Sunday, April 3, 2011

Are two programs installed by the same Setup package still an aggregate under GPL?

Let's say I have two applications: one is the "server" application and licensed under GPLv3 and the other is the "client" application and is licensed under a non-GPL compatible license. The server runs as a Windows service, and the client is a normal windows application, and they communicate only via TCP/IP and XML (no linking at all).

I know that I could distribute both of these on the same media, or together in a zip file, as an "aggregate" as far as the GPL is concerned.

However, can I write an installation program that installs both the server and the client in one process, just to be user friendly?

From stackoverflow
  • Be very careful!

    You'd have to ensure that there are two separate licence click-throughs, one for the GPL v3 code, one for the non-proprietary code. You'd also need to be extremely conscientious in ensuring that users understand their rights with respect to the GPL v3 code, and in demonstrating that you have met your obligations w.r.t making that code available.

    IANAL. I've not double-checked the wording of GPL v3 to be sure there isn't another gotcha.

    In case of doubt, consider consulting with the SFLC (Software Freedom Law Center).


    Nuances

    There's an extensive set of comments below - read it. This note is in part a response to the comments.

    The GPL is not directly an EULA (end-user licence agreement). It is more of a licence to software developers. However, it does confer on the recipients of software certain rights, and the GPL imposes obligations on you as a software developer. In particular, it requires you as the developer to make clear which rights were granted to you and which rights were granted to those to whom you supply the GPL software.

    You do not have to display the text of the GPL. You might just say "Package X is distributed under the terms of the GNU General Public License version 3. You can find the terms of this license at http://www.fsf.org/licensing/licenses/gpl.html. You have certain rights because of this license. You may obtain the source code for Package X from us by downloading it from [...a suitable URL...]. We provide limited support for Package X when it is used with Package Y. ...blah...blah...blah...".

    One advantage of displaying the GPL itself is that you do not have to provide any interpretation of it - and interpreting legal documents is difficult, especially for non-lawyers (such as me!). You might want to make it clear that the users have the rights and do not have to agree to anything; that is sensible (and I believe accurate).

    Note that it is legitimate to charge for support of Package X (the hypothetical GPL v3 software) - provided you actually provide support. That is permitted. You are not obliged to provide support to people who obtain Package X from elsewhere, either; you may limit that support to your own customers. But you can't stop your customers from obtaining the source, or from relaying the source for Package X to friends, colleagues, or customers of their own.

    I'm still not a lawyer - if you need legal advice, be prepared to pay to speak with a lawyer who is experienced with software licencing and the GPL.

    Christoph : The GPL isn't an EULA (it governs distribution rights) - there's no need for a click-through!
    Jonathan Leffler : True - but I'd want to be damn sure that it was clearly understood that there are two separate pieces of code with two separate licences. I've installed a number of bits of software with a GPL licence click-through.
    Christoph : @Jonathan: It's just that using the GPL as a click-through EULA suggests that you (the user) can't use the program if you don't agree to the terms of the GPL; that's not in the spirit of the GPL and might even violate it: users don't have to agree to anything to use GPL'ed programs
    Christoph : ps: it's not really a violation because the user just has to agree to not having to agree to anything ;), but I hope you get my meaning...
    Adam Davis : ooooh, so I should complain to all the projects that do this? I just recently installed somethign that wouldn't install until I clicked "I agree" when it displayed the GPL license. I suppose they're just using the default "license" dialog in their installer.
    Josh Kelley : The Fedora Project deliberately names the button "Understood" rather than "I agree" while displaying the license in their installer to avoid this issue.
    Christoph : Imo the best way to handle these click-through installer messages would be to just put up a notice which say (a) that you may use the program anyway you like; (b) where to get the source; (c) that you may modify/redistribute under the terms and conditions of the GPL (see gpl.txt for details);
    Jonathan Leffler : All this discussion goes to show that my headline advice - 'Be very careful!' - applies. And the GPL is a licence - the L stands for Licence (or License).
    Daniel Lopez : http://www.gnu.org/licenses/gpl-faq.html#ClickThrough
  • I believe you can write an installation program that launches two separate installation programs for each piece of software. Make sure you alert the user that his is going to happen, and in order to make it more obvious you might give them a custom option that permits them to install only one or the other (even if one can't work without the other).

    But you'll still catch flak if you're doing this primarily to avoid GPL licensing the closed source software. They may not be able to do anything about it legally, but you may find some open source competition quickly if you irritate enough people.

    Scott Whitlock : Actually, in the case I'm considering, the "non-GPL compliant" application I'm thinking of would be released under an Apache 2.0 style license because (a) it's a reference implementation and (b) it would link to a 3rd party proprietary library. I believe this would still be in the spirit of OSS.
    Adam Davis : Ah, then you shouldn't get the community backlash, though some will still grumble (too many GPL zealots... sigh)
  • I presume the installer doesn't link to what it's installing, so it looks to me like three separate programs in one aggregate, one of which is GPLv3. In any case, I don't see that kicking off different installer processes will do anything: either this is an aggregate, or it's a single derived work.

    Of course, this depends on the definition of a derivative work, which as far as I know is an undecided legal issue. However, I'd go ahead with the single installer, and make sure that some prominent documentation mentioned the different licenses.

  • As long as

    "The only condition is that you cannot release the aggregate under a license that prohibits users from exercising rights that each program's individual license would grant them."

    http://www.gnu.org/licenses/gpl-faq.html#MereAggregation

    then you should be ok with the installer program. It is not necessary to provide click-throughs, etc. as other posters mention:

    http://www.gnu.org/licenses/gpl-faq.html#ClickThrough

    The main issue, however, is not installation but whether what you are doing is a derived work (it is not as simple as linking or not linking):

    [..]pipes, sockets and command-line arguments are communication mechanisms normally used between two separate programs. [...] But if the semantics of the communication are intimate enough, exchanging complex internal data structures, that too could be a basis to consider the two parts as combined into a larger program.

    http://www.gnu.org/licenses/gpl-faq.html#MereAggregation

    Scott Whitlock : Consider the case of SOAP web services. You have XML over sockets, basically (similar to what I'm trying to do). If the web service was GPL'd, certainly clients that access the service don't have to be GPL'd as well. Perhaps it's the difference between message passing vs. remote procedure calls...
    Daniel Lopez : Yes, the problem is that it falls in a 'grey' area open to interpretation and things quickly go south if there are commercial interests involved. Many companies just choose to buy the commercial version (for dual-licensed open source) and get rid of the risk that way, but not an option for everybody
    Scott Whitlock : I think I can get around this anyway. I'm planning to license the communication module as GPLv3 + Linking Exception. The provided client and server will both be GPLv3. Anyone else who wants to write a compatible server or client can use the communication module in whatever license they want.
    Scott Whitlock : ...or they could rewrite the communication module because the protocol spec will be open.
    Daniel Lopez : Ok, I did not understand initially that you were going to writing the software but rather bundling somebody else's software. If you are creating the software then since it is up to your interpretation, there should be no issues. Affero GPL is another license to look into depending what your aim is

0 comments:

Post a Comment