GPLv3

GPLv3

[Eric Blake]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

tar 1.18 was just released, and is one of the first GNU packages that
requires GPLv3 or later.  Meanwhile, cygwin is explicit in requiring
exactly GPLv2.  According to the GPLv3 FAQ, http://gplv3.fsf.org/dd3-faq,
it is NOT okay for a GPLv3 program to link against a GPLv2-only library.
So, what is the consensus - am I allowed to upload tar 1.18, or is cygwin
forevermore stuck at tar 1.17 as the last GPLv2 release, because of the
fact that building an image of tar 1.18 linked against cygwin1.dll
constitutes a license violation?

And this problem will only grow in the near future - other cygwin packages
that I maintain have discussed in their mailing lists that they are
actively in the process of converting to GPLv3, including findutils
(release expected tomorrow) and m4 (release expected later in the week).

- --
Don't work too hard, make some time for fun as well!

Eric Blake             ebb9@byu.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)
Comment: Public key at home.comcast.net/~ericblake/eblake.gpg
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGhyQW84KuGfSFAYARAm1hAJ95tpXEgzvMe4aUNXDdQ3wn0lVt/gCff7fa
73gosNY4OYf3Q43aRe3bMZg=
=BeWb
-----END PGP SIGNATURE-----

Re: GPLv3

[Brian Dessent]

Eric Blake wrote:

> tar 1.18 was just released, and is one of the first GNU packages that
> requires GPLv3 or later.  Meanwhile, cygwin is explicit in requiring
> exactly GPLv2.  According to the GPLv3 FAQ, http://gplv3.fsf.org/dd3-faq,
> it is NOT okay for a GPLv3 program to link against a GPLv2-only library.
> So, what is the consensus - am I allowed to upload tar 1.18, or is cygwin
> forevermore stuck at tar 1.17 as the last GPLv2 release, because of the
> fact that building an image of tar 1.18 linked against cygwin1.dll
> constitutes a license violation?

Remember that the Cygwin license includes an OSI exemption, so as long
as GPLv3 is eventually OSI certified (as if...) it's fine on the Cygwin
side.  I don't know about the other direction though.

Brian

Re: GPLv3

[Eric Blake]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

According to Brian Dessent on 6/30/2007 10:12 PM:
>> So, what is the consensus - am I allowed to upload tar 1.18, or is cygwin
>> forevermore stuck at tar 1.17 as the last GPLv2 release, because of the
>> fact that building an image of tar 1.18 linked against cygwin1.dll
>> constitutes a license violation?
> 
> Remember that the Cygwin license includes an OSI exemption, so as long
> as GPLv3 is eventually OSI certified (as if...) it's fine on the Cygwin
> side.  I don't know about the other direction though.

Thanks for the reminder about the exception clause.  Since packaging tar
1.18 does not modify the sources to cygwin1.dll, I agree that the GPLv2
exception offered by cygwin is applicable here.  I don't think GPLv3 will
have any problem achieving OSI exemption, so I went ahead and uploaded tar
1.18.

- --
Don't work too hard, make some time for fun as well!

Eric Blake             ebb9@byu.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)
Comment: Public key at home.comcast.net/~ericblake/eblake.gpg
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGh7da84KuGfSFAYARAkBeAJkBBaUW2kxYXGCR7iSTzMKDtH78lgCg1lKf
94vXSl2zetTLNXk4BjAOtK8=
=GyNX
-----END PGP SIGNATURE-----

Re: GPLv3

[Eric Blake]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

According to Eric Blake on 7/1/2007 8:16 AM:
> Thanks for the reminder about the exception clause.  Since packaging tar
> 1.18 does not modify the sources to cygwin1.dll, I agree that the GPLv2
> exception offered by cygwin is applicable here.  I don't think GPLv3 will
> have any problem achieving OSI exemption, so I went ahead and uploaded tar
                                 ^^^^^^^^^
s/exemption/certification/
> 1.18.
> 

- --
Don't work too hard, make some time for fun as well!

