Both Section 7(ii) and Section 8 allow users to provide the Corresponding Source from a network location so long as it is provided at no charge.
I would like to add additional requirements.
The basic thing I'm looking for is that the source be made publicly available and not put behind some wall of inconvenience (such as requiring a specific device or requiring a user account, etc). Below are three sections: 1) stuff I want to prevent, 2) stuff I don't want to prevent, 3) stuff I'm not sure about.
## Stuff I want to prevent
A person providing source shouldn't make a user do any of the following in order to be able to download the source:
* Create a user account * Undergo identity verification/authentication (or sign in with some third party service like Facebook or Twitter) * Complete a survey or lengthy data collection process. * First request send a request to the host that your IP address be added to a whitelist * Require the use of running proprietary software in order to download the source code (e.g., requiring the use of some proprietary App Store App). * Require the use of a specific kind of device or require a person to spoof device metadata (similar to how the Android App store will prevent you from downloading an App that is not compatible with a certain device). * Require some PACER like step of having a PIN mailed to you in the mail.
With the exception of PACER, I have encountered each of the above issues when trying to download source of programs licensed under the GPL.
## Stuff I don't want to prevent
At the same time, I wouldn't want to prevent a person distributing the source from doing things that are sensible.
* Blacklisting spammer/crawler IP addresses. * Require users to fill out a captcha * Tracking basic info provided in HTTP headers * Provide a user with simple instructions like: 'in order to download this source, please enter the username "public" and password "anonymous" to the following form'.
## Stuff I'm not sure about
* Requiring the user to use a version control systems (e.g., providing access only over a "git clone" statement).
* Requiring the user to connect to some weird protocol even if there is free software that can connect to it (e.g., like, imagine if f-droid didn't have an HTTP interface, but it used some weird interface and it only provided source via the f-droid app interface running on your Replicant/Android/Linux OS) -- in order to connect from GNU/Linux you'd either have to figure out how to get f-droid running on GNU/Linux or you'd need to figure out how to create a connection to the store).
* Operating system requirements. For example, people do not build Android Apps on top of Android, they build them on top of a different OS.
Hello,
On 02/08/2013 10:49 PM, Joshua Gay wrote:
## Stuff I'm not sure about
- Requiring the user to use a version control systems (e.g., providing
access only over a "git clone" statement).
I think this should be allowed. The source code is in general aimed at developers (what are you going to do with the source code if you're not a developer?), and it is so common nowadays to distribute source code and libraries through public DVCS repositories that even installers like pip (python) and npm (node.js) support installing packages directly from git repositories.
In fact, the only project I am aware of currently licensed under copyleft-next links to its gitorious page as the only download link ;)
-- kuno / warp. ps. gitorious does have a feature where it will generate a tarball for you, but like most things on gitorious that link is not that easy to find.
On 02/08/2013 06:05 PM, Kuno Woudt wrote:
Hello,
On 02/08/2013 10:49 PM, Joshua Gay wrote:
## Stuff I'm not sure about
- Requiring the user to use a version control systems (e.g., providing
access only over a "git clone" statement).
I think this should be allowed. The source code is in general aimed at developers (what are you going to do with the source code if you're not a developer?),
You might ask someone who knows how to program to make changes to the program for you.
Consider this example. Let's say I work in a medical clinic and I buy a device that has a lot of software on it. In the future it might become buggy or I might want to get the software upgraded (recompile with a new version of the kernel and other parts, etc). I might want to download a save a copy of the complete and corresponding source because it may go away in a few years and the manufacture might not be required to continue providing it online.
Also, one thing that concerns me is that people won't provide a copy of the Corresponding Source. They might point people to check out the trunk of the source, which could be a newer version that does not correspond with the current binary that is running. So even if we can assume that a link to a git repo is OK, I hope that very clear and simple instructions for getting the *Corresponding Source* would be provided and not just the latest source.
