From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp2 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id ONYWMPsYl2DcJAAAgWs5BA (envelope-from ) for ; Sun, 09 May 2021 01:04:27 +0200 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp2 with LMTPS id MFWkK/sYl2D9IQAAB5/wlQ (envelope-from ) for ; Sat, 08 May 2021 23:04:27 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 71F93194B9 for ; Sun, 9 May 2021 01:04:27 +0200 (CEST) Received: from localhost ([::1]:37090 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lfVzm-0001zy-Ka for larch@yhetil.org; Sat, 08 May 2021 19:04:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:33060) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lfVzc-0001zW-Tm for guix-devel@gnu.org; Sat, 08 May 2021 19:04:16 -0400 Received: from mailrelay.tugraz.at ([129.27.2.202]:48815) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lfVzZ-0005yf-MG for guix-devel@gnu.org; Sat, 08 May 2021 19:04:16 -0400 Received: from nijino.local (91-114-247-246.adsl.highway.telekom.at [91.114.247.246]) by mailrelay.tugraz.at (Postfix) with ESMTPSA id 4Fd2tt5dqwz3x5f; Sun, 9 May 2021 01:04:06 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tugraz.at; s=mailrelay; t=1620515047; bh=Cf+r1o2mb0WkT9v72Q+xPiVX8s1JoXDbTNu6G3AvNs4=; h=Subject:From:To:Cc:Date:In-Reply-To:References; b=mWAM6Zwi70Qzm1j+uHsJSIgLOPghIBt9oMPmtaPmCfhWJhwj6h5GTNW9QMfHPpnD4 +wwHhljXCDPITBG5pM8TFNKmu6ABPRaNQ9slqNNgNtD01RKswo/8EtxG74pjgoBmjf i6sJZANATxlOE9cQQkptf8sX7nkLXQ+V7+mGAuHs= Message-ID: <7e605fcdba4ac830ab73719dcda902a2a39ad93a.camel@student.tugraz.at> Subject: Re: The purpose of the "license" list of a Guix package (Was: Re: Jam: which licence is this?) From: Leo Prikler To: Maxime Devos , Chris Marusich , Leo Famulari Date: Sun, 09 May 2021 01:04:05 +0200 In-Reply-To: <9b059ccb9cc50e27329824f88d9d049072d30f23.camel@telenet.be> References: <87tunuq1ei.fsf@elephly.net> <87sg3ejmxv.fsf@netris.org> <87h7juje1a.fsf@netris.org> <874kflrb1t.fsf@netris.org> <871rai2y5f.fsf_-_@gmail.com> <9b059ccb9cc50e27329824f88d9d049072d30f23.camel@telenet.be> Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.34.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-TUG-Backscatter-control: bt4lQm5Tva3SBgCuw0EnZw X-Spam-Scanner: SpamAssassin 3.003001 X-Spam-Score-relay: -1.9 X-Scanned-By: MIMEDefang 2.74 on 129.27.10.117 Received-SPF: pass client-ip=129.27.2.202; envelope-from=leo.prikler@student.tugraz.at; helo=mailrelay.tugraz.at X-Spam_score_int: -42 X-Spam_score: -4.3 X-Spam_bar: ---- X-Spam_report: (-4.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: guix-devel@gnu.org Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: "Guix-devel" X-Migadu-Flow: FLOW_IN ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1620515067; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post:dkim-signature; bh=Cf+r1o2mb0WkT9v72Q+xPiVX8s1JoXDbTNu6G3AvNs4=; b=DUwrOJYHFAx3hrcjNz5doB4RYaHomxa7uPL28jNLZzT5tnCfa/pQOmYre1OOxk94rupKu8 1BpEH5v5YNVlyZs9fHcorzuEckd5w3um4R1rygwFoks4gROIdnZUUAs7jX/dU0mlfdESwq Y+zz0xWhBoTPzEROeS1y6Si0dcXHPRICUefaLRyKlg9cOHelyjbwF5PmOnI7ePoKahUgVt IAKwb6cZu8wUm4k36Y3IA59197MNjTRAU+tKOI5irdZynn0z+kMzbLGh7/qE3Qdo42CqSc a39Ye8SZ0YxAVNz5aQJgU2hCYfX9DiP70qg631XsiQ9SLqzlFjz5l08Ko9mnTw== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1620515067; a=rsa-sha256; cv=none; b=RRhZEnlidsCc253hFfBAJsGKErNRU5uoCWHms3Sm2NgC9mHIIxtmPp8u8iHHqqZOkKre4m 1cgCYWBQl/DbkCsCN7QfTJx+nPFl4962TKCWHzwKKLszyqKQf+AURgMZdTw2ltehKf3ra6 lNYnfN4EwrtoUHHWu7oR9IixM6wfeEqn2RtWIh2OGLUkYoJ5qN+gFr4yuzpvVzOEASCUqc wDcM5Ten8jkIR+RbsG9zY0KTisvKuIwucq6hYuVsxV5ZN62EP+nziI3JrLYar7M/RaXhLX