[Cocci] licensing concerns with cocci patches

[Cocci] licensing concerns with cocci patches

[Eitan Adler]

Hi,

I am interested in adding cocci scripts to the FreeBSD tree as a suite
of scripts that can be used to help find bugs.  I have some concerns
about the license of the "semantic patches" I found.  In particular
quite a few of them are GPLv2 (andand.cocci, ifaddr.cocci,
isnull.cocci, etc). Ordinarily the product of GPL software isn't GPLed
but these seem different as the result is merely a transformation of
patch template.

Is the output of spatch + a GPL semantic patch GPL or can we license
it under a free software license?

-- 
Eitan Adler

[Cocci] licensing concerns with cocci patches

[Julia Lawall]

On Mon, 22 Oct 2012, Eitan Adler wrote:

> Hi,
>
> I am interested in adding cocci scripts to the FreeBSD tree as a suite
> of scripts that can be used to help find bugs.  I have some concerns
> about the license of the "semantic patches" I found.  In particular
> quite a few of them are GPLv2 (andand.cocci, ifaddr.cocci,
> isnull.cocci, etc). Ordinarily the product of GPL software isn't GPLed
> but these seem different as the result is merely a transformation of
> patch template.
>
> Is the output of spatch + a GPL semantic patch GPL or can we license
> it under a free software license?

My understanding is that the output of a semantic patch should not be GPL.
But I am not an expert.  In any case, that is the intent.  We would
certainly be happy that the scripts be part of BSD.

julia

[Cocci] licensing concerns with cocci patches

[Eitan Adler]

On 22 October 2012 13:05, Julia Lawall <julia.lawall@lip6.fr> wrote:
> My understanding is that the output of a semantic patch should not be GPL.
> But I am not an expert.  In any case, that is the intent.  We would
> certainly be happy that the scripts be part of BSD.

Awesome. Hopefully I will be able to start gathering a set of useful
scripts soon.



-- 
Eitan Adler

[Cocci] licensing concerns with cocci patches

[Luis R. Rodriguez]

On Tue, Oct 23, 2012 at 8:04 AM, Eitan Adler <lists@eitanadler.com> wrote:
> On 22 October 2012 13:05, Julia Lawall <julia.lawall@lip6.fr> wrote:
>> My understanding is that the output of a semantic patch should not be GPL.
>> But I am not an expert.  In any case, that is the intent.  We would
>> certainly be happy that the scripts be part of BSD.
>
> Awesome. Hopefully I will be able to start gathering a set of useful
> scripts soon.

So... We should talk a bit more :) Also I'd love to help iron out any
FUD over licensing issues given that it seems the intent expressed is
not to enforce requirement of output being GPL derivative.

  Luis

[Cocci] licensing concerns with cocci patches

[Julia Lawall]

On Tue, 23 Oct 2012, Eitan Adler wrote:

> On 22 October 2012 13:05, Julia Lawall <julia.lawall@lip6.fr> wrote:
>> My understanding is that the output of a semantic patch should not be GPL.
>> But I am not an expert.  In any case, that is the intent.  We would
>> certainly be happy that the scripts be part of BSD.
>
> Awesome. Hopefully I will be able to start gathering a set of useful
> scripts soon.

I wonder if for BSD you are actually interested in using the rules that do 
transformation?  Most of the rules that are distributed with Linux can be 
used in several ways, to do transformation or to print a report.  For the 
ones that only print reports, I guess there is no problem at all, because 
no code is generated?  I'm not sure what would be the status of the rules 
that can do transformation if you only use them to generate reports.

julia

[Cocci] licensing concerns with cocci patches

[Eitan Adler]

On 23 October 2012 15:18, Julia Lawall <julia.lawall@lip6.fr> wrote:
> I wonder if for BSD you are actually interested in using the rules that do
> transformation?