On Fri, Feb 08, 2013 at 07:54:23PM -0500, Joshua Gay wrote:
On 02/08/2013 06:05 PM, Kuno Woudt wrote:
Hello,
On 02/08/2013 10:49 PM, Joshua Gay wrote:
## Stuff I'm not sure about
- Requiring the user to use a version control systems (e.g., providing
access only over a "git clone" statement).
I think this should be allowed. The source code is in general aimed at developers (what are you going to do with the source code if you're not a developer?),
You might ask someone who knows how to program to make changes to the program for you.
Consider this example. Let's say I work in a medical clinic and I buy a device that has a lot of software on it. In the future it might become buggy or I might want to get the software upgraded (recompile with a new version of the kernel and other parts, etc). I might want to download a save a copy of the complete and corresponding source because it may go away in a few years and the manufacture might not be required to continue providing it online.
I don't think requiring that user to use 'git clone' is problematic. (Is the concern that this specific user may not have the knowledge or software tools to do it?)
Also, one thing that concerns me is that people won't provide a copy of the Corresponding Source. They might point people to check out the trunk of the source, which could be a newer version that does not correspond with the current binary that is running. So even if we can assume that a link to a git repo is OK, I hope that very clear and simple instructions for getting the *Corresponding Source* would be provided and not just the latest source.
I've wondered about whether a link to a git repo is sufficient for AGPLv3 compliance, but this appears to be how all known 'benign' examples of AGPLv3 projects are self-complying.
- RF
On Fri, Feb 08, 2013 at 09:15:32PM -0500, Richard Fontana wrote:
I don't think requiring that user to use 'git clone' is problematic. (Is the concern that this specific user may not have the knowledge or software tools to do it?)
What if the sources are only available under a proprietary source code management system which requires $$$ to obtain? i.e., like Perforce, Bitkeeper, or <shudder> Clearcase? (Although I dont think Clearcase has anonymous access, so maybe it would be prohibited on other grounds.)
Also, one thing that concerns me is that people won't provide a copy of the Corresponding Source. They might point people to check out the trunk of the source, which could be a newer version that does not correspond with the current binary that is running. So even if we can assume that a link to a git repo is OK, I hope that very clear and simple instructions for getting the *Corresponding Source* would be provided and not just the latest source.
Well, technically they did provide a copy of the Corresponding Source. They may just not have identified which revision out of the potentially thousands of revisions in the repository _was_ the Corresponding Source used to build said binary. (I guess the lawyerly equivalent would be handing over seventeen truckloads of documents in response to a discovery request, in paper form, with no index? :-)
It's good practice for binaries to identify the version id used to build them, for example: v3.8-rc3-26-ge7b04ac. The question is whether it's important enough to add this requirement to the copyleft license, given the goal of keeping its word count under that of the GPLv3....
- Ted
On Sat, Feb 09, 2013 at 11:50:01AM -0500, Theodore Ts'o wrote:
On Fri, Feb 08, 2013 at 09:15:32PM -0500, Richard Fontana wrote:
I don't think requiring that user to use 'git clone' is problematic. (Is the concern that this specific user may not have the knowledge or software tools to do it?)
What if the sources are only available under a proprietary source code management system which requires $$$ to obtain?
Though I suppose it could be made clearer, the requirement that the Corresponding Source be made available 'at no charge' to me is inconsistent with requiring someone to use a non-gratis tool to get a copy of the Corresponding Source (with no other at-no-charge option). GPLv2 and GPLv3 are certainly no clearer on this point.
- RF
On Sat, Feb 9, 2013 at 8:50 AM, Theodore Ts'o tytso@mit.edu wrote:
On Fri, Feb 08, 2013 at 09:15:32PM -0500, Richard Fontana wrote:
I don't think requiring that user to use 'git clone' is problematic. (Is the concern that this specific user may not have the knowledge or software tools to do it?)
