GPL/LGPL licensing of the Alsa library

GPL/LGPL licensing of the Alsa library

[Ossi Niiranen]

Hi,

We recently performed a licensing audit of a larger software project incorporating the Alsa library 1.0.19. One issue we identified was that although the Alsa library purported to state that the library was licensed under the LGPL, there were still several files with third party copyright holders that indicated in their header that the file in question was licensed under the GPL.

Does the Alsa project have some sort of documentation somewhere showing that the third parties consented to the re-licensing under the LGPL, or does it have copies of contributor agreements showing that the copyright holders granted the project organisation rights to re-license under the LGPL?

I realise nobody here is under any obligation to answer any of my questions, but if someone has the time, it would be greatly appreciated!

Regards.


---
Ossi Niiranen
Lakimies / Attorney-at-law (NY)
Neolex AB
Tel. +358 400 414 289
http://www.neolex.fi
LinkedIn: http://fi.linkedin.com/in/oniiranen
Twitter: http://www.twitter.com/oniiranen

The information contained in this e-mail is privileged and confidential, intended only for the use of the recipient named above. If the reader of this message is not the above mentioned recipient please note that any saving, distribution or copying of this e-mail is strictly prohibited. Please notify us promptly by e-mail at info@neolex.fi should you have received such misdirected messages and kindly destroy this e-mail. Thank You.

Re: GPL/LGPL licensing of the Alsa library

[Jaroslav Kysela]

On Mon, 28 Mar 2011, Ossi Niiranen wrote:

> Hi,
>
> We recently performed a licensing audit of a larger software project 
> incorporating the Alsa library 1.0.19. One issue we identified was that 
> although the Alsa library purported to state that the library was 
> licensed under the LGPL, there were still several files with third party 
> copyright holders that indicated in their header that the file in 
> question was licensed under the GPL.

Please, show us the list of files with different licenses to check.
I found test files and aserver (which is not probably used widely and the 
code is optional) as GPL. The library itself (.a and .so binaries) should 
follow LGPL.

 					Jaroslav

-----
Jaroslav Kysela <perex@perex.cz>
Linux Kernel Sound Maintainer
ALSA Project, Red Hat, Inc.

Re: GPL/LGPL licensing of the Alsa library

[Clemens Ladisch]

Ossi Niiranen wrote:
> We recently performed a licensing audit of a larger software project
> incorporating the Alsa library 1.0.19. One issue we identified was
> that although the Alsa library purported to state that the library was
> licensed under the LGPL, there were still several files with third
> party copyright holders that indicated in their header that the file
> in question was licensed under the GPL.

$ grep -rl 'GNU General' alsa-lib/
alsa-lib/COPYING
alsa-lib/aserver/COPYING
alsa-lib/aserver/aserver.c
alsa-lib/include/sound/asequencer.h
alsa-lib/include/sound/asound.h
alsa-lib/include/sound/asound_fm.h
alsa-lib/include/sound/asoundef.h
alsa-lib/include/sound/emu10k1.h
alsa-lib/include/sound/hdsp.h
alsa-lib/include/sound/hdspm.h
alsa-lib/include/sound/sb16_csp.h
alsa-lib/m4/attributes.m4
alsa-lib/src/ucm/main.c
alsa-lib/src/ucm/parser.c
alsa-lib/src/ucm/ucm_local.h
alsa-lib/src/ucm/utils.c
alsa-lib/test/latency.c
alsa-lib/test/oldapi.c
alsa-lib/test/playmidi1.c

The aserver tool and the tests are separate and not part of the library
itself; the UCM stuff is actually LGPL-licensed and mentions the GPL
only in "You should have received a copy of the GNU General Public
License ...".

Most files in include/sound/ are just copies of the kernel headers.

Is there any specific file that you think would make the resulting
library not LGPL?

> The information contained in this e-mail is privileged ...

This e-mail contains public information intended for any subscriber of
this mailing list and for anybody else who bothers to read it; it will
be copied, disclosed and distributed to the public.  If you think you
are not the intended recipient, please commit suicide immediately.
These terms apply also to any e-mails quoted in, referenced from, or
answering this e-mail, and supersede any confidentiality notices in
those e-mails.  Additionally, confidentiality notices in those e-mails
will incur legal processing fees of $42 per line; you have agreed to
this by reading this confidentiality notice.