Yes. This was the subject of mail. Ideally they could be 2-BSD
licensed (or dual-licensed) which solves the problem entirely. If not,
I'd be willing to accept assertions of the authors that they do not
intend for the output of the transformations to be
considered GPL.

> Most of the rules that are distributed with Linux can be
> used in several ways, to do transformation or to print a report.  For the
> ones that only print reports, I guess there is no problem at all, because no
> code is generated?

>  I'm not sure what would be the status of the rules that
> can do transformation if you only use them to generate reports.

As I understand it, there is no problem at all for reports as the code
is not being directly used (it is similar to a warning from gcc).

-- 
Eitan Adler

[Cocci] licensing concerns with cocci patches

[Julia Lawall]

On Tue, 23 Oct 2012, Eitan Adler wrote:

> On 22 October 2012 13:05, Julia Lawall <julia.lawall@lip6.fr> wrote:
>> My understanding is that the output of a semantic patch should not be GPL.
>> But I am not an expert.  In any case, that is the intent.  We would
>> certainly be happy that the scripts be part of BSD.
>
> Awesome. Hopefully I will be able to start gathering a set of useful
> scripts soon.

I should point out that what is described as "the intent" is only my 
intent.  I think there are a few scripts submitted by other people.  I 
don't know if they do transformations or just bug finding.

julia

[Cocci] licensing concerns with cocci patches

[Angelos Oikonomopoulos]

> On Tue, Oct 23, 2012 at 8:04 AM, Eitan Adler <lists@eitanadler.com> wrote:
>> On 22 October 2012 13:05, Julia Lawall <julia.lawall@lip6.fr> wrote:
>>> My understanding is that the output of a semantic patch should not be GPL.
>>> But I am not an expert.  In any case, that is the intent.  We would
>>> certainly be happy that the scripts be part of BSD.
>>
>> Awesome. Hopefully I will be able to start gathering a set of useful
>> scripts soon.
>
> So... We should talk a bit more :) Also I'd love to help iron out any
> FUD over licensing issues given that it seems the intent expressed is
> not to enforce requirement of output being GPL derivative.

Hello,

I apologize for not replying in-thread, but I'm only an occasional user 
of coccinelle, so I wasn't subscribed to the list.

The concept that the GPL would apply to the output of spatch, just 
because spatch itself is under the GPL is well beyond far-fetched. By 
the same logic, it could as well apply to the results of a 
search-and-replace in emacs :)

The FSF claims that this is not even legally possible, let alone a 
requirement of the GPL. That goes for any version of the GPL, but I'll 
just link to the GPLv2 FAQ, as that's what coccinelle uses:

https://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.html#GPLOutput

Coccinelle itself does not produce any code, it transforms code 
according to supplied rules. If the rules are under the GPL, again there 
is no requirement about the result of the transformation whatsoever. 
There are numerous clauses in the GPLv2 to support this statement, but 
I'll just quote the 0th one:

"The act of running the Program is not restricted, and the output from 
the Program is covered only if its contents constitute a work based on 
the Program (independent of having been made by running the Program)"

As a general rule of thumb, one should keep in mind that the the GPL is 
concerned with preventing the GPL code itself from becoming proprietary 
and does NOT try to force people to open up their code.

I'm happy that coccinelle is around, I like having it in my toolbox and 
I would like it if even more projects used it (and more semantic patches 
became available). I would not want to see its adoption hindered based 
on some unfounded misconception, nor would I want to see this 
misconception spread to the coccinelle community :)

FWIW, the DragonFlyBSD project (to which I occasionally contribute) has 
been happily using coccinelle semantic patches with good results for a 
while now and I'm glad to hear FreeBSD is going to embrace it further.