Eric Blake             ebb9@byu.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)
Comment: Public key at home.comcast.net/~ericblake/eblake.gpg
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGh7kh84KuGfSFAYARAoY3AJ9db/zOanxXJVrBW+bNVK3g89JAqACfUnvA
aI97GzUEhVFdtSamiWA27AE=
=70HC
-----END PGP SIGNATURE-----

Re: GPLv3

[Corinna Vinschen]

On Jul  1 08:16, Eric Blake wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> According to Brian Dessent on 6/30/2007 10:12 PM:
> >> So, what is the consensus - am I allowed to upload tar 1.18, or is cygwin
> >> forevermore stuck at tar 1.17 as the last GPLv2 release, because of the
> >> fact that building an image of tar 1.18 linked against cygwin1.dll
> >> constitutes a license violation?
> > 
> > Remember that the Cygwin license includes an OSI exemption, so as long
> > as GPLv3 is eventually OSI certified (as if...) it's fine on the Cygwin
> > side.  I don't know about the other direction though.
> 
> Thanks for the reminder about the exception clause.  Since packaging tar
> 1.18 does not modify the sources to cygwin1.dll, I agree that the GPLv2
> exception offered by cygwin is applicable here.  I don't think GPLv3 will
> have any problem achieving OSI exemption, so I went ahead and uploaded tar
> 1.18.

It's still an interesting point since the GPLv3 linked against a GPLv2
lib with excemption.  I'll try to get legal advice about Cygwin and the
GPLv3.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

Re: GPLv3

[Andrew Schulman]

> I'll try to get legal advice about Cygwin and the
> GPLv3.

All this licensing stuff gives me headaches.  I gave up trying to understand
it long ago.  

Corinna, whenever you or someone else gets legal advice about this, I'd
appreciate it if a policy could be posted stating as clearly as possible for
us packagers what we can and can't do, and what traps to watch out for, as
regards the various licenses.

Thanks, Andrew.

Re: GPLv3

[Corinna Vinschen]

On Jul  2 10:40, Andrew Schulman wrote:
> > I'll try to get legal advice about Cygwin and the
> > GPLv3.
> 
> All this licensing stuff gives me headaches.  I gave up trying to understand
> it long ago.  

Unfortunately the wording of the GPLv3 got rather less easy to
understand than the GPLv2.  I can see why, but it's unfortunate
just the same.

> Corinna, whenever you or someone else gets legal advice about this, I'd
> appreciate it if a policy could be posted stating as clearly as possible for
> us packagers what we can and can't do, and what traps to watch out for, as
> regards the various licenses.

Sure.  I'm already in internal discussion but this might take a while
longer.  The GPLv2 vs. GPLv3 issue has a couple of implications for Red
Hat so changes will not be made lightheaded.  I hope a decision is due
soon.

In the meantime, treat the http://cygwin.com/licensing.html page as
state of the art, especially the open source permission clause.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

Re: GPLv3

[Andrew Schulman]

> In the meantime, treat the http://cygwin.com/licensing.html page as
> state of the art, especially the open source permission clause.

Thanks.

Re: GPLv3

[Corinna Vinschen]

On Jul  2 11:28, Andrew Schulman wrote:
> > In the meantime, treat the http://cygwin.com/licensing.html page as
> > state of the art, especially the open source permission clause.
> 
> Thanks.

Ok, I got legal advice now.

Linking a GPLv3 application against a GPLv2-only library is not ok
because this violates the v2-only license of the library.  It does not
violate the license of the v3 application.  This means, the tar package
in the Cygwin distro is not ok (but read on) because it violates
Cygwin's license.  There's no problem from the tar side, however.

There are no short-term plans to change the license of Cygwin, rather we
just wait until the OSI certifies the GPLv3 as open source license
according to the definitions.  As Brian already noted, as soon as the
OSI certifies the GPLv3, the exemption clause from
http://cygwin.com/licensing.html will also cover GPLv3'ed packages.

In the meantime, as long as the GPLv3 is not OSI certified (which
shouldn't take long), Red Hat will not enforce the GPLv2-only state of
Cygwin on the back of GPLv3 packages.  So, tar 1.18 can stay in the
distro if Eric trusts Red Hat not to sue him.  The same applies to
every other maintainer of every other package which goes v3.

Actually, cpio goes GPLv3 as well
http://lists.gnu.org/archive/html/bug-cpio/2007-06/msg00016.html and as
the Cygwin cpio maintainer I will provide the cpio 2.9 release under
GPLv3 at any rate since, for some reason, I trust myself not to enforce
the GPLv2 on my cpio package ;)

I hope that clears the situation sufficiently.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

Re: GPLv3

[Yaakov (Cygwin Ports)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Corinna Vinschen wrote:
> There are no short-term plans to change the license of Cygwin, rather we
> just wait until the OSI certifies the GPLv3 as open source license
> according to the definitions.  As Brian already noted, as soon as the
> OSI certifies the GPLv3, the exemption clause from
> http://cygwin.com/licensing.html will also cover GPLv3'ed packages.

IANAL, but I am a stickler for words, so if I may point out the following:

There has always been an understanding that a license has to be
OSI-approved to fall under the exception clause of the Cygwin license.
But the clause doesn't say "approved by the OSI", rather it says:

"... a license that complies with the Open Source definition ..."