Regards,
Clemens

Re: GPL/LGPL licensing of the Alsa library

[Jaroslav Kysela]

On Mon, 28 Mar 2011, Clemens Ladisch wrote:

> alsa-lib/src/ucm/main.c
> alsa-lib/src/ucm/parser.c
> alsa-lib/src/ucm/ucm_local.h
> alsa-lib/src/ucm/utils.c

> the UCM stuff is actually LGPL-licensed and mentions the GPL
> only in "You should have received a copy of the GNU General Public
> License ...".

I fixed the text in GIT now. Thank you for this notice.

 					Jaroslav

-----
Jaroslav Kysela <perex@perex.cz>
Linux Kernel Sound Maintainer
ALSA Project, Red Hat, Inc.

Re: GPL/LGPL licensing of the Alsa library

[Ossi Niiranen]

Thank you Clemens and Jaroslav. 

I'll compare this file list to ours and let you know if there are differences. 

One question though. Can you point me to any documentation on aserver so I could understand a bit better what it does? Googling revealed rather simple descriptions in the form of "aserver is contained in the ALSA library" and "aserver provides the ALSA library".

And point taken re the confidentiality notice;). It is included as standard in all our emails (and actually serves a purpose in some cases), but you are absolutely right that I should remember to remove it when posting to a mailing list. An omission on my part.

On Mar 28, 2011, at 12:00 PM, Clemens Ladisch wrote:

> Ossi Niiranen wrote:
>> We recently performed a licensing audit of a larger software project
>> incorporating the Alsa library 1.0.19. One issue we identified was
>> that although the Alsa library purported to state that the library was
>> licensed under the LGPL, there were still several files with third
>> party copyright holders that indicated in their header that the file
>> in question was licensed under the GPL.
> 
> $ grep -rl 'GNU General' alsa-lib/
> alsa-lib/COPYING
> alsa-lib/aserver/COPYING
> alsa-lib/aserver/aserver.c
> alsa-lib/include/sound/asequencer.h
> alsa-lib/include/sound/asound.h
> alsa-lib/include/sound/asound_fm.h
> alsa-lib/include/sound/asoundef.h
> alsa-lib/include/sound/emu10k1.h
> alsa-lib/include/sound/hdsp.h
> alsa-lib/include/sound/hdspm.h
> alsa-lib/include/sound/sb16_csp.h
> alsa-lib/m4/attributes.m4
> alsa-lib/src/ucm/main.c
> alsa-lib/src/ucm/parser.c
> alsa-lib/src/ucm/ucm_local.h
> alsa-lib/src/ucm/utils.c
> alsa-lib/test/latency.c
> alsa-lib/test/oldapi.c
> alsa-lib/test/playmidi1.c
> 
> The aserver tool and the tests are separate and not part of the library
> itself; the UCM stuff is actually LGPL-licensed and mentions the GPL
> only in "You should have received a copy of the GNU General Public
> License ...".
> 
> Most files in include/sound/ are just copies of the kernel headers.
> 
> Is there any specific file that you think would make the resulting
> library not LGPL?
> 
>> The information contained in this e-mail is privileged ...
> 
> This e-mail contains public information intended for any subscriber of
> this mailing list and for anybody else who bothers to read it; it will
> be copied, disclosed and distributed to the public.  If you think you
> are not the intended recipient, please commit suicide immediately.
> These terms apply also to any e-mails quoted in, referenced from, or
> answering this e-mail, and supersede any confidentiality notices in
> those e-mails.  Additionally, confidentiality notices in those e-mails
> will incur legal processing fees of $42 per line; you have agreed to
> this by reading this confidentiality notice.
> 
> 
> Regards,
> Clemens

---
Ossi Niiranen
Lakimies / Attorney-at-law (NY)
Neolex AB
Tel. +358 400 414 289
http://www.neolex.fi
LinkedIn: http://fi.linkedin.com/in/oniiranen
Twitter: http://www.twitter.com/oniiranen

