Fork and Ignore: Fighting a GPL Violation By Coding Instead

Bradley M. Kuhn

Friday 22 August 2014

GPL Violations Differ

What’s a GPL Violation?

What’s a GPL Violation?

Fundamental Assumptions

Fundamental Assumptions

A Developer Releases a Codebase

There’s Always A Flame War.

… & the Community Goes On.

Altering The Deal

Conservancy as Mediator

Of Course, GPL Is Irrevocable!


All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met.

— GPLv3§2¶1

“Based on” the earlier work

How This Differs from Other Violations

Early Friendliness Yields Better Options

Avoiding Conflict

A Complex License


RhodeCode system is split-licensed and comprised of two parts:

(1) The Python code and integrated HTML are licensed under the GPLv3 license as is RhodeCode itself. …

(2) All other parts of RhodeCode including, but not limited to, CSS code, images, and design are licensed according to the license purchased.

Invalid Additional Term?


All other non-permissive additional terms are considered “further restrictions” within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term.

— GPLv3§7¶4

Remember: No Conflict!


RhodeCode system is split-licensed and comprised of two parts:

(1) The Python code and integrated HTML are licensed under the GPLv3 license as is RhodeCode itself. …

(2) All other parts of RhodeCode including, but not limited to, CSS code, images, and design are licensed according to the license purchased.

Making the Fork

Step 0: Evaluation Committee Decision

Step 1: Last Known GPLv3’d version

Step 1: Last Known GPLv3’d version

Step 2: Extract New Python & HTML

Step 2: Example Command

An example command for extracting patches from Company’s repository:

  hg --cwd $RHODECODE_REPOSITORY diff -r 21af6c4eab3d -r 6177597791c2 \
     -I rhodecode/__init__.py \
     -I rhodecode/websetup.py \
     -I rhodecode/bin/ \
     -I rhodecode/config/ \
     -I rhodecode/controllers/ \
     -I rhodecode/lib/ \
     -X rhodecode/lib/paster_commands/make_config.py \
     -X rhodecode/config/deployment.ini_tmpl \
     -X rhodecode/bin/template.ini.mako \
     -I rhodecode/model/ \
     -I rhodecode/tests/ \
     -I rhodecode/templates/ \
     -I setup.py \
    | hg --cwd $KALLITHEA_REPOSITORY import - --no-commit

Step 2: Vetting

Step 3: Rename


Kallithea, or Καλλιθεα, is the name of a locality on the island of Rhodes, in Greece, which itself means ‘the best view’. Our Kallithea project helps developers get the best views of their project and its contributions so they can better collaborate together.

Step 3: Rename

Step 3: Example Commands

Example commands to do renaming:

sed -i 's,setup-rhodecode,setup-db,g' */tests/scripts/create_rc.sh docs/*.rst setup.py
sed -i 's,setup_rhodecode,setup_db,g' setup.py
hg ci -m 'Rename paster command setup-rhodecode to setup-db'

hg mani | xargs sed -i 's/\<from rhodecode import /from kallithea import /g'
sed -i 's,\<rhodecode \(=\|is\) None\>,kallithea \1 None,g' */config/*.py
hg mani | xargs sed -i 's/\<import rhodecode$/import kallithea/g'
hg mani | xargs sed -i 's/\<rhodecode\.\(bin\|config\|controllers\|lib\|model\|tests\|__init__\|__version__\|websetup\|CONFIG\|EXTENSIONS\|CELERY_ON\|CELERY_EAGER\)\>/kallithea.\1/g'
hg mani | xargs sed -i 's,\<rhodecode/\(controllers\|lib\|model\|tests\|public\|i18n\|__init__\|templates\)\>,kallithea/\1,g'
sed -i 's, rhodecode/, kallithea/,g' MANIFEST.in

 hg mani | xargs sed -i -e 's,settings\['"'rhodecode_' + ,settings[,g" -e 's,\<rhodecode_\(title\|realm\|ga_code\|captcha_public_key\|captcha_private_key\|show_public_icon\|show_private_icon\|stylify_metatags\|repository_fields\|lightweight_journal\|dashboard_items\|admin_grid_items\|show_version\|use_gravatar\|gravatar_url\|clone_uri_tmpl\|update_url\|extras\)\>,\1,g'
 hg ci -m 'Drop rhodecode_ prefix for known setting names that are stored in kallithea_settings without prefix'

Step 4: Beyond Reproach

GPL’d Javascript

So, What Do I find?

So, there’s Javascript in this thing?

  $ hg clone -q https://kallithea-scm.org/repos/kallithea/
  $ cd kallithea; hg locate -r ffd45b185016 'rhodecode/public/js/*'
  codemirror.js
  codemirror_loadmode.js
  excanvas.min.js
  qgraph.js
  jquery.1.10.1.min.js
  mergerly.js
  mode
  native.history.js
  pyroutes_map.js
  rhodecode.js
  yui.2.9.js
  yui.flot.js

Verify Upstream licensed this code

 $
 $ hg -v log -r bb9ef0638069
 changeset:   4120:bb9ef0638069
 branch:      rhodecode-2.2.5-gpl
 user:        Bradley M. Kuhn <bkuhn@sfconservancy.org>
 date:        Fri May 16 15:54:24 2014 -0400
 description:
   Update CodeMirror CSS and Javascript files to version 3.15, under MIT-permissive license.