What if the sources are only available under a proprietary source code management system which requires $$$ to obtain? i.e., like Perforce, Bitkeeper, or <shudder> Clearcase? (Although I dont think Clearcase has anonymous access, so maybe it would be prohibited on other grounds.)
Also, one thing that concerns me is that people won't provide a copy of the Corresponding Source. They might point people to check out the trunk of the source, which could be a newer version that does not correspond with the current binary that is running. So even if we can assume that a link to a git repo is OK, I hope that very clear and simple instructions for getting the *Corresponding Source* would be provided and not just the latest source.
Well, technically they did provide a copy of the Corresponding Source. They may just not have identified which revision out of the potentially thousands of revisions in the repository _was_ the Corresponding Source used to build said binary. (I guess the lawyerly equivalent would be handing over seventeen truckloads of documents in response to a discovery request, in paper form, with no index? :-)
As a data point on what is possible, Mozilla nightly builds have a link somewhere (I can't find it right now though) to the exact hg revision that was used to do the build. I think that's perfectly reasonable as a requirement (though perhaps it should be in the non-existent FAQ).
And as a general point, I agree with the notion that the correct standard is "getting source can require the same number of hoops to be jumped through that the binary required, but no more". Writing in specific rules (e.g., identity verification, user traffic logging, etc.) is a recipe for a license that is broken within 5-10 years (as well as too wordy).
Luis (suggestion for a lurker who wants to contribute: search the archives for "FAQ" and create a skeletal FAQ with relevant quotes from the various email threads)
Hello,
On 02/09/2013 01:54 AM, Joshua Gay wrote:
On 02/08/2013 06:05 PM, Kuno Woudt wrote:
Hello,
On 02/08/2013 10:49 PM, Joshua Gay wrote:
## Stuff I'm not sure about
- Requiring the user to use a version control systems (e.g., providing
access only over a "git clone" statement).
I think this should be allowed. The source code is in general aimed at developers (what are you going to do with the source code if you're not a developer?),
You might ask someone who knows how to program to make changes to the program for you.
But if you're not a programmer, how do you know if the zip file you downloaded does indeed contain the complete and corresponding source code you need? Most free software projects do not include third party libraries in their tar balls or source code repositories, you should ensure that you download matching versions of all dependencies if you want to be able to build the software years from now [1].
There are no guarantees that you can do a successful build of the source code you downloaded unless you do a build. If you cannot do this yourself, you should hire a programmer to do so. Having to "git clone" is the least of your concerns in this scenario.
Consider this example. Let's say I work in a medical clinic and I buy a device that has a lot of software on it. In the future it might become buggy or I might want to get the software upgraded (recompile with a new version of the kernel and other parts, etc). I might want to download a save a copy of the complete and corresponding source because it may go away in a few years and the manufacture might not be required to continue providing it online.
If I was hired by you to fix a bug in that software, I will first have to try to understand the software. For that, a full commit history will be very valuable in helping me understand why certain parts of the code have been implemented the way they are. Nowadays a lot of information which would in the past be in comment blocks has been moved to commit messages.
Or, to use the phrase from the GPL: A tar ball of the source code is nowadays no longer the "the preferred form of the work for making modifications to it". The preferred form is a clone of the DVCS repository with full history. Especially when trying to fix a bug, it is often useful to go back in history to find the commit which introduced the bug, this will give a developer a better understanding of the bug and will help him fix it in a way which doesn't break things elsewhere.
Also, one thing that concerns me is that people won't provide a copy of the Corresponding Source. They might point people to check out the trunk of the source, which could be a newer version that does not correspond with the current binary that is running. So even if we can assume that a link to a git repo is OK, I hope that very clear and simple instructions for getting the *Corresponding Source* would be provided and not just the latest source.
Obviously they have a copy of the Corresponding Source if they have the full history :). Release tags solve this problem, and in my experience most projects that do releases do use them. I can see the desire to mandate use of release tags which correspond with binaries, but I'm not convinced this is enough of a practical problem that the copyright license should mandate it for derivatives.
