tom callaway (spot) wrote,

in this post, i rant about licensing



I tend to giggle a little bit to myself whenever I hear about a "100% Free GNU/Linux distribution". I'm sure it is possible, theoretically to make one, but it quickly delves into semantics.

First, who defines what "Free" means? Debian has a meaning, as does the Free Software Foundation. Their meanings are similar, but not compatible. Debian determines "Free" by committee. The FSF somewhat does as well, but ultimately, the tricky decisions go to Richard Stallman (rms).

Second, on either definition, you'd need to do an incredibly thorough audit of every file in the system to be sure that every single file is under a known license. We (Fedora) continue to find new licenses on a weekly basis, if not daily. When we find something non-free, it almost always exists in the "100% Free GNU/Linux distributions". I don't spend time checking these things out, honestly, but for example, all of them were shipping GLX under SGI's god-awful FreeB (and GLX) licensing at one point, well after Fedora and Debian both were aware of it. The number of things I have found (and continue to find) along with the surprise from upstreams when I inform them of the issues, forces me to draw the conclusion that the "100% Free" distributions are not doing proper audits (or if they are, they're not talking to the upstreams about it).

I will leave texlive aside as an exercise in futility. I may write more about that if/when I ever manage to finish auditing that steaming pile.

But, lets look at afio. The original version of this code was written in 1985 by Mark Brukhartz, while he was at Lachman Associates. Here is the license for the original afio code:


* Copyright (c) 1985 Lachman Associates, Inc..
*
* This software was written by Mark Brukhartz at Lachman Associates,
* Inc.. It may be distributed within the following restrictions:
* (1) It may not be sold at a profit.
* (2) This credit and notice must remain intact.
* This software may be distributed with other software by a commercial
* vendor, provided that it is included at no additional charge."


Okay. Now, realize that all afio changes from 1985 on are derived works from code under that license. There is no "clean afio", the very first implementation (that anyone knows of) is under these terms.

Now, this license isn't free. Why?
The restriction for selling the code "at a profit" is against the FSF's definition of Free:


A free program must be available for commercial use, commercial development, and commercial distribution.

http://www.gnu.org/philosophy/free-sw.html

It isn't Debian Free, either, it breaks clause 5 and 6 of the DFSG:


5. No Discrimination Against Persons or Groups

The license must not discriminate against any person or group of persons.

6. No Discrimination Against Fields of Endeavor

The license must not restrict anyone from making use of the program in a specific field of endeavor. For example, it may not restrict the program from being used in a business, or from being used for genetic research.

http://www.debian.org/social_contract#guidelines

Is that unclear? Okay, well, lets ask the DFSG FAQ:

(from 12. j.)

Q: Can I say "You must not use the program for commercial purposes"?

A: This is non-free. We want businesses to be able to use Debian for their computing needs. A business should be able to use any program in Debian without checking its license.

http://people.debian.org/~bap/dfsg-faq.html

But wait, you may be saying, there is an exception:


* This software may be distributed with other software by a commercial
* vendor, provided that it is included at no additional charge.


Unfortunately, that only means the restriction applies to everyone that isn't a "commercial vendor". For example, Debian isn't a commercial vendor. Realistically, someone selling Linux distribution CDs on ebay may not be a commercial vendor either. What about a guy who asks for a dollar to cover the cost of burning a Fedora DVD for the guys at his LUG, he's certainly not a commercial vendor. Is he making a profit unless he asks for the exact amount of the DVD? This clause is incredibly troublesome, and the exception doesn't help.

You may be saying, yeah, so it's non-free, so what? There are lots of non-free things out there.

Okay. Are you sitting down for this one?

Afio is in the FSF's directory of Free Software: http://directory.fsf.org/project/afio/
Afio is in Debian (and not in "non-free"): http://packages.debian.org/search?keywords=afio&searchon=names&suite=all§ion=all

So, how did this confusion happen? Well, someone (oh mysterious unknown person of the internets) decided that afio was pretty darned useful and uploaded it to sunsite (which used to be a pretty good place to dump useful UNIXy things that you found on the internets). At some point, someone at SunSite (again, this person's name is lost to the internets) decided to redefine the licensing terms. They wrote:


* This software was written by Mark Brukhartz at Lachman Associates,
* Inc.. Additional code was written by a large cast of people.
*
* Licensing and (re)distribution
* ------------------------------
*
* THE SUMMARY INFORMATION BELOW WAS WRITTEN FOR THE BENEFIT OF
* SOFTWARE DISTRIBUTORS
*
* Because of historical reasons, different parts of this software
* package are covered by different licenses. However:
*
* A) This software package as a whole may be re-distributed by any
* method that satisfies the conditions of both the Perl "Artistic
* License" and the GNU Library General Public License.
*
* B) According to the theory.html file of the Sunsite Archive
* Maintainers, this implies that the correct LSM template field
* is:
*
* Copying-policy: LGPL
*
* C) This software package can also be re-distributed under
* particular conditions that are _weaker_ than the Perl "Artistic
* License" combined with the GNU Library General Public License.
* Redistribution need only satisfy all four license notices below.
*
* Disclaimer: I am not a lawyer, and neither are the Sunsite Archive
* Maintainers."