Complies according to whom?  If IMHO, the GPLv3 does comply with the
definition as published at the provided URL, who says I need to wait for
the OSI to actually certify it as such?

I understand that this goes against the general understanding that has
existed until now, but as we all have learned through following Groklaw,
it's not one's understanding of a contract that decides a case but the
actual language therein.

Could Red Hat's lawyers take another look at the language and provide
their opinion on this?


Yaakov
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGiVuHpiWmPGlmQSMRCLYgAJ0cNmz2EDKIKcfXG6bNF+juzzzBPQCgyzAc
Sn5F7WnnV568KZ+e41k3gPA=
=GIYO
-----END PGP SIGNATURE-----

Re: GPLv3

[Yaakov (Cygwin Ports)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Corinna Vinschen wrote:
> Red Hat will not enforce the GPLv2-only state of
> Cygwin on the back of GPLv3 packages.  So, tar 1.18 can stay in the
> distro if Eric trusts Red Hat not to sue him.

I'll trust Red Hat much more than other companies that we're supposed to
"trust" not to sue us. :-)


Yaakov
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGiVzcpiWmPGlmQSMRCC0yAJ9v7zn7vDH+sS4hZrtyT/vexl1WuQCdHtkY
PXaQfYPmAlBmdT/kH4kANlY=
=Nchc
-----END PGP SIGNATURE-----

RE: GPLv3

[Dave Korn]

On 02 July 2007 21:10, Yaakov (Cygwin Ports) wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> Corinna Vinschen wrote:
>> There are no short-term plans to change the license of Cygwin, rather we
>> just wait until the OSI certifies the GPLv3 as open source license
>> according to the definitions.  As Brian already noted, as soon as the
>> OSI certifies the GPLv3, the exemption clause from
>> http://cygwin.com/licensing.html will also cover GPLv3'ed packages.
> 
> IANAL, but I am a stickler for words, so if I may point out the following:
> 
> There has always been an understanding that a license has to be
> OSI-approved to fall under the exception clause of the Cygwin license.
> But the clause doesn't say "approved by the OSI", rather it says:
> 
> "... a license that complies with the Open Source definition ..."
> 
> Complies according to whom?

  By definition: according to the judgement of whoever wrote that paragraph
and that license, which is to say, according to RH legal team.

>  If IMHO, the GPLv3 does comply with the
> definition as published at the provided URL, who says I need to wait for
> the OSI to actually certify it as such?

  You don't, as long as you are confident that the licensors will concur with
your MHO.  Well, technically, you don't have to wait for anything ever: this
is a civil matter, there are no restraining injunctions, it would be up to RH
legal to decide whether they felt GPLv3 complies, in which case they wouldn't
sue your, or whether they felt it doesn't, in which case they would have the
option of suing you, in the event of which it would then still be up to a
court to decide whether the standards by which they have adjudged whether it
'complies' or not are reasonable under the standards by which civil contracts
are judged, and hence enforcable, or not, and hence not.  Herein lies both
your security - they don't /have/ to sue you if they don't want to, even if
something you do doesn't technically live up to the word of the license,
because they are at liberty to decide for themselves if it 'complies' or note
- and also your risk, because none of it is defined with mathematical rigour,
there is an element of judgement to all the phraseology used, and it's a
matter of contract law.  Note very importantly the difference between whether
X 'complies with' Y, which is a subjective judgement, and whether X is
*certified as* Y, which is a matter of fact or not according to the decision
of the relevant certifying body.

> Could Red Hat's lawyers take another look at the language and provide
> their opinion on this?

  What they say will - by definition - be definitive :-)

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....

Re: GPLv3

[Yaakov (Cygwin Ports)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Dave Korn wrote:
>>  If IMHO, the GPLv3 does comply with the
>> definition as published at the provided URL, who says I need to wait for
>> the OSI to actually certify it as such?
> 
>   You don't, as long as you are confident that the licensors will concur with
> your MHO.  Well, technically, you don't have to wait for anything ever: this
> is a civil matter, there are no restraining injunctions, it would be up to RH
> legal to decide whether they felt GPLv3 complies, in which case they wouldn't
> sue your, or whether they felt it doesn't, in which case they would have the
> option of suing you, in the event of which it would then still be up to a
> court to decide whether the standards by which they have adjudged whether it
> 'complies' or not are reasonable under the standards by which civil contracts
> are judged, and hence enforcable, or not, and hence not.  Herein lies both
> your security - they don't /have/ to sue you if they don't want to, even if
> something you do doesn't technically live up to the word of the license,
> because they are at liberty to decide for themselves if it 'complies' or note
> - and also your risk, because none of it is defined with mathematical rigour,
> there is an element of judgement to all the phraseology used, and it's a
> matter of contract law.  Note very importantly the difference between whether
> X 'complies with' Y, which is a subjective judgement, and whether X is
> *certified as* Y, which is a matter of fact or not according to the decision
> of the relevant certifying body.

