CRITICAL License issue

[gwendoline-goetz]

The project gittle is licensed as Apache 2.0, but imports "dulwich" package, which is GPL v2 (see http://git.samba.org/?p=jelmer/dulwich.git;a=blob_plain;f=COPYING;hb=HEAD). In order to avoid license break, please reconsider gittle license and reassign its license to GPL v2.

gittle as well as dulwich cannot be used (meaning imported) in proprietary projects (or in general in non GPL projects).

This is a known issue more information http://www.apache.org/licenses/GPL-compatibility.html.

[gmt]

IANAL but at least with respect to GPLv2, my (relatively vague) understanding is that, although some may consider this to be a "loophole" or bug in the GPLv2, scripted dependencies such as python imports do not create of a derivative work. So, I suppose, this would make Gittle illegal to use in pypy, but legal to use in cpython.

Even so, that's an awfully fine line to tread. Whether I'm right or wrong about the above, the path of least resistance would clearly be to relicense or dual-license Gittle as GPLv2.

To do this, I'm pretty sure Gittle would want the blessing of the owners of its code -- not at all sure its a requirement, but, anyhow, it certainly couldn't hurt to seek it.

For my (tiny) part, that's absolutely fine, and in fact, any contributions I have made or may make in the future to Gittle may be considered to be dual-licensed as Apache2.0 and GPLv2.

Unfortunately, Gittle has done a shit job of identifying the copyright holders of it's code. Does it mostly belong to FriendCode? Some individual? Setting a precedent, here, by adding copyright statements as required by both the GPLv2 and Apache2.0 licenses, is strongly recommended. It also will serve to at least suggest the implicit expectations of the project admins as to who is going to "own" the intellectual "property" therein, at least, in the eyes of those who take that insane, poisonous metaphor seriously :)

IMO your best course of action would be to identify all individuals that have contributed to the code, get their permission to relicense as GPLv2 (or dual-license), and then update both the COPYING file and each individual source file to reflect, respectively, the new licensing and the copyright holders.

Whatever is done, doing it quickly and decisively will help avoid future IP/licensing concerns. Letting this ticket languish creates a kind of "license limbo" that might make future contributors or prospective consumers uncomfortable, or even open the project to legal attack in the unlikely event that it should somehow gain litigious enemies.

[AaronO]

@gmt Thanks for your concern.

I agree that this is an important matter (see #7).

As of right now gittle's dependencies are the following :

• mimer, funky are owned by FriendCode, Inc and authored by myself => Apache v2
• dulwich => GPL (if you look at Dulwich uses GPLv2 license #7, you'll see that @jelmer was thinking about switching to Apache v2)
• paramiko => LGPL
• pycrypto => Is a bit of a mess, split between public domain and GPL

Regarding contributors (https://github.com/FriendCode/gittle/graphs/contributors), gittle's codebase is almost entirely authored by myself (@AaronO), with minor contributions from @SamyPesse on the README's and licenses (not the codebase itself).

Others have contributed mostly tiny fixes (typo fixes or documentation), besides yourself (@gmt) and myself (@AaronO) there are no real authors to the codebase itself.

My stance on licensing gittle is very liberal and is essential "whatever benefits the most people", so I'm fine on dual licensing it Apache v2 and GPL and it seems like @gmt that's something your favorable for as well.

I'm all for getting this sorted out. However I'm extremely busy with other work (https://github.com/FriendCode/codebox for example), so I don't have a lot of mental bandwidth to spend on this matter.

@gmt Would you mind spearheading and managing this matter ?

[gmt]

Hey, been preoccupied, myself, but I'm still here. I'd be happy to look into sorting this out. Pretty sure your comment above gives me most if not all of the ammo I need to do it. Might take a week or two but I'm on it.

[gmt]

Hey, just acknowledging it's been more than a week or two :) Had some unexpected family stuff to deal with, but now I'm back at the helm now. Still have some catch-up to do, but hopefully in the coming week or three I can turn my attention to this.

[AaronO]

@gmt What's your status on this ?

I'm going to be releasing a new gittle@0.4.0 release, with a good handful of fixes and improvements.

It would be nice to get this cleared up. IMHO, we want to be safe, but there shouldn't be any real license issues here.

[gmt]

I'd still waiting to hear something from Sammy. In spite of your out-of-band assurances, I'm still of the opinion that, legally speaking, I can't treat you as speaking for him in this case. Sorry, I know it's kind of ridiculous.

Any chance you can talk him into quickly adding a comment to this issue along the lines of "I'm fine with the above proposal, please go ahead and dual-license my contributions".

Looks like a handful of new contributors have appeared, since I last combed through everything, so I'll to do a quick audit, now, of their contributions. At a glance they mostly looked like one-liners and bug-fixes that I'm comfortable treating as non-substantive -- but if any don't, I'll see about tracking them down and getting their "OK"'s as well.

[SamyPesse]

@gmt sorry for taking so long, everything is ok for me, I'm fine with the above proposal, please go ahead and dual-license my contributions

[gmt]

@SamyPesse, awesome, thanks a ton! Looking over the commit-log, I think ideally we should try to get something from @cscorley. I've got a tweet out to him; he looks pretty active over there so we'll see what happens. In the meanwhile I'll start getting my ducks in a row as far as the actual patches (that part is comparatively easy).

[cscorley]

Hey y'all,

I'm fine with the above proposal, please go ahead and dual-license my contributions.
Feel free to license my contributions to the Gittle project however the maintainers see fit. "Whatever benefits the most people" is also my general stance.

[gmt]

Sweet, that's everyone accounted for if I'm not mistaken. I should have a pull request for you soon.

[jacebrowning]

@gmt dual-licensing my contributions is fine as well.

[gmt]

@jacebrowning, much appreciated, thanks for your quick response (I seem to have glossed over jace's contributions the first time around, and so just bugged him about it moments ago :) )!

[jelmer]

@gmt Gittle is still a derived work if it imports Dulwich.
What does it matter if the library that is loaded comes from .so files or .py
files?

[gmt]

@jelmer my understanding is, it has to do with the language of the GPLv2, which speaks specifically about binary linkage. I believe this "loophole" was one of the reasons the GPLv3 was created, and also is the reason the linux kernel and several other projects specifically disclaim the GPL language about "or any later version at your option" and consider themselves to be GPLv2-licensed only.

Regardless, henceforth, these are academic questions with respect to gittle, which is now licensed as GPLv2 by the owners of its copyright.