Re: GPL/LGPL licensing of the Alsa library

[Takashi Iwai]

At Mon, 28 Mar 2011 12:19:55 +0300,
Ossi Niiranen wrote:
> 
> Thank you Clemens and Jaroslav. 
> 
> I'll compare this file list to ours and let you know if there are differences. 
> 
> One question though. Can you point me to any documentation on
> aserver so I could understand a bit better what it does? Googling
> revealed rather simple descriptions in the form of "aserver is
> contained in the ALSA library" and "aserver provides the ALSA
> library". 

It's a daemon program to serve the multiple streaming using alsa-lib
PCM shm plugin.  This is a legacy technology, and mostly you can
ignore it but just for fun.


Takashi

Re: GPL/LGPL licensing of the Alsa library

[Ossi Niiranen]

Sorry it took a while, but here's the list (this does not include files with
the autoconf exception):

asequencer.h
aserver.c
asoundef.h
asound_fm.h
asound.h
attributes.m4
(autoconf files)
emu10k1.h
hdsp.h
latency.c
oldapi.c
playmidi1.c
sb16_csp.h
sndop-mixer.alisp
sndo-mixer.alisp

The source code distribution of the package we reviewed does not seem to
include the hdspm.h file you refer to below nor the UCM files. Does that
mean the distribution is in some way "broken"?

Ours did include also the sndop-mixer files which seem to be licensed under
the GPL as well (although at least one of them does not necessarily warrant
copyright protection as it is just a few lines).

You made some generic comments in your email about why the GPL licensing is
not an issue. If you have the time and the interest (there is obviously no
obligation), I'd wish to take that a bit further into a file specific
analysis (as we need certainty on a file level to be able to see there is no
risk). For example, you say that aserver is "separate". Does that mean it is
not shipped with the Alsa library? The impression I got from another
response to my earlier post was that it is a legacy technology but still
shipped with the library. If that's the case, I could not simply say that
there are no GPL issues without further information on how this legacy tech
is used. I need to do a similar file-based analysis for the other files as
well to make sure there are no issues.

Just to re-emphasise something. My goal here is simply to produce an opinion
on whether the licensing of a larger software package (which includes the
alsa library) is properly managed - not to accuse anyone of anything. This
process however requires quite a lot of digging into technical
implementations and I thus appreciate the effort you folks have already put
into helping me on this.

- Ossi

On Mon, Mar 28, 2011 at 12:00 PM, Clemens Ladisch <clemens@ladisch.de>wrote:

> Ossi Niiranen wrote:
> > We recently performed a licensing audit of a larger software project
> > incorporating the Alsa library 1.0.19. One issue we identified was
> > that although the Alsa library purported to state that the library was
> > licensed under the LGPL, there were still several files with third
> > party copyright holders that indicated in their header that the file
> > in question was licensed under the GPL.
>
> $ grep -rl 'GNU General' alsa-lib/
> alsa-lib/COPYING
> alsa-lib/aserver/COPYING
> alsa-lib/aserver/aserver.c
> alsa-lib/include/sound/asequencer.h
> alsa-lib/include/sound/asound.h
> alsa-lib/include/sound/asound_fm.h
> alsa-lib/include/sound/asoundef.h
> alsa-lib/include/sound/emu10k1.h
> alsa-lib/include/sound/hdsp.h
> alsa-lib/include/sound/hdspm.h
> alsa-lib/include/sound/sb16_csp.h
> alsa-lib/m4/attributes.m4
> alsa-lib/src/ucm/main.c
> alsa-lib/src/ucm/parser.c
> alsa-lib/src/ucm/ucm_local.h
> alsa-lib/src/ucm/utils.c
> alsa-lib/test/latency.c
> alsa-lib/test/oldapi.c
> alsa-lib/test/playmidi1.c
>
> The aserver tool and the tests are separate and not part of the library
> itself; the UCM stuff is actually LGPL-licensed and mentions the GPL
> only in "You should have received a copy of the GNU General Public
> License ...".
>
> Most files in include/sound/ are just copies of the kernel headers.
>
> Is there any specific file that you think would make the resulting
> library not LGPL?
>
> > The information contained in this e-mail is privileged ...
>
> This e-mail contains public information intended for any subscriber of
> this mailing list and for anybody else who bothers to read it; it will
> be copied, disclosed and distributed to the public.  If you think you
> are not the intended recipient, please commit suicide immediately.
> These terms apply also to any e-mails quoted in, referenced from, or
> answering this e-mail, and supersede any confidentiality notices in
> those e-mails.  Additionally, confidentiality notices in those e-mails
> will incur legal processing fees of $42 per line; you have agreed to
> this by reading this confidentiality notice.
>
>
> Regards,
> Clemens
>

