Added new version of seminar materials.
This commit is contained in:
John Sullivan
Bradley M. Kuhn
parent
21dcc7b2d8
commit
c911d4f085
1 changed files with 359 additions and 289 deletions
|
|
@ -1,19 +1,17 @@
|
|||
% case-study-ethics.tex -*- LaTeX -*-
|
||||
|
||||
% Tutorial Text for GPL Compliance Case Studies
|
||||
% and Legal Ethics in Free Software Licensing
|
||||
% Tutorial Text for the Detailed Study and Analysis of GPL and LGPL course
|
||||
%
|
||||
% Copyright (C) 2004 Free Software Foundation, Inc.
|
||||
% Copyright (C) 2003, 2004 Free Software Foundation, Inc.
|
||||
|
||||
% Verbatim copying and distribution of this entire document is permitted in
|
||||
% any medium, provided this notice is preserved.
|
||||
|
||||
\documentclass[12pt]{report}
|
||||
\documentclass[11pt]{book}
|
||||
% FILTER_PS: \input{generate-ps-file}
|
||||
% FILTER_PDF: \input{generate-pdf-file}
|
||||
% FILTER_HTML: \input{generate-html-file}
|
||||
\input{one-inch-margins}
|
||||
|
||||
% NOT FOUND \input{one-inch-margins}
|
||||
\usepackage{enumerate}
|
||||
\usepackage[dvips]{graphicx}
|
||||
%\setlength\parskip{0.7em}
|
||||
%\setlength\parindent{0pt}
|
||||
|
||||
|
|
@ -23,28 +21,35 @@
|
|||
|
||||
\begin{document}
|
||||
|
||||
\begin{titlepage}
|
||||
\frontmatter
|
||||
|
||||
\begin{titlepage}
|
||||
|
||||
\begin{center}
|
||||
|
||||
\vspace{.5in}
|
||||
%\vspace{.5in}
|
||||
\vfill
|
||||
|
||||
{\Large {\sc GPL Compliance Case Studies} \\
|
||||
\includegraphics{fsf-logo.eps}
|
||||
|
||||
\vspace{.7in}
|
||||
\vfill
|
||||
|
||||
Sponsored by the Free Software Foundation \\
|
||||
{\Large
|
||||
{\sc GPL Compliance Case Studies} \\
|
||||
|
||||
\vfill
|
||||
|
||||
\vspace{.3in}
|
||||
%\vspace{.7in}
|
||||
|
||||
Columbia Law School, New York, NY, USA \\
|
||||
% \vspace{.3in}
|
||||
|
||||
Stanford University, Stanford, CA, USA \\
|
||||
\vspace{.1in}
|
||||
Wednesday 21 January 2004
|
||||
Wednesday, 25 August 2004
|
||||
}
|
||||
|
||||
\vspace{.7in}
|
||||
% \vspace{.7in}
|
||||
\vfill
|
||||
|
||||
{\large
|
||||
Bradley M. Kuhn
|
||||
|
|
@ -63,6 +68,11 @@ Daniel Ravicher
|
|||
Senior Counsel
|
||||
|
||||
Free Software Foundation
|
||||
|
||||
President and Executive Director
|
||||
|
||||
Public Patent Foundation
|
||||
|
||||
}
|
||||
|
||||
\end{center}
|
||||
|
|
@ -70,7 +80,7 @@ Free Software Foundation
|
|||
\vfill
|
||||
|
||||
{\parindent 0in
|
||||
Copyright \copyright{} 2004 \hspace{.2in} Free Software Foundation, Inc.
|
||||
Copyright \copyright{} 2003, 2004 \hspace{.2in} Free Software Foundation, Inc.
|
||||
|
||||
\vspace{.3in}
|
||||
|
||||
|
|
@ -81,43 +91,99 @@ any medium, provided this notice is preserved.
|
|||
\end{titlepage}
|
||||
|
||||
\pagestyle{plain}
|
||||
|
||||
\pagenumbering{roman}
|
||||
|
||||
\begin{abstract}
|
||||
\chapter*{GPL Compliance Case Studies}
|
||||
|
||||
This one-day course presents the details of five different GPL compliance
|
||||
cases handled by FSF's GPL Compliance Laboratory. Each case offers unique
|
||||
insights into problems that can arise when the terms of GPL are not
|
||||
properly followed, and how diplomatic negotiation between the violator and
|
||||
the copyright holder can yield positive results for both parties.
