From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:34703) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RJCBB-00030B-QE for qemu-devel@nongnu.org; Wed, 26 Oct 2011 18:42:39 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RJCB9-0005Io-IK for qemu-devel@nongnu.org; Wed, 26 Oct 2011 18:42:37 -0400 Received: from mx1.redhat.com ([209.132.183.28]:53922) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RJCB9-0005IK-9k for qemu-devel@nongnu.org; Wed, 26 Oct 2011 18:42:35 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p9QMgVhv012387 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 26 Oct 2011 18:42:32 -0400 Received: from berio (dhcp-100-2-110.bos.redhat.com [10.16.2.110]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with SMTP id p9QMgUoY028313 for ; Wed, 26 Oct 2011 18:42:30 -0400 Date: Wed, 26 Oct 2011 18:43:38 -0400 From: Richard Fontana Message-ID: <20111026224338.GB19496@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Subject: [Qemu-devel] An opinion on copyright-notice-less qemu files List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Hi qemu developers, WARNING: (1) I am not your lawyer; (2) this is not legal advice; (3) this is a long post which you will probably find extremely boring unless you happen to be a licensing geek, which I suspect is not true of most if not all of you. My colleague Paolo Bonzini was discussing with me the subject of what the qemu project should do (if anything) about files in qemu that have no copyright/license notice, in connection with the recent qemu-devel subthread on "GPLv3 troubles". In a sense the underlying issue is what the legal status of such files is. Paolo correctly identified four possibilities (I am here paraphrasing how Paolo put them): 1) Assume nothing about the file - therefore, to deal with the GPLv3 compatibility issue, ask all authors for permission to treat as GPLv2+ (GPLv2 or later). 2) Because qemu has a LICENSE file (which, importantly, I am assuming has been in place more or less from the get-go) that says "QEMU as a whole is released under the GNU General Public License", assume noticeless files are GPL+ (that is, GPLv1 or later) unless evidence suggests that the file is GPLv2-only (e.g. if it is from a default-GPLv2-only project like the Linux kernel). 3) Because of the LICENSE file and the fact that qemu includes the GPLv2 text in its COPYING file (which, importantly, I am assuming has been the case more or less from the get-go), assume noticeless files are GPLv2+ unless evidence suggests that they are GPLv2-only. 4) Because, despite what the LICENSE file says, qemu today contains a number of files that "GPLv2 only" (either explicitly, or else where noticeless code is already known to be taken from a GPLv2-only project), with this appearing to represent conscious developer preference in at least some cases, and because therefore qemu has been in general a globally "GPLv2 only" project for some time, assume noticeless files are GPLv2 only, and therefore you should ask all authors of noticeless files for permission to treat as GPLv2+. I told Paolo that I thought possibility 3 was the best interpretation of the situation. At his request, I am posting my rationale here. We must reject possibility 1. That is to say, we cannot take the view that *nothing* can be assumed about a noticeless file in qemu. To argue otherwise would imply that one cannot safely assume anything about a contribution to a free software project -- particularly one with longstanding public information on its licensing -- that happens not to contain a copyright or license notice, which for better or worse happens to be the typical practice. This would have unthinkable and absurd results, contrary to the expectations of developers, distributors and users everywhere, and therefore cannot possibly be correct. I suppose there is a weaker version of possibility 1, that noticeless files are implicitly licensed under *some* terms, but we can't possibly know what those are. I think however that any range of possible interpretations of what such an implied license would be that differs from what's captured by the other three possibilities are equivalent to the stronger assumption that nothing can be known or reasonably assumed about the legal status of the file (unless you want to argue that the implied license is something more permissive than the GPL, which I will not argue and which is not necessary to address). So, possibility 1 is wrong. Possibilities 2, 3 and 4 are all correct inasmuch as they reject the assumption underlying possibility 1, and stand for the proposition that a noticeless contribution to a globally-GPL-licensed project is, by default, GPL-licensed by implication. I think it cannot seriously be disputed that there are an enormous number of free software projects that use the GPL yet which include at least some noticeless source files, and that for such projects the prevailing understanding relied upon by developers, distributors and users alike is that the global GPL license applies to the noticeless file by implication. Indeed, I am not even sure if "by implication" is justifiable where, as with qemu, there is