Licensing and what it means for NethServer

Community
, , ,
1

I assume licensing isn’t the most favorite subject of many of our members. Some probably even fled to NethServer because of the licensing hell by proprietary software companies.
Well, guess what: We have our own licensing hell. And it is called license (in)compatibility.

Let me give you an example to illustrate why I am starting this discussion.
I have been active in an opensource project called Chamilo. Chamilo is an Electronic Learning environment, just like Moodle, that we now have available in the NethForge-testing repository (go test!!)
One of the dependencies of Chamilo is php-xapian. Xapian is an opensource search engine library. you can use it to index and search your content. To use xapian with php, you need to build these yourself. Php-xapian is not available in the official repositories as a binary. Why? Because the license form of xapian and php bite each other: they are not compatible with each other.

There are several sources about open source licenses. The source I often use is FSF (Free Software Foundation) or the website of Richard Stallman: gnu.org

On gnu.org there is a compatibility matrix that sheds some light:
https://www.gnu.org/licenses/gpl-faq.html#AllCompatibility
but that only compares several GPL flavors of licenses.

On wikipedia there is a more complete matrix on the most known opensource licenses:

You might ask: What does this have to do with NethServer?. Well, as you know, NethServer is a highly modular distribution. And anyone can create and add modules for NethServer. Most of the time these modules are existing projects and are shipped under a specific license.

And that’s where this topic kicks in: What if the license of the application that you want to add as a NethServer module is not compatible with the NethServer license?

I asked this question to an attorney who specialises in ‘internet law’. He responded with the following answer:
"Dag Rob,

Merci, leuke vraag. Heel in het kort, als een dependency license-incompatible is dan mag je ze niet samen shippen maar moet de eindgebruiker deze zelf downloaden en installeren. Een installatiescript dat dit automatisch doet, is op het randje. Ik kom hier in januari op terug op de blog!"
Groeten Arnoud

Which translates:
Hi Rob,
Thanks, nice question. Short answer, if a dependency is license-incompatible, you can not ship them together, but the end user must download and install the dependency himself. An installscript that is doing this automatically is considered a grey area. I will get back on this in Januari with a blogpost!"
regards,
Arnoud

Now we can do several things about this.

  • do not allow incompatible modules (in official repositories, including nethforge)
  • put modules like this in privately maintained repositories (like stephdl, or by any other member of the community)
  • … any other options?

Key is: what do we, as a community, want to offer and how are we going to respect free licensing forms. Although it might be a pain in the behind, respecting licensing forms is VERY important. It makes what opensource is about. It allows you to use software, distribute software, change software and examine software. For some reason different forms of licensing were created. We, as a community and project have to find some way that we respect those rules and still be able to ship great software modules with NethServer.

As the second part of the answer I received states: USING software that is license incompatible with NethServer is no problem at all! All free licenses have in common that you are free to use it. The problem is with shipping them together.

I would like to come to consensus how to handle this dilemma with NethServer.

4 Likes
2

Great post @robb!

What is the goal of forbid shipping (incompatible licensed softwares) together? I don’t catch it… Can you help me? Somebody wants to be sure his software comes down from specific channels?

3

No, the goal is not to not ship them together. It is just by choosing a specific license it can end up to be not compatible with another license.
Every developer will have their reasons to choose a specific, or maybe even their own, license. I think you can compare why choosing or creating a license a bit with with why choosing or creating a linux distribution.
Just because you can is often the sole reason. Or because you didn’t find everything covered with existing licenses. or you want to do the user a raindance… (jk)
But because of all those different licenses, some licenses just don’t go with each other so you can’t ship both in the same package.

For NethServer the matrix on wikipedia is important. NethServer is GPL v3 or newer so in the 3rd column is our compatibility list:

4

Thank you rob, this is a academic but really needed question.
So if I understand right, it’s a matter of choosing the right license to be as compatible (or flexible) as possible when you want to ship the modules as part of nethserver?
In this matrix GPL v3 is not very compatible to ohter licenses. Do you suggest to change the license to a more compatible like FSF or OSI?

5

I don’t think there is a reason to run to another licence form, however I am not an expert on licencing issues. Maybe a read at RMS’s work will enlighten us all… :slight_smile: (can I say: hail rms? :wink: )
https://www.gnu.org/licenses/rms-why-gplv3.html

1 Like
6

I don’t see the difference between these two points.
Both repositories (personal or community’s) can both contain software with multiple licenses and packages can be installed in the same machine.

I think the real difference is between distributing the rpm from a machine other then the one from the original project. :confused:

1 Like
7

I don’t think I completely get what you try to say here.
Do we distinguish what is distributed through the ISO and what is available through repositories?
Then how do we handle install NethServer on top of a minimal CentOS install?

As said, I am not an expert and I don’t know what is considered ‘shipping’. Does this include repositories? I am just thinking out loud now, and if I have a look at the xapian and php example, it does include repositories.

I just sent an email to FSF (Free Software Foundation) with some questions about this subject. I will post back as soon I get an answer.

8

I received a response from FSF by Yoni Rabkin, a volunteer with FSF. I asked permission to post his reply here so we can further discuss this here. The first mail is my initial mail to FSF. After the ==================== you can read the response by Yoni:
Hi to all at fsf,

I am writing this mail because I asked in the fsf IRC channel on freenode.net how we (NethServer project) should handle possible license incompatibilities.

NethServer is a modular Linux distribution that builds on top of a CentOS minimal install. There is a ISO which ships CentOS + the base modules of NethServer as an installer.

To enhance the base install there are several modules available through official NethServer repository and NethForge community repository.

Besides the official repositories, there are some repositories however maintained by NethServer community members, that are not part of the official repositories.