|
||||
\textit{Stanford University, Stanford, CA 25 August 2004}
|
||||
|
||||
\begin{tabular}[t]{ll}
|
||||
09:00 - 09:25 & Registration / Check-in / Continental Breakfast\\
|
||||
&\\
|
||||
09:25 - 09:30 & Welcome\\
|
||||
&\\
|
||||
09:30 - 09:45 & Overview of FSF's GPL Compliance Lab\\
|
||||
&\textit{Bradley M. Kuhn}\\
|
||||
&\\
|
||||
09:45 - 10:40 & GPL Violation Case Study A\\
|
||||
&\textit{Bradley M. Kuhn}\\
|
||||
&\\
|
||||
10:40 - 11:00 & GPL Violation Case Study B\\
|
||||
&\textit{Bradley M. Kuhn}\\
|
||||
&\\
|
||||
11:00 - 11:10 & Q \& A\\
|
||||
&\\
|
||||
11:10 - 11:20 & Break\\
|
||||
&\\
|
||||
11:20 - 11:50 & GPL Violation Case Study C\\
|
||||
&\textit{Bradley M. Kuhn}\\
|
||||
&\\
|
||||
11:50 - 12:10 & GPL Violation Case Study D\\
|
||||
&\textit{Bradley M. Kuhn}\\
|
||||
&\\
|
||||
12:10 - 12:20 & Good Practices for GPL Compliance\\
|
||||
&\textit{Bradley M. Kuhn}\\
|
||||
&\\
|
||||
\end{tabular}
|
||||
|
||||
\begin{tabular}[t]{ll}
|
||||
12:20 - 12:30 & Q \& A\\
|
||||
&\\
|
||||
12:30 - 14:00 & Lunch and Lecture ``GPL 3: Prospects and Process''\\
|
||||
& \textit{Prof. Eben Moglen}\\
|
||||
&\\
|
||||
|
||||
14:00 - 15:40 & Ethical Considerations and Legal Practices\\
|
||||
&\textit{Daniel Ravicher}\\
|
||||
&\\
|
||||
15:40 - 15:50 & Q \& A\\
|
||||
&\\
|
||||
15:50 - 16:00 & Break\\
|
||||
&\\
|
||||
16:00 - 17:30 & Current Issues in Free Software\\
|
||||
& \textit{Prof. Eben Moglen}\\
|
||||
&\\
|
||||
17:30 - 18:00 & Q \& A\\
|
||||
\end{tabular}
|
||||
|
||||
\pagebreak
|
||||
|
||||
% =====================================================================
|
||||
% START OF SECOND DAY SEMINAR SECTION
|
||||
% =====================================================================
|
||||
|
||||
\chapter*{Preface}
|
||||
|
||||
This one-day course presents the details of five different GPL
|
||||
compliance cases handled by FSF's GPL Compliance Laboratory. Each case
|
||||
offers unique insights into problems that can arise when the terms of
|
||||
GPL are not properly followed, and how diplomatic negotiation between
|
||||
the violator and the copyright holder can yield positive results for
|
||||
both parties.
|
||||
|
||||
Attendees should have successfully completely the course, a ``Detailed
|
||||
Study and Analysis of GPL and LGPL'', as the material from that course
|
||||
forms the building blocks for this material.
|
||||
Study and Analysis of the GPL and LGPL,'' as the material from that
|
||||
course forms the building blocks for this material.
|
||||
|
||||
The course is of most interest to lawyers who have clients or employers
|
||||
that deal with Free Software on a regular basis. However, technical
|
||||
managers and executives whose businesses use or distribute Free Software
|
||||
will also find the course very helpful.
|
||||
This course is of most interest to lawyers who have clients or
|
||||
employers that deal with Free Software on a regular basis. However,
|
||||
technical managers and executives whose businesses use or distribute
|
||||
Free Software will also find the course very helpful.
|
||||
|
||||
\bigskip
|
||||
|
||||
These course materials are merely a summary of the highlights of the
|
||||
course presented. Readers of this material should assume that they have
|
||||
missed the bulk of the material, as the detailed discussion of these case
|
||||
studies is the most illuminating part about them. Merely reading this
|
||||
material is akin to matriculating into a college course and read only the
|
||||
textbook instead of going to class.
|
||||
|
||||
\end{abstract}
|
||||
course presented. Please be aware that during the actual GPL course, class
|
||||
discussion supplements this printed curriculum. Simply reading it is
|
||||
not equivalent to attending the course.
|
||||
|
||||
\tableofcontents
|
||||
|
||||
\pagebreak
|
||||
\mainmatter
|
||||
|
||||
\pagenumbering{arabic}
|
||||
|
||||
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
||||
\chapter{Overview of FSF's GPL Compliance Lab}
|
||||
|
||||
The GPL is a Free Software license with legal teeth. Unlike licenses like
|
||||
|
|
@ -142,32 +208,33 @@ clause is where the legal teeth of the license are rooted. As a copyright
|
|||
license, GPL governs only the activities governed by copyright law ---
|
||||
copying, modifying and redistributing computer software. Unlike most
|
||||
copyright licenses, GPL gives wide grants of permission for engaging with
|
||||
these activities. Such permissions continue and all parties may exercise
|
||||
these activities. Such permissions continue, and all parties may exercise
|
||||
them until such time as one party violates the terms of GPL\@. At the
|
||||
moment of such a violation (i.e., the engaging of copying, modifying or
|
||||
redistributing in ways not permitted by GPL) \S 4 is invoked. While other
|
||||
parties may continue to operate under GPL, the violating party loses their
|
||||
rights.
|
||||
|
||||
Specifically, \S 4 terminates the violators' rights to continue engaging
|
||||
in the permissions that otherwise granted by GPL\@. Effectively, their
|
||||
permissions go back to the copyright defaults --- no permission is granted
|
||||
to copy, modify, nor redistribute the work. Meanwhile, \S 5 points out
|
||||
that if if the violator has no rights under GPL --- as they will not once
|
||||
they have violated it --- then they otherwise have no rights and are
|
||||
prohibited by copyright law from engaging in the activities of copying,
|
||||
modifying and distributing.
|
||||
Specifically, \S 4 terminates the violators' rights to continue
|
||||
engaging in the permissions that are otherwise granted by GPL\@.
|
||||
Effectively, their rights revert to the copyright defaults ---
|
||||
no permission is granted to copy, modify, nor redistribute the work.
|
||||
Meanwhile, \S 5 points out that if the violator has no rights under
|
||||
GPL, they are prohibited by copyright law from engaging in the
|
||||
activities of copying, modifying and distributing. They have lost
|
||||
these rights because they have violated the GPL, and no other license
|
||||
gives them permission to engage in these activities governed by copyright law.
|
||||
|
||||
\section{Ongoing Violations}
|
||||
|
||||
In conjunction with \S 4's termination of violators' rights, there is one
|
||||
final industry fact added to the mix: rarely, does one engage in a single,
|
||||
solitary act of copying, distributing or modifying software. Almost
|
||||
always, a violator will have legitimately acquired a copy a GPL'd program,
|
||||
either making modifications or not, and then began a ongoing activity of
|
||||
In conjunction with \S 4's termination of violators' rights, there is
|
||||
one final industry fact added to the mix: rarely, does one engage in a
|
||||
single, solitary act of copying, distributing or modifying software.