   These files are exactly as they appear the upstream release 3.15 of
   Codemirror, which was released under an MIT-permissive license.  To extract
   these files, I did the following:

   I downloaded the following file:
        http://codemirror.net/codemirror-3.15.zip
   with sha256sum of:
   $ sha256sum codemirror-3.15.zip
   8cf3a512899852fd4e3833423ea98d34918cbf7ee0e4e0b13f8b5e7b083f21b9  codemirror-3.15.zip

   And extracted from it the Javascript and CSS files herein committed, which
   are licensed under the MIT-permissive license, placing them into their
   locations in: rhodecode/public/{css,js}/

   Using the procedure above, the only difference found between these files in
   RhodeCode 2.2.5 release and herein were a few comments and whitespace.

   Note that the file .../public/js/mode/meta_ext.js does *not* appear to be
   part of CodeMirror and therefore is not included in this commit.

Add Correct LICENSE notices

Update our LICENSE.md:

  Codemirror
  ----------

  Kallithea incorporates parts of the Javascript system called
  [Codemirror](http://codemirror.net/), which is primarily:

  Copyright &copy; 2013 by Marijn Haverbeke <marijnh@gmail.com>

  and licensed under the MIT-permissive license, which is
  [included in this distribution](MIT-Permissive-License.txt).

  Additional files from upstream Codemirror are copyrighted by various authors
  and licensed under other permissive licenses.  The sub-directories under
  [.../public/js/mode/](kallithea/public/js/mode) include the copyright and
  license notice and information as they appeared in Codemirror's upstream
  release.

Most Javascript is Object Code

Most Javascript is Object Code


“Object code” means any non-source form of a work.

— GPLv3§1¶1


Object code is not restricted to a narrow technical meaning and is understood broadly to include any form of the work other than the preferred form for making modifications to it. Object code therefore includes any kind of transformed version of source code, such as bytecode or minified Javascript.

FSF’s GPLv3 First Rationale Document, 2006-01-16 (emphasis mine)

Why You?!? I (asked)!


The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities.

— GPLv3§1

Handling Our Distribution

What about distributing minified Javascript in our repository?


Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code.

— GPLv3§6(c)

YUI Solution

From our LICENSE.md:

Kallithea incorporates parts of the Javascript system called
[YUI 2 — Yahoo! User Interface Library](http://yui.github.io/yui2/docs/yui_2.9.0_full/),
which is made available under the [BSD License](http://yuilibrary.com/license/):

Copyright &copy; 2013 Yahoo! Inc. All rights reserved.
[Text of 3-Clause BSD]

Kallithea includes a minified version of YUI 2.9. To build yui.2.9.js:
    git clone https://github.com/yui/builder
    git clone https://github.com/yui/yui2
    cd yui2/
    git checkout hudson-yui2-2800
    # work around inconsistent casing
    ln -sf JumpToPageDropDown.js src/paginator/js/JumpToPageDropdown.js
    rm -f tmp.js
    for m in yahoo event dom connection animation dragdrop \
             element datasource autocomplete container event-delegate \
             json datatable paginator; do
      rm -f build/\$m/\$m.js
      ( cd src/\$m && ant build deploybuild ) && \
        sed -e 's,@VERSION@,2.9.0,g' -e 's,@BUILD@,2800,g' build/\$m/\$m.js >> tmp.js
    done
    java -jar ../builder/componentbuild/lib/yuicompressor/yuicompressor-2.4.4.jar \
     tmp.js -o yui.2.9.js

In compliance with GPLv3 the Corresponding Source for this Object Code is made
available on [https://kallithea-scm.org/repos/mirror](https://kallithea-scm.org/repos/mirror).

Avoid Licensing Infractions

When the Original Code Did It …

Kallithea’s about.html

Copyright © 2010–2013, RhodeCode GmbH
Copyright © 2011–2014, Unity Technologies
Copyright © 2012, 2014, Andrew Shadura
Copyright © 2012, Augusto Herrmann
Copyright © 2012, Dan Sheridan
Copyright © 2012, 2014, Dominik Ruf
Copyright © 2012, Vincent Duvert
Copyright © 2011, Liad Shani
Copyright © 2013, Jonathan Sternberg
Copyright © 2011, Jason F. Harris
Copyright © 2011, Lorenzo M. Catucci
Copyright © 2013, Grzegorz Rożniecki
Copyright © 2011, Les Peabody
Copyright © 2011, Nicolas VINOT
Copyright © 2012, Indra Talip
Copyright © 2012, H Waldo G
Copyright © 2011, Aparkar
Copyright © 2013, Dennis Brakhane
Copyright © 2011, Matt Zuba
Copyright © 2014, Bradley M. Kuhn
Copyright © 2012–2013, xpol
Copyright © 2012, hppj
Copyright © 2013–2014, Takumi IINO
Copyright © 2011, Shawn K. O’Shea
Copyright © 2012, Tony Bussieres
Copyright © 2011, Simon Lopez
Copyright © 2012, mikespook
Copyright © 2012, nansenat16
Copyright © 2012, Zachary Auclair
Copyright © 2012, Raoul Thill
Copyright © 2011, Jared Bunting
Copyright © 2013, Magnus Ericmats
Copyright © 2010, Lukasz Balcerzak
Copyright © 2014, Sean Farley
Copyright © 2014, Martin Vium
Copyright © 2014, Daniel Anderson
Copyright © 2014, Travis Burtrum

Lessons for New Communities

Early Results: Success

More Info / Talk License

Presentation and slides are: Copyright © 2014 Bradley M. Kuhn, and are licensed under the Creative Commons Attribution-Share Alike 4.0 International License.

Some images included herein are ©’ed by others. I believe my use of those images is fair use under USA © law. However, I suggest you remove such images if you redistribute these slides under CC-By-SA 4.0.