As a community we encourage our members to develop new modules so the functionality of NethServer is extended even further. Most of these modules that are developed are existing applications that are (re)packaged so they seamlessly integrate with NethServer and the NethServer webinterface.

If I look at Comparison of free and open-source software licenses - Wikipedia I see a lot of licenses that are incompatible with GPLv3.

My questions would be:

  • What if someone wants to add a module to NethServer and the application that he or she wants to add as a module is licenced under a license that is not compatible with GPLv3, what options do we have to be able to make that module available?

  • In what way should the NethServer project and community act to respect the licenseforms without limiting the options of adding extra functionality? Is that possible?

  • Would it be considered ‘good practice’ if an application that is not compatible with GPL v3, is offered through a repository that is not linked with the NethServer project?

  • A specific example could be: an application that uses php, can that be shipped with NethServer? (GPLv3 and PHP license are not compatible)

Can you give me some insight in this matter and/or point me to documentation that explains this matter?

best regards and merry x-mas to you all!

Rob Bosch

NethServer community team member

Belgium

=====================================================================

Hello and thank you for writing in.

Hi to all at fsf,

I am writing this mail because I asked in the fsf IRC channel on
freenode.net how we (NethServer project) should handle possible
license incompatibilities.

I was the one who suggested you do so. My name is Yoni Rabkin and I am
one of the volunteers who helps answer licensing questions at this
address.

I saw your email come in and decided to start the conversation right
away.

NethServer is a modular Linux distribution that builds on top of a
CentOS minimal install. There is a ISO which ships CentOS + the base
modules of NethServer as an installer.

The Nethserver site states that “the whole project” is under GPLv3. I
understand that to mean that original code by the project developers is
licensed under GPLv3. But note that a complete GNU/Linux distribution is
not licensed, as a whole, under a single license. A GNU/Linux
distribution is typically a collection of many thousands of individual
programs, each with their own copyright holder/s and license. While the
GPL is a very popular license, a typical GNU/Linux distribution will
contain software under many other licenses, and not all of them are GPL
compatible.

Just for instance: the kernel Linux is distributed under GPLv2
only. Because each version of the GPL is a strong copyright GPLv2 and
GPLv3 are mutually incompatible.

See:
http://www.gnu.org/licenses/license-list.html#GPLIncompatibleLicenses
http://www.gnu.org/licenses/license-list.html#GPLv2

However this incompatibility need not be a problem. Most of the software
distributed as a part of a GNU/Linux distribution is in what we call
“mere aggregation”. See:
http://www.gnu.org/licenses/gpl-faq.html#MereAggregation

In the case of the kernel Linux above, this means that the license would
only be a problem if you included GPLv2-incompatible code as part of the
kernel Linux itself, as opposed to software in userland which merely
uses the kernel.

In the case of PHP, Wordpress is a famous example of software written in
PHP which is released under the terms of the GPL. This is possible
because the license of the PHP4 implementation (PHP License, Version
3.01) normally doesn’t cover software written in the language. If you
were by contrast modifying the PHP4 engine itself or its libraries you
would not be able to license those modifications under the GPL.

Finally, if someone were to modify your own original GPLv3-licensed
code, they could only do so if they released their work under GPLv3 as
well.

To recapitulate:

* A GNU/Linux distribution need not necessarily contain only
  mutually compatible free software licenses.

* Free software license compatibility is important when you are
  modifying, or linking together, pieces of software in a way which
  would otherwise require permission from the copyright holder.

I hope this is of help. Please feel free to write back with further
questions if needed.

–
I am not a lawyer, the above is not legal advice

Regards, Yoni Rabkin

The services of the GPL Compliance Lab are made possible by
donations from people like you. Please consider supporting us
today by becoming a member [Join the FSF | Free Software Foundation] or by making
a donation [Support the Free Software Foundation | Free Software Foundation].

3 Likes
9

Hi,

It’s a really interesting question and a complicate subject.
As far as I know, the GPL v3 is very restrictive… for this reason, it’s not widly adopted.

The GPL v2 seem more permissive, if we can tel this, anyway the GPL licences are not really permissives.

10

As far as I understand, we can continue to ship the software from NethForge and private repositories, unless the third-party software owner imposes some special restrictions.

Good work Rob! :wink:

11

i think we can consider the modules as ‘mere agregations’. therefore i think it is allowedto ship them with different licenses. butvwe have to make sure that the license mentioned in the nethserver module source code is the same as the license that the application is lcenced under in the case that nethserver is not the license holder of that application.
for instance: if I decide to create a nethserver module for SavaPage, which is licenced under AGPL v2, the module must be licenced under AGPL v2 too.

This also means that I think that the license statement on the NethServer website should be redefined. There it states that the whole NethServer distribution is lcenced under GPL v3 or newer. There should be clear that NethServer written code is available under GPL v3. All 3rd party applications that ship with NethServer are under the licnse they originally are available.

2 Likes
12

Are you sure? I think the nethserver module is “mere aggregatation” too… because its code does not link with the module itself. Generally speaking a nethserver-module only writes some config files on the disk… I guess it can be licensed as we like.

13

uhm… No, I am not sure. Actualy I just don’t know and will have to ask. this. It maks it clear that this is diffcult sbject. Let me get back on ths later. I will ask my expert sources again…

2 Likes
14

great work @robb , i think this could be also a good source to solve some doubts:
https://fosdem.org/2017/schedule/track/legal_and_policy_issues/

3 Likes
15

Interesting article regarding licenses …hot out the oven

3 Likes
16

guide to GPL v2
https://www.linuxfoundation.org/news-media/research/practical-gpl-compliance

3 Likes