-- kuno / warp.
On Fri, Feb 08, 2013 at 04:49:29PM -0500, Joshua Gay wrote:
Both Section 7(ii) and Section 8 allow users to provide the Corresponding Source from a network location so long as it is provided at no charge.
I would like to add additional requirements.
The basic thing I'm looking for is that the source be made publicly available and not put behind some wall of inconvenience (such as requiring a specific device or requiring a user account, etc).
Below are three sections: 1) stuff I want to prevent, 2) stuff I don't want to prevent, 3) stuff I'm not sure about.
## Stuff I want to prevent
A person providing source shouldn't make a user do any of the following in order to be able to download the source:
- Create a user account
- Undergo identity verification/authentication (or sign in with some
third party service like Facebook or Twitter)
- Complete a survey or lengthy data collection process.
- First request send a request to the host that your IP address be added
to a whitelist
- Require the use of running proprietary software in order to download
the source code (e.g., requiring the use of some proprietary App Store App).
- Require the use of a specific kind of device or require a person to
spoof device metadata (similar to how the Android App store will prevent you from downloading an App that is not compatible with a certain device).
- Require some PACER like step of having a PIN mailed to you in the mail.
With the exception of PACER, I have encountered each of the above issues when trying to download source of programs licensed under the GPL.
Any suggestions for how to do this in ~25 words or less?
The "in a reasonably equivalent manner" language in section 8 arguably takes care of it there (and where it doesn't, maybe there isn't really a problem). It occurs to me that there may be an unnecessary mismatch between 7(ii) and 8.
Perhaps some of the language in AGPLv3 section 13 might be useful.
What I don't want is to have a laundry list of specific forbidden burdensome requirements (though that could be covered in the currently-nonexistent FAQ).
## Stuff I don't want to prevent
At the same time, I wouldn't want to prevent a person distributing the source from doing things that are sensible.
- Blacklisting spammer/crawler IP addresses.
- Require users to fill out a captcha
- Tracking basic info provided in HTTP headers
- Provide a user with simple instructions like: 'in order to download
this source, please enter the username "public" and password "anonymous" to the following form'.
## Stuff I'm not sure about
- Requiring the user to use a version control systems (e.g., providing
access only over a "git clone" statement).
As noted elsewhere, I think this is probably okay. I think the main objection would be the lack of specificity.
- Requiring the user to connect to some weird protocol even if there is
free software that can connect to it (e.g., like, imagine if f-droid didn't have an HTTP interface, but it used some weird interface and it only provided source via the f-droid app interface running on your Replicant/Android/Linux OS) -- in order to connect from GNU/Linux you'd either have to figure out how to get f-droid running on GNU/Linux or you'd need to figure out how to create a connection to the store).
- Operating system requirements. For example, people do not build
Android Apps on top of Android, they build them on top of a different OS.
I wasn't sure what you meant by this last one. Do you mean 'you shouldn't have to be forced to run Android in order to get source code for an Android app'?
- RF
On Fri, Feb 8, 2013 at 10:37 PM, Richard Fontana fontana@sharpeleven.org wrote:
Any suggestions for how to do this in ~25 words or less?
The "in a reasonably equivalent manner" language in section 8 arguably takes care of it there (and where it doesn't, maybe there isn't really a problem).
I'm inclined to agree that "reasonably equivalent manner" is sufficient, although it may not be clear. In the interests of reminding myself that I still pay attention to this project, I've created a merge request[1] that changes the language slightly in order to make it more obvious that the method for getting the source should be the same as getting the object code. If the object code requires login or other hoops to access, I see no reason that the source can't be subject to the same hoops. (Whether it *should* is another story, but to my mind so long as obtaining the source is exactly as onerous as obtaining any object code, it is not philosophically offensive).
