissive license.

Can you explain how you reach this conclusion?  My reading of section 6 suggests that Corresponding Source must be conveyed under the terms of this License (e.g., GPLv3).  Where does the license allow Corresponding Source to be distributed under a GPLv3-compatible license?

Both are tempting, but I’m not sure that either makes sense in all situations.

Be careful with "makes sense", I have seen engineers and their managers use that in court and make total fools of themselves. You have to comply with the license whether or not it fits with conventional process in your industry.

You’re right, let me clarify what I mean.  It seems to me that neither of these statements are a complete and usable test for “intimacy” because I believe there are situations where each would result in unintended application.

If I modify the application to work with the library, but the application is also capable of working without the library (similar to 2(a) from LGPLv3), does this mean it’s no longer “intimate” since the library is no longer needed to run the software?

Intimacy doesn't matter for this example. You can't combine works under incompatible licenses. Period.

I’m flipping it around.  In this example, we’re saying that if the application needs the library in order to run, this is “intimate data communication” and the library must be distributed along with any other Corresponding Source.  So if my application is also capable of working without the library, it doesn’t need the library in order to run.  Unless there is some other reason the library is Corresponding Source, the licenses are irrelevant.

Your objection goes directly to my point: this statement is not a complete and usable test for “intimacy” because the phrase “needed to run” is narrower than you believe this section should be.  Maybe “needed to compile” might work in some cases, but not all, depending on the programming language.

What if I want to modify an existing application that is under an incompatible open source license to work only with an LGPLv3 library, and the application’s license requires me to distribute as source?  LGPLv3 doesn’t grant any additional permissions that would save the application in this case.

Try rephrasing the question, it doesn't make sense this way.

Glad to.
There is an existing application under CDDL.  GNU.org states that this license is incompatible with GPLv3 because it is file-based copyleft, and section 3.1 states that if you distribute in Executable form you must also distribute in Source form under CDDL.
There is an existing library under LGPLv3.
I want to modify the application so that it needs the unmodified library in order to run.

LGPLv3 is GPLv3 with additional permissions.  So let’s first think about if the library were GPLv3, then see if LGPLv3 allows anything different.

According to John’s statement, if the library were GPLv3, the application would be interacting with it by “intimate” communications and the source code of the application must be distributed under GPLv3.

LGPLv3’s additional permissions only allow me to distribute the Executable form of my app under different license terms.  There is no additional permission allowing me to distribute the Source Form under CDDL.

So I don’t believe John’s statement is a complete and usable test for “intimacy” because it is broader than intended as the basis for LGPLv3.

Thanks,
Nick
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opensource.org/pipermail/license-discuss_lists.opensource.org/attachments/20190122/2faf9250/attachment.html>