known global licensing information. So which of possibilities 2, 3 and 4 represents the best interpretation? Possibilities 2 and 3 are similar, being based on the notion that the authors of a noticeless file specifically contributed to qemu must have intended what was contributed to be licensed under the default license of the project stated explicitly in the LICENSE file -- the GPL. Under possibility 2, the argument is that we can't assume anything about the version of the GPL because the LICENSE file statement doesn't specify a version, and each version of the GPL has had a provision saying, in essence, that if a version number is not specified, the user can treat the code as being under any published version of the license. Thus, the implied license under possibility 2 is "noticeless files can be treated as being under any version of the GPL". Under possibility 3, the argument (as Paolo expressed it to me, though I am paraphrasing) is that the implied license is that a noticeless file can be treated as being GPLv2 or later, as the inclusion of the GPLv2 text in COPYING suggests an intent to have GPLv2 be the earliest possible version of the GPL one can legitimately assume a noticeless file to be under, despite the more general language in the LICENSE file statement. Note that the difference between possibilities 2 and 3 is very unimportant because (for the most part) GPLv1 is extinct. Nevertheless, I think possibility 3 is the better interpretation, not just because of the inclusion of the GPLv2 text, and not just because qemu postdates the creation of GPLv2, but also because the earliest license notices I see in source files from Fabrice Bellard state "GPLv2 or later". I think his intent was for qemu to be a GPLv2-or-later project, and I think it is reasonable to assume that all subsequent noticeless contributions inherited this choice by implication and are similarly licensed by default. I also think this is suggested by common sense (given the moribundity of GPLv1 during the entire time period that is relevant here) -- but the correctness of possibility 3 over possibility 2 is really only of theoretical interest. This brings us to possibility 4, which is tempting but must be rejected. Possibility 4 suggests that qemu started out being "GPLv2 or later" but *became* "GPLv2 only" the moment the first copyrightable piece of "GPLv2 only" code was included. While I will agree with that, if the argument is that *explicit* "GPLv2 only" files cause noticeless files to be GPLv2-only by default, it implies that prior to the point at which the first *explicit* GPLv2-only code made its way into qemu, any noticeless files (assuming there were any) were "GPLv2 or later" (or maybe GPLv1 or later). The argument would have to be that the first developer to use a "GPLv2 only" notice changed the default implied licensing policy for noticeless files. In other words, the assumption here is that possibilities 2 or 3 were once correct, but stopped being correct at some date. This might be a reasonable interpretation in some circumstances but I don't think it's reasonable for qemu. Unlike the Linux kernel project, qemu retained a global LICENSE file that refused to specify a particular version of the GPL as a default license. Qemu developers presumably made no effort to revise or clarify the contents of that file in a way that would change the appearance of such a policy. Moreover, it is my understanding that *after* the point in time at which the first qemu developer placed the first explicitly "GPLv2 only" code into the project, some other developers continued to use explicit "GPLv2 or later" notices for subsequently-contributed code. Thus, if that is right, there was no universal perception that qemu had been magically transformed into a "default GPLv2 only" project in some maximal sense, affecting the legal status of noticeless files, *merely* because a subset of developers began to use "GPLv2 only" notices for *their* code, even though it is true that the inclusion of explicit "GPLv2 only" code prevented qemu from being globally "GPLv2 or later". While the "GPLv2 only" developers may have affected the license of qemu as a whole, they had no legitimate authority to affect the implied license under which qemu users could reasonably assume applied to individual portions of code contributed by *other* qemu developers who chose not to include *any* license notice. Had they had some intention of doing so, they can only blame themselves for failing to revise the LICENSE file (written, I believe, by someone who had used "GPLv2 or later" notices on *his* code) or to otherwise make clear to the world that qemu had changed from being "v2 or later" (or "GPL+") to "GPLv2 only" (however, I suspect they never thought about that issue). I therefore reject possibility 4. In conclusion, for the foregoing reasons, I believe possibility 3 is correct. Noticeless files in qemu should be assumed to be implicitly licensed by their authors under "GPLv2 or later" unless there is extrinsic evidence to suggest some other licensing policy was intended by their authors. Richard Fontana Open Source Licensing and Patent Counsel Red Hat, Inc.