|
||||
Almost always, a violator will have legitimately acquired a copy of a
|
||||
GPL'd program, either making modifications or not, and then begun
|
||||
distributing that work. For example, the violator may have put the
|
||||
software in boxes and sold them at stores. Or perhaps the software was
|
||||
put up for download on the Internet. Regardless of the delivery
|
||||
software in boxes and sold them at stores. Or perhaps the software
|
||||
was put up for download on the Internet. Regardless of the delivery
|
||||
mechanism, violators almost always are engaged in {\em ongoing\/}
|
||||
violation of GPL\@.
|
||||
|
||||
|
|
@ -175,14 +242,14 @@ In fact, when we discover a GPL violation that occurred only once --- for
|
|||
example, a user group who distributed copies of a GNU/Linux system without
|
||||
source at one meeting --- we rarely pursue it with a high degree of
|
||||
tenacity. In our minds, such a violation is an educational problem, and
|
||||
unless the user group becomes a repeat offender (as it turns out, the
|
||||
never do) we simply forward along an FAQ entry that best explains how user
|
||||
groups can most easily comply with GPL, and send them on there merry way.
|
||||
unless the user group becomes a repeat offender (as it turns out, they
|
||||
never do), we simply forward along a FAQ entry that best explains how user
|
||||
groups can most easily comply with GPL, and send them on their merry way.
|
||||
|
||||
It is only the cases of {\em ongoing\/} GPL violation that warrant our
|
||||
active attention. We vehemently pursue those cases where dozens, hundreds
|
||||
or thousands of customers are receiving software that is out of
|
||||
compliance, and where the company continually puts for sale (or
|
||||
compliance, and where the company continually offers for sale (or
|
||||
distributes gratis as a demo) software distributions that include GPL'd
|
||||
components out of compliance. Our goal is to maximize the impact of
|
||||
enforcement and educate industries who are making such a mistake on a
|
||||
|
|
@ -191,12 +258,12 @@ large scale.
|
|||
In addition, such ongoing violation shows that a particular company is
|
||||
committed to a GPL'd product line. We are thrilled to learn that someone
|
||||
is benefiting from Free Software, and we understand that sometimes they
|
||||
have become confused about the rules of the road. Rather than merely
|
||||
become confused about the rules of the road. Rather than merely
|
||||
giving us a post mortem to perform on a past mistake, an ongoing violation
|
||||
gives us an active opportunity to educate a new contributor the GPL'd
|
||||
gives us an active opportunity to educate a new contributor to the GPL'd
|
||||
commons about proper procedures to contribute to the community.
|
||||
|
||||
Our central goal is not, in fact, to merely clear up particular violation.
|
||||
Our central goal is not, in fact, to merely clear up a particular violation.
|
||||
In fact, over time, we hope that our compliance lab will be out of
|
||||
business. We seek to educate the businesses that engage in commerce
|
||||
related to GPL'd software to obey the rules of the road and allow them to
|
||||
|
|
@ -210,7 +277,7 @@ matter, allowing that company to join the GPL ecosystem as a contributor.
|
|||
|
||||
Our enforcement of GPL is not a fund-raising effort; in fact, FSF's GPL
|
||||
Compliance Lab runs at a loss (in other words, it is subsided by our
|
||||
donors). Our violation reports come from volunteers, who have encountered
|
||||
donors). Our violation reports come from volunteers, who have encountered,
|
||||
in their business or personal life, a device or software product that
|
||||
appears to contain GPL'd software. These reports are almost always sent
|
||||
via email to $<$license-violation@fsf.org$>$.
|
||||
|
|
@ -218,7 +285,7 @@ via email to $<$license-violation@fsf.org$>$.
|
|||
Our first order of business, upon receiving such a report, is to seek
|
||||
independent confirmation. When possible, we get a copy of the software
|
||||
product. For example, if it is an offering that is downloadable from a
|
||||
website, we download it and investigate ourselves. When it is not
|
||||
Web site, we download it and investigate ourselves. When it is not
|
||||
possible for us to actually get a copy of the software, we ask the
|
||||
reporter to go through the same process we would use in examining the
|
||||
software.
|
||||
|
|
@ -240,7 +307,7 @@ Once we have confirmed that a violation has indeed occurred, we must then
|
|||
determine whose copyright has been violated. Contrary to popular belief,
|
||||
FSF does not have the power to enforce GPL in all cases. Since GPL
|
||||
operates under copyright law, the powers of enforcement --- to seek
|
||||
redress once \S 4 has been invoked --- lies with the copyright holder of
|
||||
redress once \S 4 has been invoked --- lie with the copyright holder of
|
||||
the software. FSF is one of the largest copyright holders in the world of
|
||||
GPL'd software, but we are by no means the only one. Thus, we sometimes
|
||||
discover that while GPL'd code is present in the software, there is no
|
||||
|
|
@ -249,7 +316,7 @@ software copyrighted by FSF present.
|
|||
In cases where FSF does not hold copyright interest in the software, but
|
||||
we have confirmed a violation, we contact the copyright holders of the
|
||||
software, and encourage them to enforce GPL\@. We offer our good offices
|
||||
to help negotiate compliance on their behalf, and many times we help as a
|
||||
to help negotiate compliance on their behalf, and many times, we help as a
|
||||
third party to settle such GPL violations. However, what we will describe
|
||||
primarily in this course is FSF's first-hand experience enforcing its own
|
||||
copyrights and GPL\@.
|
||||
|
|
@ -262,8 +329,7 @@ works best when you assume the best of others, and only change policy,
|
|||
procedures and attitudes when some specific event or occurrence indicates
|
||||
that a change is necessary. We treat the process of GPL enforcement in
|
||||
the same way. Our goal is to encourage violators to join the cooperative
|
||||
community of software sharing, so we want to open our hand in friendship
|
||||
to them.