Re: GPL/LGPL licensing of the Alsa library

[Clemens Ladisch]

Ossi Niiranen wrote:
> The source code distribution of the package we reviewed does not seem to
> include the hdspm.h file you refer to below nor the UCM files. Does that
> mean the distribution is in some way "broken"?

No, I just used whatever alsa-lib I had lying around, about 1.0.24.

> Ours did include also the sndop-mixer files which seem to be licensed under
> the GPL as well (although at least one of them does not necessarily warrant
> copyright protection as it is just a few lines).

I just searched for "GNU General"; this string isn't in these files.
I'm happy to see that your research is more thorough.  :-)

> You made some generic comments in your email about why the GPL licensing is
> not an issue. If you have the time and the interest (there is obviously no
> obligation), I'd wish to take that a bit further into a file specific
> analysis (as we need certainty on a file level to be able to see there is no
> risk).

OK

> For example, you say that aserver is "separate". Does that mean it is
> not shipped with the Alsa library? The impression I got from another
> response to my earlier post was that it is a legacy technology but still
> shipped with the library. If that's the case, I could not simply say that
> there are no GPL issues without further information on how this legacy tech
> is used.

The aserver executable is shipped _with_ the ALSA library, but it is not
part of the library itself; applications that use the ALSA library do
not use aserver directly.

The ALSA library offers an API that allows application to access sound
devices.  Furthermore, the library contains several plugins that
implement the actual access to specific devices, as well as other
plugins that modify the sound data (e.g., sample rate conversion) and
redirect the result to another plugin.

In most cases, the plugin at the bottom of this stack is the "hw" plugin
which interfaces with the ALSA drivers in the kernel.

There are the "shm" and "share" plugins that use sockets to talk with
the aserver program, which runs as a separate process and also uses
alsa-lib to access the actual sound device.  The goal of this is to
allow multiple programs to share this sound device.

Applications that link to the ALSA library use only the public API and
typically do not know which plugin(s) are used to implement the device;
the plugin configuration is read by alsa-lib from some machine-specific
.conf files.  (I wrote "typically" because it is possible for
applications to create their own configuration from scratch.)

Nowadays, the plugins that use aserver are considered legacy because
the dshare and dmix plugins allow the same sharing without having to run
a separate server program.

In conclusion, applications that use alsa-lib are not "derived from" or
"based on" the aserver program (in any interpretation of these clauses);
this falls clearly under the "mere aggregation" clause of the GPL.

> include/sound/asound.h
> include/sound/asoundef.h
> include/sound/asequencer.h

These files are copies of the respective kernel files and define the
interface between the kernel and the hw plugins.

> include/sound/asound_fm.h
> include/sound/emu10k1.h
> include/sound/hdsp.h
> include/sound/sb16_csp.h

These files are copies of the respective kernel files and define
interfaces that applications can use to directly access certain
hardware-dependent parts of these drivers.

The ALSA library uses only the system calls defined in these kernel
headers, so it is not derived from the kernel.

> m4/attributes.m4

Parts of this file are copied into the configure script when running
Autoconf.  This falls under the Autoconf exception.

> alsa-lib/test/latency.c
> alsa-lib/test/oldapi.c
> alsa-lib/test/playmidi1.c

The test programs are neither used by nor shipped with the compiled
alsa-lib.

> *.alisp

As far as I can tell, these files are not actually used anywhere.


Regards,
Clemens