[ClusterLabs Developers] [booth][sbd] GPLv2.1+ clarification request

[Jan Pokorný]

On 18/03/16 16:16 +0100, Lars Ellenberg wrote:
> On Thu, Mar 17, 2016 at 07:12:19PM +0100, Dejan Muhamedagic wrote:
>> Hi Jan,
>> 
>> On Thu, Mar 17, 2016 at 06:47:37PM +0100, Jan Pokorný wrote:
>>> Hello all,
>>> 
>>> during latest reviews of packages building on core cluster
>>> infrastructure, it turned out there is a frequented (viral?) issue
>>> with source files declaring unusual licence: GPLv2.1+.
>> 
>> Yes, I'd say that it's all coming from a single source. I suspect
>> that nobody's looking at the license, just copies another source
>> file from the same project. Anyway, that's what I did in booth.
>> 
>> Who created the first file with this non-existent license is
>> anybody's guess. It could probably be traced, but I doubt that
>> it'd help in any way.
> 
> Actually it might.
> 
> I think that what happened was this:

Lars, many thanks for providing the following historical context.
It seems to provide enough background to guide the interpretation
of dubious license notices towards the original intentions.

Let me premise that from the new perspective, it might have been
a bit preposterous trying to contact every and each (potential)
licensor of the affected files (got a couple of bounces[*], anyway),
just followed the transparency principle, turning them to stand-by
should any coordination be required...
I am sorry if you were looped in without solicitation, especially if
neither project is of your interest anymore.

> in the early days of heartbeat, way back when,
> source code got "batch tagged" with the license statement:
> http://hg.linux-ha.org/heartbeat-STABLE_3_0/rev/4a67fde00b0b#l1.10
> 2000/07/26 05:17:18
> 
> Most stuff got tagged with the LGPL 2.1.
> 
> Some time later, someone noticed that in some cases,
> a "program" is not a "library", and tried to re-tag
> e.g. "api_test.c" with the GPL 2,
> but without properly taking the actual suggested GPL 2 stanza,
> but by simply dropping "Lesser" and changing "library" to "software".
> http://hg.linux-ha.org/heartbeat-STABLE_3_0/rev/bc508513c4dc#l2.10
> 2000/08/31 05:23:36
> 
>  :-(

I was made aware of this is downright supported by LGPL 2.1 provision:

  3. You may opt to apply the terms of the ordinary GNU General Public
  License instead of this License to a given copy of the Library. To do
  this, you must alter all the notices that refer to this License, so
  that they refer to the ordinary GNU General Public License, version
  2, instead of to this License. (If a newer version than version 2 of
  the ordinary GNU General Public License has appeared, then you can
  specify that version instead if you wish.) Do not make any other
  change in these notices.

  Once this change is made in a given copy, it is irreversible for that
  copy, so the ordinary GNU General Public License applies to all
  subsequent copies and derivative works made from that copy.

  This option is useful when you wish to copy part of the code of the
  Library into a program that is not a library. 

So one might think this is just it's imperfect execution.

> Both changes predate the GPLv3 by seven years.

Hence the timeless, causation-ignorant, plain logic implication of GPLv3+
cannot simply hold under the demonstrated reality-check.

> From there it propagated to ipfail.c and attrd.c, which both became
> *the* template files to start from when writing daemons and extensions
> using the API.
> 
> Developers quickly browse their "template",
> their "auto-correct" filter reads "GPL 2",
> which they are content with,
> and in good faith they hack away.
> 
> I think it is safe to assume that any developer copying from there meant
> to "stay in project" regarding the licensing.

Agreed on good will/no surprises being presumed in free software
projects, leading to code being anything that really matters in such
circles.  Licensing (and other) paper work is frequently played down
to cargo cult minimum[**].  Unfortunately, a minor inaccuracy there
can go 15+ years down the road unnoticed, as we can observe right now :-)

> So I move to change it to GPLv2+, for everything that is a "program",
> and LGPLv2.1 for everything that may be viewed as a library.
> 
> At least that's how I will correct the wording in the
> affected files in the heartbeat mercurial.

In the light of the presented historic excursion, that feels natural.

Assuming no licensors want to speak up, the question now stands:
Is it the same conclusion that has been reached by booth and sbd
package maintainers (Dejan and Andrew respectively, if I follow what's
authoritative nowadays properly) and are these willing to act on it to
prevent the mentioned ambiguous interpretation once forever?

I will be happy to provide actual patches, but that's not a decision
for me to take.

In fact, Andrew has already expressed his inclination:
http://oss.clusterlabs.org/pipermail/developers/2016-March/000182.html


Thanks for taking this seriously.


[*] see the difference of CC field between original and this message
    (if you know alternative contacts and think they might be
    interested, please point them this thread out)
[**] see also
http://oss.clusterlabs.org/pipermail/users/2016-January/002104.html

-- 
Jan (Poki)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.clusterlabs.org/pipermail/developers/attachments/20160321/0279fbf7/attachment-0002.sig>