|
||||
community of software sharing, so we want to open our hand in friendship.
|
||||
|
||||
Therefore, once we have confirmed a violation, our first assumption is
|
||||
that the violation is an oversight or otherwise a mistake due to confusion
|
||||
|
|
@ -277,9 +343,9 @@ compliance work.
|
|||
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
||||
\chapter{Davrik: Modified GCC SDK}
|
||||
|
||||
In our first case study, we will consider Davrik, a company that produces
|
||||
software and hardware toolkits to assist OEM vendors who products consumer
|
||||
electronic devices.
|
||||
In our first case study, we will consider Davrik, a company that
|
||||
produces software and hardware toolkits to assist OEM vendors, makers
|
||||
of consumer electronic devices.
|
||||
|
||||
\section{Facts}
|
||||
|
||||
|
|
@ -300,7 +366,7 @@ more evidence was discovered.
|
|||
|
||||
FSF was later able to confirm the violation when two additional reports
|
||||
surfaced from other violation reporters, both of whom had used the SDK
|
||||
professional and noticed clear similarities to FSF's GNU GCC\@. FSF's
|
||||
professionally and noticed clear similarities to FSF's GNU GCC\@. FSF's
|
||||
Compliance Engineer asked the reporters to run standard tests to confirm
|
||||
the violation, and it was confirmed that Davrik's SDK was indeed a
|
||||
derivative work of GCC\@. Davrik had ported to Windows and added a number
|
||||
|
|
@ -313,13 +379,13 @@ to request that source (if \S 3(b) was exercised). The violators
|
|||
confirmed that such requests were not answered.
|
||||
|
||||
FSF brought the matter to the attention of Davrik, who immediately
|
||||
escalated the matter to their attorneys. After a long negotiation, Davrik
|
||||
acknowledged that their SDK was indeed a derivative work of GCC\@. Davrik
|
||||
released most of the source, but some disagreement occurred over whether
|
||||
LP was a derivate work of GCC\@. After repeated FSF inquiries, Davrik
|
||||
reaudited the source and discovered that FSF's analysis was correct and
|
||||
determined that LP included a number of source files copied from the GCC
|
||||
code-base.
|
||||
escalated the matter to their attorneys. After a long negotiation,
|
||||
Davrik acknowledged that their SDK was indeed a derivative work of
|
||||
GCC\@. Davrik released most of the source, but some disagreement
|
||||
occurred over whether LP was a derivate work of GCC\@. After repeated
|
||||
FSF inquiries, Davrik reaudited the source to discover that FSF's
|
||||
analysis was correct. Davrik determined that LP included a number of
|
||||
source files copied from the GCC code-base.
|
||||
|
||||
\label{davrik-build-problems}
|
||||
Once the full software release was made available, FSF asked the violation
|
||||
|
|
@ -329,22 +395,21 @@ instructions with the software, and such build instructions were
|
|||
incorporated into the next software release.
|
||||
|
||||
At FSF's request as well, Davrik informed customers who had previously
|
||||
purchased the product that the source was now available, by announcing
|
||||
the available on its website and via a customer newsletter.
|
||||
purchased the product that the source was now available by announcing
|
||||
the availablity on its Web site and via a customer newsletter.
|
||||
|
||||
Davrik did have some concerns regarding patents. They wished to include a
|
||||
statement with the software release that made sure they were not granting
|
||||
any patent permission other than what was absolutely required by GPL\@.
|
||||
They understood that their patent assertions could not trump any rights
|
||||
granted by GPL\@. The following language was negotiated to be included
|
||||
with the release:
|
||||
granted by GPL\@. The following language was negotiated into the release:
|
||||
|
||||
\begin{quotation}
|
||||
Subject to the qualifications stated below, Davrik, on behalf of itself
|
||||
and its Subsidiaries, agrees not to assert the Claims against you for your
|
||||
making, use, offer for sale, sale, or importation of the Davrik's GNU
|
||||
Utilities or derivative works of the Davrik's GNU Utilities
|
||||
("Derivatives"), but only to the extent that any such Derivatives are
|
||||
(``Derivatives''), but only to the extent that any such Derivatives are
|
||||
licensed by you under the terms of the GNU General Public License. The
|
||||
Claims are the claims of patents that Davrik or its Subsidiaries have
|
||||
standing to enforce that are directly infringed by the making, use, or
|
||||
|
|
@ -357,19 +422,19 @@ patent as a Claim. Subsidiaries are entities that are wholly owned by
|
|||
Davrik.
|
||||
|
||||
This statement does not negate, limit or restrict any rights you already
|
||||
have under the GNU General Public License, Version 2.
|
||||
have under the GNU General Public License version 2.
|
||||
\end{quotation}
|
||||
|
||||
This quelled Davrik's concerns about other patent licensing they sought to
|
||||
do outside of the GPL'd software, and satisfied FSF's concerns that they
|
||||
do outside of the GPL'd software, and satisfied FSF's concerns that Davrik
|
||||
give proper permissions to exercise teachings of patents that were
|
||||
exercised in their GPL'd software release.
|
||||
|
||||
Finally, a GPL Compliance Officer inside Davrik was appointed who is
|
||||
responsible for all matters of GPL compliance inside the company. Darvik
|
||||
is responsible for informing FSF if the position is given to someone else
|
||||
inside the company, and making sure that FSF has direct contact
|
||||
information with Darvik's Compliance Officer.
|
||||
Finally, a GPL Compliance Officer inside Davrik was appointed to take
|
||||
responsibility for all matters of GPL compliance inside the company.
|
||||
Darvik is responsible for informing FSF if the position is given to
|
||||
someone else inside the company, and making sure that FSF has direct
|
||||
contact with Darvik's Compliance Officer.
|
||||
|
||||
\section{Lessons}
|
||||
|
||||
|
|
@ -404,7 +469,7 @@ This case introduces a number of concepts regarding GPL enforcement.