From the context of this, we can be pretty confident that Lachman Associates, Inc.. didn't write this. Thus, whoever wrote it, took a big leap in IANAL licensing and decreed that the "software package as a whole" may be distributed under any method that meets the Artistic or LGPL license. Unfortunately (or fortunately!), licensing doesn't work that way. Stating that someone else's code is under a new license is like stating that my fire-bellied toads are now lemurs; you can say it until you turn blue, but it doesn't make it true.

I don't know why the FSF decided it was Free, we've identified things in their Free Software Directory that weren't quite free before, but they're usually accidents.

However, we do have insight into why Debian thinks it is Free:
http://lists.debian.org/debian-legal/1999/05/msg00162.html
http://lists.debian.org/debian-legal/1999/05/msg00168.html

Needless to say, I disagree, as does Red Hat Legal. (It's also an example of why handling licensing through a committee composed of IANAL folks is a bad idea, but I digress.)

What about the 100% Free GNU/Linux distributions? Surely they... oh wait.

  • GNUSense: http://heanet.archive.gnewsense.org/gnewsense/pool/universe/a/afio/

  • Ututo: http://132.207.4.160/distfiles/afio-2.4.7.tgz (from http://www.ututo.net/packages/sources/)

  • Dynebolic: Uhh... to the best of my knowledge, they don't ship afio, but they appear to have given up on listing their packages in 2007. Their website is also... erm... difficult to use.

  • Musix: They seem to use the same Ututo sources/packages, so, yes, they have afio.

  • BlagBlagBlagBlagBlagBlag: No, because they're derived from Fedora, and we never had it.

  • GNUStep (linux livecd distro): Not on the livecd, but they point to Debian's repo, which has it, thus, they shouldn't qualify as a "Free System Distribution", see: "There should be no repositories or ports for nonfree software."

  • Trisquel: I don't think it is on the livecd, but my spanish is rusty. They definitely point to Ubuntu's repository, so they shouldn't qualify as a "Free System Distribution", see: "There should be no repositories or ports for nonfree software."


  • Two out of seven, isn't bad, right?

    This isn't an isolated example, merely a convenient one. Therein lies the folly of the "100% Free GNU/Linux" distribution. Unless you have an extremely small and focused set of well audited software, you're operating on good faith that everything inside is as free as you claim it is. (The same analogy is true about OpenBSD and their security claims, but I digress.)

    This is why for Fedora, the goal of being 100% Free isn't something that we're losing sleep over. Sure, we'd like to be 100% Free, and we're working towards that every day, but actually being 100% Free is HARD, especially if you want more than 700 MB of packages.

    I'm not even going to talk about firmware. That's an entirely different religious battle.




    Now, here's the thing that amused me this morning. Normally, in a case like this, we try to track down the copyright holder, and initially, we were making efforts to track down Mark Brukhartz (well actually, I found him, but he was non responsive over email). This morning, I realized that he wasn't the copyright holder, Lachman Associates, Inc. is.

    Or more appropriately, was.

    In 1989, Lachman Associates was purchased by Eastman Kodak's Interactive Systems subsidiary (formerly ISC, acquired by Kodak in 1988). Kodak sold the Intel-UNIX operating system portion of Interactive Systems to Sun Microsystems on September 26, 1991. Kodak sold the remaining parts of ISC to SHL Systemhouse Inc in 1993. SHL Systemhouse Inc was purchased by MCI in 1995. MCI became MCI WorldCom in 1998, which became WorldCom in 2000, went into Chapter 11 from 2002-2004, and was acquired by Verizon in 2005.

    It is not clear whether the afio code was considered part of the ISC OS portion, so the copyright owner could be any of these entities (in order of probability):

    1. Sun Microsystems
    2. Verizon (assuming they did not liquidate the IP during Chapter 11)
    3. Kodak

    ( sources:
    http://www.lachman.org/
    http://www.centergate.com/rlachman.html
    http://en.wikipedia.org/wiki/INTERACTIVE_Systems_Corporation
    http://findarticles.com/p/articles/mi_qa3653/is_199510/ai_n8732201
    http://en.wikipedia.org/wiki/MCI_Inc.
    )

    Now, if Sun does own the copyright from the ISC purchase, they're the most likely to relicense it with a Free license. Of course, we'd need to find
    someone at Sun who was motivated to track this down (and whether they own it or not). We have _several_ outstanding issues with Sun around licensing at the moment, so I'm not holding my breath here.

    If Sun doesn't own it, then it is most likely that Verizon or Kodak owns it. This means we'd need to find someone at either company who is motivated to determine whether they own the afio Copyright, then who is willing and capable of relicensing that copyrighted code under a Free license. I think we have a better chance of finding Jimmy Hoffa.

    (original bugzilla ticket for afio: https://bugzilla.redhat.com/show_bug.cgi?id=449037 )

    The moral of this? Get your licensing right, the first time. You really do not know where your code will end up.
    • Post a new comment

      Error

      Anonymous comments are disabled in this journal

      default userpic

      Your reply will be screened

      Your IP address will be recorded 

    • 51 comments