On 8/21/24 03:42, c.bu...@posteo.jp wrote: > Hello together, > > My question in short: Is "GPLv2" by default "-only" or "-or-later" when > the suffix is not explicit specified?
It's unclear, but "only" is the safe option. The "or later" is essentially a dual license, and merging a single commit anywhere in the history that's only under one license means the result can technically only be distributed under the terms of that one license. (Whether those commits can be retroactively "cleaned out" is... complicated.) Open source isn't joint copyright ownership, with breaks open, but a series of derived works, which breaks closed. With joint ownership of a copyright, any of the copyright holders can provide a license to the copyright. With derived works, each separate copyright holder must compatibly license their contribution or else you can't distribute the result. Thus it's really easy to lose dual licenses, or for more permissive licenses to be replaced by more restrictive "compatible subset" licenses. (But you can't discard ALL permission to distribute or you can't distribute, which is where distribution in violation of license terms comes in. As for what qualifies as "distribution"... it's complicated.) Busybox hit this back in 2006 when we found we'd historically merged some code from linux-kernel sources that were GPLv2 only, and thus our "or later" either needed a lot of careful study and pruning to even potentially reestablish, or it needed to stay with "only". (We were looking into this both because we were launching the first GPL enforcement suits on a historical backlog of reports I'd inherited, known as the "hall of shame", and because GPLv3 was dropping out of "Duke Nukem Forever / Gnu Hurd" eternal vaporware purgatory and actually looked like it might finally become real. Which, sadly, it did.) Note that "a lawyer", "copyright law", and "open source" is like "a programmer", "a ruby programmer", and "ruby on rails using mruby on nommu ipv6-only with what calls itself arm assembly acceleration but is actually thumb2". Don't just ask a random lawyer how this stuff works, the domain expertise is near-fractal. (Last paragraph's very handwavy explanation was from me coming up to speed on new york's second circuit in the late 2000s, with bits of California's ninth circuit and Texas' absolutely batshit fifth circuit, and then of course the "Federal Circuit for Intellectual Property" which is ENTIRELY bullshit. I remember when Harald Welte was doing German enforcement actions circa 2005 and learning about inalienable author's rights, which was an entirely DIFFERENT way to sabotage the concept of "public domain" than what we do in the states. And at the time the law in China was "ha ha, no", but now it's a DIFFERENT kind of "ha ha, no". And did you know that Japan's intellectual property law does not have the doctrine of "fair use"?) > I am a member of an upstream maintainer team that took over a project > [1] two years ago. > The project itself is round about 15 years old. We are the third > generation of maintainers, > and we lack contact with the earlier developers. > > The project is licensed under "GPLv2" without explicit specified suffix > "-only" or "-or-later". Assuming "only" is the safe option. > This is stated on Microsoft GitHub, in the license file, and in the > header of each code file. > However, only the standard GPLv2 text has been copied without > modification. > I have no further information about the licensing. Often there isn't any. You can go through the code's history and try to figure out who is involved, and either contact them or remove their code, which I've done on multiple occasions over the years: https://busybox.net/~landley/forensics.txt http://lists.landley.net/pipermail/toybox-landley.net/2011-November/012976.html This isn't a question of "what do the license and the law say", this is a question of "who are the copyright holders who might cause a stink"? Of course to undermine THAT Bradley Kuhn is currently attempting to invent a whole new legal theory that he personally has standing to sue everyone everywhere over every open source license even if every single copyright holder whose copyright the license is on tells him to take a hike. (And also in passing that "privity of contract" isn't a thing.) https://www.aoshearman.com/en/insights/vizio-ruling-offers-potential-precedent-on-source-code As I said: actual lawyers. There's a minefield of zealots and rich people working at cross purposes in a patchwork of conflicting legal jurisdictions... If you're wondering why I don't GPL my code anymore when given a choice... yeah. > If I understand this standard text correctly, it does not clearly > specify whether the > project is "GPLv2-only" or "GPLv2-or-later". To my knowledge there are > no exclusive > license texts to this two variants. This distinction would need to be > specified elsewhere. > > How should one handle this if I cannot determine it with certainty, > especially since I > cannot contact the previous authors? Are there any precedents for this? Quite a few. They contradict, plus jurisdictional salad, changes over time, people like Bradley who invent the law they want and argue for it in court despite all precedent until they get lucky with a batty judge or the other side runs out of money... (Ask me about Apple vs Franklin sometime. Foundational to modern computer IP law, and CLEARLY a special case technicality that could EASILY have been appealed but the result was what the big money wanted and they'd ground away until they got it then stopped there.) > Can I freely interpret the license and simply state that it is > "-or-later"? If nobody objects, you can do anything you want. If they do object (at some point in the future, no useful statute of limitations on this stuff last I checked) then it gets messy and bespoke. It's entirely possible you DO have a viable "or later" project, and it's entirely possible nobody would ever DO anything about it if you didn't, and even if they did it's entirely possible you'd win in court or at least be able to talk them down. But I can't tell you that from here. I do note that "GPLv3 only" is a license people who switched to it tend to regret, such as Samba maintainer Jeremy Allison who explicitly lamented the switch in https://archive.org/details/copyleftconf2020-allison > In this case the project would be more flexible to contributions in the > future. How so? You could accept the same set of patches, dropping the "or later" would just affect who could take code FROM your project and put it into other projects. If you merge GPLv3-only code into your project, you've also dropped half the dual license. > Are there any court rulings, guidelines, or recommendations from > advocacy > groups (e.g., FSF, FSFE, OSSI, etc.) on this matter? Alas "do your own research" (read a dozen blogs that all reference each other as sources) works about as poorly with licensing as with vaccination. I worked with a half-dozen different lawfirms over something like 25 years to become as badly half-assed at it as I am, and the result of all that is I'd find a real lawyer to book professional hours into doing an official write-up for you, and anything short of that is "have fun storming the castle" territory. Maybe ping https://softwarefreedom.org/services/ and see if they can either do an opinion for your specific case, or recommend somebody to be YOUR lawyer in this matter? Founded by a co-author of GPLv2 and GPLv3, if ANYBODY knows it's them. Rob _______________________________________________ The opinions expressed in this email are those of the sender and not necessarily those of the Open Source Initiative. Official statements by the Open Source Initiative will be sent from an opensource.org email address. License-discuss mailing list License-discuss@lists.opensource.org http://lists.opensource.org/mailman/listinfo/license-discuss_lists.opensource.org