|
|||
\item {\bf Confirming compliance is a community effort.} The whole point
|
||||
of making sure that software distributors respect the terms of GPL is to
|
||||
allow a thriving software sharing community to benefit and improve the
|
||||
work. FSF are not the experts on how a compiler for consumer electronic
|
||||
work. FSF is not the expert on how a compiler for consumer electronic
|
||||
devices should work. We therefore inform the community who originally
|
||||
brought the violation to our attention and ask them to assist in
|
||||
evaluation and confirmation of the product's compliance. Of course, FSF
|
||||
|
|
@ -415,11 +480,11 @@ This case introduces a number of concepts regarding GPL enforcement.
|
|||
|
||||
\item {\bf Informing the harmed community is part of compliance.} FSF asks
|
||||
violators to make some attempt --- such as via newsletters and the
|
||||
company's website --- to inform those who already have the products as
|
||||
company's Web site --- to inform those who already have the products as
|
||||
to their rights under GPL\@. One of the key thrusts of GPL's \S 1 and
|
||||
\S 3 is to {\em make sure the user knows she has these rights\/}. If a
|
||||
product was received out of compliance by a customer, she may never
|
||||
actually discover that she had such rights. Informing customers, in a
|
||||
actually discover that she has such rights. Informing customers, in a
|
||||
way that is not burdensome but has a high probability of successfully
|
||||
reaching those who would seek to exercise their freedoms, is essential
|
||||
to properly remedy the mistake.
|
||||
|
|
@ -427,9 +492,9 @@ This case introduces a number of concepts regarding GPL enforcement.
|
|||
\item {\bf Lines between various copyright, patent, and other legal
|
||||
mechanisms must be precisely defined and considered.} The most
|
||||
difficult negotiation point of the Davrik case was drafting language
|
||||
that simultaneously protected the Davrik's patent rights outside of the
|
||||
that simultaneously protected Davrik's patent rights outside of the
|
||||
GPL'd source, but was consistent with the implicit patent grant in
|
||||
GPL\@. As we discussed in the first course in this series, there is
|
||||
GPL\@. As we discussed in the first course of this series, there is
|
||||
indeed an implicit patent grant with GPL, thanks to \S 6 and \S 7.
|
||||
However, many companies become nervous and wish to make the grant
|
||||
explicit to assure themselves that the grant is sufficiently narrow for
|
||||
|
|
@ -445,62 +510,62 @@ This case introduces a number of concepts regarding GPL enforcement.
|
|||
\chapter{Bracken: a Minor Violation in a GNU/Linux Distribution}
|
||||
|
||||
In this case study, we consider a minor violation made by a company whose
|
||||
knowledge of the Free Software community and it functions is deep.
|
||||
knowledge of the Free Software community and its functions is deep.
|
||||
|
||||
\section{The Facts}
|
||||
|
||||
Bracken produces a GNU/Linux operating system product that is sold
|
||||
primarily to OEM vendors to be placed in appliance devices that are used
|
||||
for a single purpose, such as an Internet-browsing-only device. The
|
||||
product is almost 100\% Free Software, mostly licensed under GPL and
|
||||
related Free Software licenses.
|
||||
primarily to OEM vendors to be placed in appliance devices used for a
|
||||
single purpose, such as an Internet-browsing-only device. The product
|
||||
is almost 100\% Free Software, mostly licensed under GPL and related
|
||||
Free Software licenses.
|
||||
|
||||
FSF found out about this violation through a report first posted in a
|
||||
comment on a Slashdot\footnote{Slashdot is a popular news and discussion
|
||||
site for technical readers.} comment, and then was brought to attention
|
||||
again by another Free Software copyright holder who had discovered the
|
||||
FSF found out about this violation through a report first posted on a
|
||||
Slashdot\footnote{Slashdot is a popular news and discussion site for
|
||||
technical readers.} comment, and then it was brought to our attention again
|
||||
by another Free Software copyright holder who had discovered the
|
||||
same violation.
|
||||
|
||||
Bracken's GNU/Linux product is delivered directly from their website.
|
||||
This allowed FSF engineers to directly download and confirm the violation
|
||||
quickly. It was discovered that there were two primary problems with the
|
||||
Bracken's GNU/Linux product is delivered directly from their Web site.
|
||||
This allowed FSF engineers to directly download and confirm the
|
||||
violation quickly. Two primary problems were discovered with the
|
||||
online distribution:
|
||||
|
||||
\begin{itemize}
|
||||
|
||||
\item No source code nor offer for source code was provided for a number
|
||||
of components for the distributed GNU/Linux system; only binaries were
|
||||
available.
|
||||
available
|
||||
|
||||
\item An End User License Agreement (``EULA'') was included that
|
||||
contradicted the permissions granted by GPL\@.
|
||||
contradicted the permissions granted by GPL\@
|
||||
|
||||
\end{itemize}
|
||||
|
||||
FSF contacted Bracken and gave them the details of the violation. Bracken
|
||||
immediately ceased distribution of the product temporarily, and set forth
|
||||
immediately ceased distribution of the product temporarily and set forth
|
||||
a plan to bring themselves back into compliance. This plan included the
|
||||
following steps:
|
||||
|
||||
\begin{itemize}
|
||||
|
||||
\item Bracken attorneys would rewrite the EULA to comply with GPL, and
|
||||
would vet the new EULA through FSF before use.
|
||||
\item Bracken attorneys would rewrite the EULA to comply with GPL and
|
||||
would vet the new EULA through FSF before use
|
||||
|
||||
\item Bracken engineers would provide source side-by-side with the
|
||||
binaries for the GNU/Linux distribution on the site (and on CD's, if
|
||||
ever they distributed that way).