[1] https://gitorious.org/copyleft-next/copyleft-next/merge_requests/30
On Fri, Feb 08, 2013 at 11:19:42PM -0500, Ben Cotton wrote:
If the object code requires login or other hoops to access, I see no reason that the source can't be subject to the same hoops. (Whether it *should* is another story, but to my mind so long as obtaining the source is exactly as onerous as obtaining any object code, it is not philosophically offensive).
I agree. This is basically the GPL policy.
- RF
On 02/08/2013 10:37 PM, Richard Fontana wrote:
On Fri, Feb 08, 2013 at 04:49:29PM -0500, Joshua Gay wrote:
Both Section 7(ii) and Section 8 allow users to provide the Corresponding Source from a network location so long as it is provided at no charge.
I would like to add additional requirements.
The basic thing I'm looking for is that the source be made publicly available and not put behind some wall of inconvenience (such as requiring a specific device or requiring a user account, etc).
Below are three sections: 1) stuff I want to prevent, 2) stuff I don't want to prevent, 3) stuff I'm not sure about.
## Stuff I want to prevent
A person providing source shouldn't make a user do any of the following in order to be able to download the source:
- Create a user account
- Undergo identity verification/authentication (or sign in with some
third party service like Facebook or Twitter)
- Complete a survey or lengthy data collection process.
- First request send a request to the host that your IP address be added
to a whitelist
- Require the use of running proprietary software in order to download
the source code (e.g., requiring the use of some proprietary App Store App).
- Require the use of a specific kind of device or require a person to
spoof device metadata (similar to how the Android App store will prevent you from downloading an App that is not compatible with a certain device).
- Require some PACER like step of having a PIN mailed to you in the mail.
With the exception of PACER, I have encountered each of the above issues when trying to download source of programs licensed under the GPL.
Any suggestions for how to do this in ~25 words or less?
[snip]
How about:
"Corresponding source shall be accessible via non-proprietary means of access without charge, need for identity verification, or user traffic logging."
That comes to 20 words and would be a start.
Stephen Michael Kellat
On Sat, Feb 9, 2013 at 1:31 PM, Stephen Michael Kellat skellat@fastmail.net wrote:
"Corresponding source shall be accessible via non-proprietary means of access without charge, need for identity verification, or user traffic logging."
That would seem to prohibit even basic logging of HTTP traffic, which would be unacceptable to most sysadmins and possibly unenforceable in some jurisdictions. I don't think that's what you intended, but the wording is sufficiently vague. "Non-proprietary" would also require greater clarity if it ever came to litigation.
On 02/09/2013 01:52 PM, Ben Cotton wrote:
On Sat, Feb 9, 2013 at 1:31 PM, Stephen Michael Kellat skellat@fastmail.net wrote:
"Corresponding source shall be accessible via non-proprietary means of access without charge, need for identity verification, or user traffic logging."
That would seem to prohibit even basic logging of HTTP traffic, which would be unacceptable to most sysadmins and possibly unenforceable in some jurisdictions. I don't think that's what you intended, but the wording is sufficiently vague. "Non-proprietary" would also require greater clarity if it ever came to litigation.
I agree. For now I wanted to throw a first draft out. I'm still thinking about ways to cleaning it up some within Richard's 25 word limit.
Stephen Michael Kellat
On Sat, Feb 09, 2013 at 01:31:45PM -0500, Stephen Michael Kellat wrote:
"Corresponding source shall be accessible via non-proprietary means of access without charge, need for identity verification, or user traffic logging."
I'm not so sure about the last clause. What precisely qualifies as "user traffic logging"? Some people might think IP addresses might qualify.
The goal here is to prevent requiring a user acount, right? Wouldn't "identity verification" be sufficient?
Also, while most crypto qualifies these days under the ITAR exemption, enough so that we don't think about it, there is still software (such as that pertaining to satellites and launch vehicles) which is still coverred by ITAR. What if someone, say, in the amateur radio community, wants to use open source software in an amateur satellite project? I could imagine cases where the software could be freely shared within the United States, but due to ITAR regulations, someone who tried putting it on an open ftp site would could end up getting thrown in jail.