OTCSCi0ahqNJEtatNSQdXvw0hiOsjKAJXAaO/HyFJVH0b8jcHpebYBoiSrHiTw== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=pass header.d=tugraz.at header.s=mailrelay header.b=mWAM6Zwi; dmarc=pass (policy=none) header.from=student.tugraz.at; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Spam-Score: -3.15 Authentication-Results: aspmx1.migadu.com; dkim=pass header.d=tugraz.at header.s=mailrelay header.b=mWAM6Zwi; dmarc=pass (policy=none) header.from=student.tugraz.at; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Queue-Id: 71F93194B9 X-Spam-Score: -3.15 X-Migadu-Scanner: scn0.migadu.com X-TUID: siemJ2dExC+T Am Samstag, den 08.05.2021, 22:52 +0200 schrieb Maxime Devos: > Leo Prikler schreef op za 08-05-2021 om 12:16 [+0200]: > > [... something about dependencies and copyleft ...] > > [...] > > However, compliance is not *that* simple. If you're dealing with > > copyleft, providing the source is not enough, you also need to > > license > > your own work under that copyleft license, e.g. the GPL. [...] > > Just checking if our understanding is the same, as I have seen a > discussion on IRC where people the situation described below was > _not_ legally acceptable. Disclaimer: IANAL, but I'd argue the following. > Suppose we have a GPLv3+ library, say guile-jwt. > Suppose there is a (group of) developer(s) writing an application > using guile-jwt. Let's call the application APP, and the developer(s) > DEV. At this point in time, I'd argue, that APP is "a work based on guile- jwt", as defined in section 0 of the GPLv3. > A hypothetical situation: > > * Suppose DEV is not very fond of licensing APP under a copyleft > license, > and insteads prefers something with basically no licenses. > * DEV wants to choose, say, license:expat. > * license:expat is not license:gpl3 > * Would this be a problem? I would think not. While APP used > guile-jwt, it doesn't include or modify its source code. I would think yes. If what you said was true about Guile code, then any proprietary code could just link against the GPL willy-nilly (well, they'd have to take care to explicitly call dlopen, but you get the point). That obviously is not the case, the LGPL exists for a reason. > So I would think DEV must still respect GPL for the combination > (e.g., if DEV provides binaries for APP, they must include source > code for guile-jwt *and* APP), and theoretically someone may fork > APP to replace guile-jwt with a hypothetical guile-jwt/expat, and > at that point the GPL doesn't apply anymore to the combination > APP-with-guile-jwt/expat. I agree, that they'd at least have to provide the Corresponding Source as laid out in section 6, but I also think they'd have to follow section 4 and 5, in particular 5c. The code within APP, that is not directly related to guile-jwt may very well be Expat, and DEV might even go so far as to claim, that "just the source" of the other stuff is Expat as well, but APP as a package must be GPL'd (unless APP is only using public domain or Expat parts of guile-jwt if they exist). Once someone does have an expat-fork of guile-jwt and it's fair to no longer assume APP to be based on guile-jwt, but rather guile-jwexpat, the package as a whole can be distributed under the Expat license. > I would find it interesting to know if some ‘legal people’ have > worked out this situation. Which ones? The ones who tell you "you must form a bill of materials" or the ones who tell you "just provide the source"? :) Regards, Leo PS: The above was written under the assumption, that you write your app in a way, that it calls guile-jwt directly, not by forking guile and communicating to it through pipes or sockets.