|
||||
ever they distributed that way)
|
||||
|
||||
\item Bracken attorneys would run an internal seminar for its engineers
|
||||
regarding proper GPL compliance, to help ensure that such oversights
|
||||
regarding source releases would not occur in the future.
|
||||
regarding proper GPL compliance to help ensure that such oversights
|
||||
regarding source releases would not occur in the future
|
||||
|
||||
\item Bracken would resume distribution of the product only after FSF
|
||||
formally restored Bracken's distribution rights.
|
||||
formally restored Bracken's distribution rights
|
||||
\end{itemize}
|
||||
|
||||
This case was completed in the matter of about a month. FSF approved the
|
||||
new EULA text. They key portion in the EULA relating to GPL read as
|
||||
follows:
|
||||
This case was completed in about a month. FSF approved the new EULA
|
||||
text. The key portion in the EULA relating to GPL read as follows:
|
||||
|
||||
\begin{quotation}
|
||||
Many of the Software Programs included in Bracken Software are distributed
|
||||
|
|
@ -547,16 +612,16 @@ role in GPL compliance.
|
|||
product into compliance.
|
||||
|
||||
\item {\bf When people in key positions understand the Free Software
|
||||
nature of their software products, compliance concerns are as mundane as
|
||||
minor software bugs.} Even the most functional system or structure has
|
||||
its problems, and successful business often depends on agile response to
|
||||
the problems that do come up; avoiding problems altogether is a pipe
|
||||
dream. Minor GPL violations can and do happen even with well-informed
|
||||
redistributors. However, when the company --- and in particular, the
|
||||
lawyers, managers, and engineers working on the Free Software product
|
||||
lines --- have adapted to the cooperative Free Software culture,
|
||||
resolving such problems is merely a mundane detail of typical operation
|
||||
and resolution is reached quickly.
|
||||
nature of their software products, compliance concerns are as
|
||||
mundane as minor software bugs.} Even the most functional system or
|
||||
structure has its problems, and successful business often depends on
|
||||
agile response to the problems that do come up; avoiding problems
|
||||
altogether is a pipe dream. Minor GPL violations can and do happen
|
||||
even with well-informed redistributors. However, resolution is
|
||||
reached quickly when the company --- and in particular, the lawyers,
|
||||
managers, and engineers working on the Free Software product lines
|
||||
--- have adapted to Free Software culture that the lower-level
|
||||
engineer already understood
|
||||
|
||||
\item {\bf Legally, distribution must stop when a violation is
|
||||
identified.} In our opinion, Bracken went above and beyond the call of
|
||||
|
|
@ -569,26 +634,26 @@ role in GPL compliance.
|
|||
negotiating in bad faith) does FSF even threaten an injunction on
|
||||
copyright grounds. However, Bracken --- as a good Free Software citizen
|
||||
--- chose to be on the safe side and do the legally correct thing while
|
||||
the violation case was pending. Since from start to finish it took less
|
||||
than am month to resolve, this lapse in distribution did not, to FSF's
|
||||
the violation case was pending. From start to finish, it took less
|
||||
than a month to resolve. This lapse in distribution did not, to FSF's
|
||||
knowledge, impact Bracken's business in any way.
|
||||
|
||||
\item {\bf EULAs are a common area for GPL problems.} Often, EULAs are
|
||||
drafted from boilerplate text that a company uses for all its products.
|
||||
Even the most diligent attorneys forget or simply do not know that a
|
||||
product contains software licensed under GPL and other Free Software
|
||||
licenses. Drafting a EULA that accounts for such licenses is
|
||||
straightforward; the text quoted above works just fine. The EULA must
|
||||
be designed so that it does not trump and rights and permissions already
|
||||
granted by GPL\@, and it clearly state that if there is a conflict
|
||||
between the EULA and GPL, with regard to GPL'd code, that the GPL is the
|
||||
overriding license.
|
||||
\item {\bf EULAs are a common area for GPL problems.} Often, EULAs
|
||||
are drafted from boilerplate text that a company uses for all its
|
||||
products. Even the most diligent attorneys forget or simply do not
|
||||
know that a product contains software licensed under GPL and other
|
||||
Free Software licenses. Drafting a EULA that accounts for such
|
||||
licenses is straightforward; the text quoted above works just fine.
|
||||
The EULA must be designed so that it does not trump rights and
|
||||
permissions already granted by GPL\@. The EULA must clearly state
|
||||
that if there is a conflict between it and GPL, with regard to GPL'd
|
||||
code, the GPL is the overriding license.
|
||||
|
||||
\item {\bf Compliance Officers are rarely necessary when companies are
|
||||
educated about GPL compliance.} As we saw in the Davrik case, FSF asks
|
||||
that a formal ``GPL Compliance Officer'' be appointed inside a
|
||||
previously violating organization to shepherd the organization to a
|
||||
cooperative approach with regard to GPL compliance. However, when FSF
|
||||
cooperative approach to GPL compliance. However, when FSF
|
||||
sees that an organization already has such an approach, there is no
|
||||
need to request that such an officer be appointed.
|
||||
|
||||
|
|
@ -603,10 +668,11 @@ and regulatory problems can impact GPL compliance matters.
|
|||
|
||||
\section{The Facts}
|
||||
|
||||
Vigorien distributes a backup solution product that allows system
|
||||
administrators to create encrypted backups of file-systems on Unix-like
|
||||
computers. The product is based on GNU tar, a backup utility that
|
||||
replaces the standard Unix utility, ``tar'', but has additional features.
|
||||
Vigorien distributes a back-up solution product that allows system
|
||||
administrators to create encrypted backups of file-systems on
|
||||
Unix-like computers. The product is based on GNU tar, a backup utility
|
||||
that replaces the standard Unix utility simply called tar, but has
|
||||
additional features.
|
||||
|
||||
Vigorien's backup solution added cryptographic features to GNU tar, and
|
||||
included a suite of utilities and graphical user interfaces surrounding
|
||||
|
|
@ -615,7 +681,7 @@ GNU tar to make backups convenient.