There's some discussions about how the GPL interacts with ITAR here:
http://www.dwheeler.com/essays/dod-oss-qa.html
But if we require that "corresponding source" must _always_ be accessible via the network, this might be problemtic for certain use cases.
Regards,
- Ted
On 02/09/2013 02:14 PM, Theodore Ts'o wrote:
On Sat, Feb 09, 2013 at 01:31:45PM -0500, Stephen Michael Kellat wrote:
"Corresponding source shall be accessible via non-proprietary means of access without charge, need for identity verification, or user traffic logging."
I'm not so sure about the last clause. What precisely qualifies as "user traffic logging"? Some people might think IP addresses might qualify.
I agree. That's a bit of inartful drafting on my part.
The goal here is to prevent requiring a user acount, right? Wouldn't "identity verification" be sufficient?
Not sure. If I understand Joshua's concerns, he does not want user accounts involved. I need to think about my thinking on that more in the meantime.
Also, while most crypto qualifies these days under the ITAR exemption, enough so that we don't think about it, there is still software (such as that pertaining to satellites and launch vehicles) which is still coverred by ITAR. What if someone, say, in the amateur radio community, wants to use open source software in an amateur satellite project? I could imagine cases where the software could be freely shared within the United States, but due to ITAR regulations, someone who tried putting it on an open ftp site would could end up getting thrown in jail.
As a duly-licensed amateur radio operator, I am well aware that ITAR remains an interesting conundrum. For the most part, I'm not aware of matters of concern under ITAR being released under open source licenses of any sort. I know at least one satellite going up that has an Arduino on-board which would have an open source license involved but it seemed like that was set to be connected only to sensors. See: http://www.uk.amsat.org/?p=7983
I may need to think of an appropriate inquiry to AMSAT's office in Maryland.
There's some discussions about how the GPL interacts with ITAR here:
http://www.dwheeler.com/essays/dod-oss-qa.html
But if we require that "corresponding source" must _always_ be accessible via the network, this might be problemtic for certain use cases.
That's going to be an interesting scenario that I do not think we've approached yet. If anything, ITAR is deserving of its own thread.
Here's my second attempt at a draft:
"Corresponding source shall be accessible without charge or user verification being required. Access through only a marketplace/storefront to source may not be mandated."
That's 24 words.
Stephen Michael Kellat
On 02/08/2013 10:37 PM, Richard Fontana wrote:
On Fri, Feb 08, 2013 at 04:49:29PM -0500, Joshua Gay wrote:
Both Section 7(ii) and Section 8 allow users to provide the Corresponding Source from a network location so long as it is provided at no charge.
I would like to add additional requirements.
Any suggestions for how to do this in ~25 words or less?
I am going to think about this for a bit. I think that sections 5, 7, and 8 could be combined into a single, simpler section focused on a condition of providing the complete and corresponding source whenever you distribute a derived work (and expand the definition of derived work to include object/binary form of a program).
On Mon, Feb 11, 2013 at 11:25:13AM -0500, Joshua Gay wrote:
On 02/08/2013 10:37 PM, Richard Fontana wrote:
On Fri, Feb 08, 2013 at 04:49:29PM -0500, Joshua Gay wrote:
Both Section 7(ii) and Section 8 allow users to provide the Corresponding Source from a network location so long as it is provided at no charge.
I would like to add additional requirements.
Any suggestions for how to do this in ~25 words or less?
I am going to think about this for a bit. I think that sections 5, 7, and 8 could be combined into a single, simpler section focused on a condition of providing the complete and corresponding source whenever you distribute a derived work (and expand the definition of derived work to include object/binary form of a program).
Interesting idea. Assuming you take that further, I'm curious whether you would consider an alteration of the 'Corresponding Source' definition to be necessary.
- RF
copyleft-next@lists.fedorahosted.org