While wrt GPLv3 software I agree that this is purely hypothetical and
certainly soon to be moot (when OSI certifies GPLv3), one could conceive
another case which would be relevant and possibly damaging to RH:

1) 3PP distributes clearly non-FOSS software depending on Cygwin (either
w/o Cygwin itself or with Cygwin and sources).

2) RH sues 3PP for violation of Cygwin license.

3) Defendant successfully argues that "complies with" != "certified",
and continues with elaborate explanation how his license supposedly
complies with OSI definition.

4) Court (or, worse yet, uneducated, uninformed, layman jury) falls for
defendant's hot air.

While I'm certain RH has excellent lawyers and this argument would be
well fought, this "subjective judgement", as you put it, could make this
problematic, or just unnecessary difficult (and expensive) at best.


Yaakov

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGiY/CpiWmPGlmQSMRCNg9AKDswbG7h12wQPyL8aKT/J5FSe9GygCgj/RS
jdtTmvYVfX2vJFlkqjGvEWg=
=pLiA
-----END PGP SIGNATURE-----

Re: GPLv3

[Corinna Vinschen]

On Jul  2 15:09, Yaakov (Cygwin Ports) wrote:
> Corinna Vinschen wrote:
> > There are no short-term plans to change the license of Cygwin, rather we
> > just wait until the OSI certifies the GPLv3 as open source license
> > according to the definitions.  As Brian already noted, as soon as the
> > OSI certifies the GPLv3, the exemption clause from
> > http://cygwin.com/licensing.html will also cover GPLv3'ed packages.
> 
> IANAL, but I am a stickler for words, so if I may point out the following:
> 
> There has always been an understanding that a license has to be
> OSI-approved to fall under the exception clause of the Cygwin license.
> But the clause doesn't say "approved by the OSI", rather it says:
> 
> "... a license that complies with the Open Source definition ..."
> 
> Complies according to whom?

Read http://cygwin.com/licensing.html again:

  See http://www.opensource.org/docs/definition_plain.html for the
  precise Open Source Definition referenced above.

Even if the license is not approved, the above definition sets the rules
against which the license is measured.

> Could Red Hat's lawyers take another look at the language and provide
> their opinion on this?

Been there, done that.  Regardless of the exact wording, somebody
who wants to ignore the licensing issue will do anyway.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

RE: GPLv3

[Dave Korn]

On 03 July 2007 08:09, Corinna Vinschen wrote:



  And there I was trying to TITTLL the thread.

  Oh well, anyone for hippos?  ;-)



  BTW, I just noticed the link to the OSI site is 404.  It could be that it's
one of those sites that just don't work if you disable scripts and cookies,
but it's more likely the link is just out-of-date.

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....

Re: GPLv3

[Corinna Vinschen]

On Jul  3 18:43, Dave Korn wrote:
>   BTW, I just noticed the link to the OSI site is 404.  It could be that it's
> one of those sites that just don't work if you disable scripts and cookies,
> but it's more likely the link is just out-of-date.

Fixed.


Thanks for the hint,
Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

Re: GPLv3

[Eric Blake]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

According to Corinna Vinschen on 7/2/2007 12:04 PM:
> In the meantime, as long as the GPLv3 is not OSI certified (which
> shouldn't take long), Red Hat will not enforce the GPLv2-only state of
> Cygwin on the back of GPLv3 packages.  So, tar 1.18 can stay in the
> distro if Eric trusts Red Hat not to sue him.  The same applies to
> every other maintainer of every other package which goes v3.

OK, I'm putting some (hopefully well-founded) trust in Red Hat, as well as
in the OSI certification process.  Thanks for the clarification; I'll
leave tar 1.18 available for download, in spite of its current (but
temporary) legal status.

- --
Don't work too hard, make some time for fun as well!

Eric Blake             ebb9@byu.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)
Comment: Public key at home.comcast.net/~ericblake/eblake.gpg
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGjFiN84KuGfSFAYARAoSmAJ0Yrwu+0wxw8VCwqIR1TEu0nRy+kwCgmDHI
TKyQmrIZ/81YKSBbVErBg0k=
=7VF4
-----END PGP SIGNATURE-----