|
|||
FSF discovered the violation from a user report, and determined that the
|
||||
cryptographic features were the only part of the product that constituted
|
||||
a derivative work of GNU tar; the extraneous utilities merely made
|
||||
``shell'' calls out to GNU tar. FSF requested that Vigorien come into
|
||||
shell calls out to GNU tar. FSF requested that Vigorien come into
|
||||
compliance with GPL by releasing the source of GNU tar, with the
|
||||
cryptographic modifications, to its customers.
|
||||
|
||||
|
|
@ -627,7 +693,7 @@ FSF disputed the first claim, pointing out that Vigorien had only one
|
|||
option if they did not want to release the source: they would have to
|
||||
remove GNU tar from the software and not distribute it further. Vigorien
|
||||
rejected this suggestion, since GNU tar was an integral part of the
|
||||
product and the security changes were useless without GNU tar.
|
||||
product, and the security changes were useless without GNU tar.
|
||||
|
||||
Regarding the export control claims, FSF proposed a number of options,
|
||||
including release of the source from one of Vigorien's divisions overseas
|
||||
|
|
@ -645,13 +711,14 @@ did so, and the violation was resolved.
|
|||
|
||||
\begin{enumerate}
|
||||
|
||||
\item {\bf Removing the GPL'd portion of the product is always an option.}
|
||||
Many violators' first response is to simply refuse to release the source
|
||||
code as GPL requires. FSF offers the option to simply remove the GPL'd
|
||||
portions from the product and continue along without them indefinitely.
|
||||
Every case where this has been suggested has led to the same conclusion.
|
||||
Like Vigorien, the violator argues that the product cannot function
|
||||
without the GPL'd components and they cannot effectively replace them.
|
||||
\item {\bf Removing the GPL'd portion of the product is always an
|
||||
option.} Many violators' first response is to simply refuse to
|
||||
release the source code as GPL requires. FSF offers the option to
|
||||
simply remove the GPL'd portions from the product and continue along
|
||||
without them. Every case where this has been suggested has led to
|
||||
the same conclusion. Like Vigorien, the violator argues that the
|
||||
product cannot function without the GPL'd components, and they
|
||||
cannot effectively replace them.
|
||||
|
||||
Such an outcome is simply further evidence that the combined work in
|
||||
question is indeed a derivative work of the original GPL'd component.
|
||||
|
|
@ -674,14 +741,14 @@ did so, and the violation was resolved.
|
|||
in source form'' is not a valid defense for explaining why the terms of
|
||||
the GPL are ignored. If companies do not want to release source code
|
||||
for some reason, then they should not base the work on GPL'd software.
|
||||
No external argument for non-compliance can hold weight if the work as
|
||||
No external argument for noncompliance can hold weight if the work as
|
||||
whole is indeed a derivative work of a GPL'd program.
|
||||
|
||||
The ``security concerns'' argument is often floated as a reason to keep
|
||||
software proprietary, but the computer security community has on
|
||||
numerous occasions confirmed that such arguments are entirely specious.
|
||||
Security experts have found --- since the beginnings of the field of
|
||||
cryptography in the ancient word --- that sharing results about systems
|
||||
cryptography in the ancient world --- that sharing results about systems
|
||||
and having such systems withstand peer review and scrutiny builds the
|
||||
most secure systems. While full disclosure may help some who wish to
|
||||
compromise security, it helps those who want to fix problems even more
|
||||
|
|
@ -709,7 +776,7 @@ companies were involved and many complex issues arose.
|
|||
|
||||
Haxil produced a consumer electronics device which included a mini
|
||||
GNU/Linux distribution to control the device. The device was of interest
|
||||
to many technically minded consumers, who purchased the device and very
|
||||
to many technically-minded consumers, who purchased the device and very
|
||||
quickly discovered that Free Software was included without source.
|
||||
Mailing lists throughout the Free Software community erupted with
|
||||
complaints about the problem, and FSF quickly investigated.
|
||||
|
|
@ -722,31 +789,31 @@ arms about the violation.
|
|||
Meanwhile, Haxil was in the midst of being acquired by Polgara. Polgara
|
||||
was as surprised as everyone else to discover the product was based on
|
||||
GPL'd software; this fact had not been part of the disclosures made during
|
||||
acquisition. FSF contacted both Haxil and Polgara, and product managers
|
||||
acquisition. FSF contacted Haxil, Polgara, and the product managers
|
||||
who had transitioned into the ``Haxil division'' of the newly-merged
|
||||
Polgara company and Polgara's General Counsel's office worked with FSF on
|
||||
Polgara company. Polgara's General Counsel's office worked with FSF on
|
||||
the matter.
|
||||
|
||||
FSF meanwhile formed a coalition with the other primary copyright holders
|
||||
FSF formed a coalition with the other primary copyright holders
|
||||
to pursue the enforcement effort on their behalf. FSF communicated
|
||||
directly with Polgara's representatives to begin working through the
|
||||
issues on behalf of FSF itself and the Free Software community at large.
|
||||
issues on behalf of itself and the Free Software community at large.
|
||||
|
||||
Polgara pointed out that the software distribution they used was mostly
|
||||
contributed by an upstream provider, Thesulac, and Haxil's changes to that
|
||||
code base were minimal. Polgara negotiated with Thesulac to obtain the
|
||||
source, although the issue was moving very slowly in the channels between
|
||||
source, although the issue moved very slowly in the channels between
|
||||
Polgara and Thesulac.