Hope this helps,
Aggelos

[Cocci] licensing concerns with cocci patches

[Julia Lawall]

On Tue, 23 Oct 2012, Angelos Oikonomopoulos wrote:

>> On Tue, Oct 23, 2012 at 8:04 AM, Eitan Adler <lists@eitanadler.com> 
>> wrote:
>>> On 22 October 2012 13:05, Julia Lawall <julia.lawall@lip6.fr> wrote:
>>>> My understanding is that the output of a semantic patch should not be 
>>>> GPL.
>>>> But I am not an expert.  In any case, that is the intent.  We would
>>>> certainly be happy that the scripts be part of BSD.
>>> 
>>> Awesome. Hopefully I will be able to start gathering a set of useful
>>> scripts soon.
>> 
>> So... We should talk a bit more :) Also I'd love to help iron out any
>> FUD over licensing issues given that it seems the intent expressed is
>> not to enforce requirement of output being GPL derivative.
>
> Hello,
>
> I apologize for not replying in-thread, but I'm only an occasional user of 
> coccinelle, so I wasn't subscribed to the list.
>
> The concept that the GPL would apply to the output of spatch, just because 
> spatch itself is under the GPL is well beyond far-fetched. By the same logic, 
> it could as well apply to the results of a search-and-replace in emacs :)

Not quite.  Because thre is no GPL on the replace.  The user writes the 
replace himself.  What is being discussed is semantic patches that are 
GPL'd, not the fact that Coccinelle itself is GPL'd.

> The FSF claims that this is not even legally possible, let alone a 
> requirement of the GPL. That goes for any version of the GPL, but I'll just 
> link to the GPLv2 FAQ, as that's what coccinelle uses:
>
> https://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.html#GPLOutput
>
> Coccinelle itself does not produce any code, it transforms code according to 
> supplied rules. If the rules are under the GPL, again there is no requirement 
> about the result of the transformation whatsoever. There are numerous clauses 
> in the GPLv2 to support this statement, but I'll just quote the 0th one:
>
> "The act of running the Program is not restricted, and the output from the 
> Program is covered only if its contents constitute a work based on the 
> Program (independent of having been made by running the Program)"
>
> As a general rule of thumb, one should keep in mind that the the GPL is 
> concerned with preventing the GPL code itself from becoming proprietary and 
> does NOT try to force people to open up their code.
>
> I'm happy that coccinelle is around, I like having it in my toolbox and I 
> would like it if even more projects used it (and more semantic patches became 
> available). I would not want to see its adoption hindered based on some 
> unfounded misconception, nor would I want to see this misconception spread to 
> the coccinelle community :)
>
> FWIW, the DragonFlyBSD project (to which I occasionally contribute) has been 
> happily using coccinelle semantic patches with good results for a while now 
> and I'm glad to hear FreeBSD is going to embrace it further.

Thanks for the input.  It is clearly an issue that needs to be understood 
better.

julia

[Cocci] licensing concerns with cocci patches

[Angelos Oikonomopoulos]

On 23/10/2012 11:42 ??, Julia Lawall wrote:
> On Tue, 23 Oct 2012, Angelos Oikonomopoulos wrote:
[...]
>> The concept that the GPL would apply to the output of spatch, just
>> because spatch itself is under the GPL is well beyond far-fetched. By
>> the same logic, it could as well apply to the results of a
>> search-and-replace in emacs :)
>
> Not quite. Because thre is no GPL on the replace. The user writes the
> replace himself. What is being discussed is semantic patches that are
> GPL'd, not the fact that Coccinelle itself is GPL'd.

Oh, I misunderstood the issue in question then, sorry for my careless 
reading.

I hope everyone agrees that patches that merely report potential issues 
are fine. In the case that a semantic patch adds significant amounts of 
original code, it does sound that the authors of the semantic patches 
might need to grant an explicit exception. I seriously doubt that the 
output of patches like andand.cocci (or any search-and-replace-style 
transformation) is copyrightable, however :)

BTW, you might also consider asking the SFLC for pro-bono advice on this 
https://www.softwarefreedom.org/about/contact/

HTH,
Aggelos