|
||||
|
||||
FSF encouraged a round-table meeting so that high bandwidth communication
|
||||
could occur between FSF, Polgara and Thesulac. Polgara and Thesulac
|
||||
agreed, and that discussion began. Thesulac provided nearly complete
|
||||
sources to Polgara, and Polgara made a full software release on their
|
||||
website. At the time of writing, that software still has some build
|
||||
problems (similar those that occurred with Davrik, as described in
|
||||
Web site. At the time of writing, that software still has some build
|
||||
problems (similar to those that occurred with Davrik, as described in
|
||||
Section~\ref{davrik-build-problems}). FSF continues to negotiate with
|
||||
Polgara and Thesulac to resolve these problems, which have a clear path to
|
||||
solution and are expected to resolve.
|
||||
a solution and are expected to resolve.
|
||||
|
||||
Similar to the Vigorien case, Thesulac has regulatory concerns. In this
|
||||
case, it is not export controls --- an issue that has since been resolved
|
||||
|
|
@ -767,7 +834,7 @@ regarding the problem.
|
|||
more difficult.} FSF has a strong policy never to publicize names of
|
||||
GPL violators if they are negotiating in a friendly way and operating in
|
||||
good faith toward compliance. Most violations are honest mistakes, and
|
||||
FSF sees no reason to publicly admonish violators who genuinely see to
|
||||
FSF sees no reason to publicly admonish violators who genuinely want to
|
||||
come into compliance with GPL and to work hard staying in compliance.
|
||||
|
||||
This case was so public in the Free Software community that both Haxil's
|
||||
|
|
@ -796,7 +863,7 @@ regarding the problem.
|
|||
When FSF carries out enforcement, we are patient and sympathetic when
|
||||
the problem appears to be upstream. In fact, we urge the violator to
|
||||
point us to the upstream provider so we may talk to them directly. In
|
||||
this case we were happy to begin negotiations with Thesulac. However,
|
||||
this case, we were happy to begin negotiations with Thesulac. However,
|
||||
Polgara still has an obligation to bring their product into compliance,
|
||||
regardless of Thesulac's response.
|
||||
|
||||
|
|
@ -805,7 +872,7 @@ regarding the problem.
|
|||
distribute a ``good practices for GPL compliance'' document with their
|
||||
product. Polgara added various software components to Thesulac's
|
||||
product, and it is conceivable that such additions can introduce
|
||||
compliance. In FSF's opinion, Thesulac is no way legally responsible
|
||||
compliance. In FSF's opinion, Thesulac is in no way legally responsible
|
||||
for such a violation introduced by their customer, but it behooves them
|
||||
from a marketing standpoint to educate their customers about using the
|
||||
product. We can argue whether or not it is your coffee vendor's fault
|
||||
|
|
@ -817,14 +884,14 @@ regarding the problem.
|
|||
many parties.} Most Free Software systems have hundreds of copyright
|
||||
holders. Some have thousands. FSF is in a unique position as one of
|
||||
the largest single copyright holders on GPL'd software and as a
|
||||
respected umpire in the community neutrally enforcing the rules of the
|
||||
respected umpire in the community, neutrally enforcing the rules of the
|
||||
GPL road. FSF works hard in the community to convince copyright
|
||||
holders that consolidating GPL claims through FSF is better for them,
|
||||
and more likely to yield positive compliance results.
|
||||
|
||||
A few copyright holders engage in the ``proprietary relicensing''
|
||||
business, so they use GPL enforcement as a sales channel for that
|
||||
business. FSF, as a community-oriented not-for-profit organization,
|
||||
business. FSF, as a community-oriented, not-for-profit organization,
|
||||
seeks only to preserve the freedom of Free Software in its enforcement
|
||||
efforts. As it turns out, most of the community of copyright holders
|
||||
of Free Software want the same thing. Share and share alike is a
|
||||
|
|
@ -841,7 +908,7 @@ Generally, from the experience of GPL enforcement, we glean the following
|
|||
general practices that can help in GPL compliance for organizations that
|
||||
distribute products based on GPL'd software:
|
||||
|
||||
\begin{enumerate}
|
||||
\begin{itemize}
|
||||
|
||||
\item Talk to your software engineers and ask them where they got the
|
||||
components they use in the products they build. Find out if GPL'd
|
||||
|
|
@ -868,11 +935,11 @@ distribute products based on GPL'd software:
|
|||
merely having GPL'd code in one part of a product does not necessarily
|
||||
mean that every related product must also be GPL'd. And, even if some
|
||||
software needs to be released that was not before, the product will
|
||||
surely still survive. In FSF's enforcement efforts, we have not yet
|
||||
surely survive. In FSF's enforcement efforts, we have not yet
|
||||
seen a product line die because source was released to customers in
|
||||
compliance with GPL.
|
||||
|
||||
\end{enumerate}
|
||||
\end{itemize}
|
||||
|
||||
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
||||
\end{document}
|
||||
|
|
@ -880,6 +947,9 @@ distribute products based on GPL'd software:
|
|||
% LocalWords: proprietarize redistributors sublicense yyyy Gnomovision EULAs
|
||||
% LocalWords: Yoyodyne FrontPage improvers Berne copyrightable Stallman's GPLs
|
||||
% LocalWords: Lessig Lessig's UCITA pre PDAs CDs reshifts GPL's Gentoo glibc
|
||||
% LocalWords: TrollTech administrivia LGPL's MontaVista Davrik Davrik's Darvik
|
||||
% LocalWords: Darvik's Slashdot sublicensed Vigorien Vigorien's Haxil Polgara
|
||||
% LocalWords: TrollTech administrivia LGPL's MontaVista OpenTV Mitek Arce DVD
|
||||
% LocalWords: unprotectable protectable Unfreedonia chipset CodeSourcery Iqtel
|
||||
% LocalWords: impermissibly Bateman faire minimis Borland uncopyrightable Mgmt
|
||||
% LocalWords: franca downloadable Davrik Davrik's Darvik
|
||||
% LocalWords: Slashdot sublicensed Vigorien Vigorien's Haxil Polgara
|
||||
% LocalWords: Thesulac Polgara's Haxil's Thesulac's SDK CD's
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue