Debian Bug report logs - #583758
libvpx license is GPL incompatible

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Reinhard Tartler <siretart@tauware.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: gstreamer0.10-plugins-bad: linking against libvpx makes package unredistributable

Date: Sun, 30 May 2010 15:01:32 +0200

Package: gstreamer0.10-plugins-bad
Version: 0.10.18.3-2
Severity: serious

From the changelog:

 gst-plugins-bad0.10 (0.10.18.3-2) unstable; urgency=low
 .
   * debian/build-deps.in,
     debian/gstreamer-plugins-bad.install:
     + Enable and ship the VP8 encoder/decoder plugin.

Quoting from its copyright statement:

http://packages.debian.org/changelogs/pool/main/g/gst-plugins-bad0.10/gst-plugins-bad0.10_0.10.18.3-2/gstreamer0.10-plugins-bad.copyright

,----
| Copyright:
| 
|     This package is free software; you can redistribute it and/or
|     modify it under the terms of the GNU Lesser General Public
|     License as published by the Free Software Foundation; either
|     version 2 of the License, or (at your option) any later version.
`----

However, libvpx copyright:

http://packages.debian.org/changelogs/pool/main/libv/libvpx/libvpx_0.9.0-5/libvpx0.copyright

,----
| License:
| 
|   For everything not listed below:
|     All rights reserved.
| 
|     Redistribution and use in source and binary forms, with or without
|     modification, are permitted provided that the following conditions
|     are met:
| 
|     - Redistributions of source code must retain the above copyright
|       notice, this list of conditions and the following disclaimer.
| 
|     - Redistributions in binary form must reproduce the above
|       copyright notice, this list of conditions and the following
|       disclaimer in the documentation and/or other materials provided
|       with the distribution.
| 
|     - Neither the name of Google nor the names of its contributors may
|       be used to endorse or promote products derived from this software
|       without specific prior written permission.
| 
|     THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|     "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|     LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|     FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|     COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|     INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|     BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|     LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|     CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|     LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|     ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|     POSSIBILITY OF SUCH DAMAGE.
|  
|     Subject to the terms and conditions of the above License, Google
|     hereby grants to You a perpetual, worldwide, non-exclusive,
|     no-charge, royalty-free, irrevocable (except as stated in this
|     section) patent license to make, have made, use, offer to sell,
|     sell, import, and otherwise transfer this implementation of VP8,
|     where such license applies only to those patent claims, both
|     currently owned by Google and acquired in the future, licensable by
|     Google that are necessarily infringed by this implementation of
|     VP8. If You or your agent or exclusive licensee institute or order
|     or agree to the institution of patent litigation against any entity
|     (including a cross-claim or counterclaim in a lawsuit) alleging that
|     this implementation of VP8 or any code incorporated within this
|     implementation of VP8 constitutes direct or contributory patent
|     infringement, or inducement of patent infringement, then any rights
|     granted to You under this License for this implementation of VP8
|     shall terminate as of the date such litigation is filed.
`----

These additional restrictions are additional restrictions imposed on the
gstreamer package, which is forbidden by LGPL §10.

This license incompatibility has been confirmed by:

 techrights: http://techrights.org/2010/05/29/chris-dibona-on-webm-osi/
 vlc: http://mailman.videolan.org/pipermail/vlc-devel/2010-May/075102.html
 ffmpeg: http://permalink.gmane.org/gmane.comp.video.ffmpeg.cvs/30501

Please revert this upload at your earliest convenience.

-- System Information:
Debian Release: 5.0.4
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (x86_64)

Kernel: Linux 2.6.32.11-gernoth-64bit (SMP w/4 CPU cores)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/bash

Message #10 received at 583758@bugs.debian.org (full text, mbox, reply):

From: Sebastian Dröge <slomo@circular-chaos.org>

To: Reinhard Tartler <siretart@tauware.de>, 583758@bugs.debian.org

Subject: Re: Bug#583758: gstreamer0.10-plugins-bad: linking against libvpx makes package unredistributable

Date: Sun, 30 May 2010 17:45:57 +0200

[Message part 1 (text/plain, inline)]

On Sun, 2010-05-30 at 15:01 +0200, Reinhard Tartler wrote:
> Package: gstreamer0.10-plugins-bad
> Version: 0.10.18.3-2
> Severity: serious
> 
> From the changelog:
> 
>  gst-plugins-bad0.10 (0.10.18.3-2) unstable; urgency=low
>  .
>    * debian/build-deps.in,
>      debian/gstreamer-plugins-bad.install:
>      + Enable and ship the VP8 encoder/decoder plugin.
> 
> Quoting from its copyright statement:
> 
> http://packages.debian.org/changelogs/pool/main/g/gst-plugins-bad0.10/gst-plugins-bad0.10_0.10.18.3-2/gstreamer0.10-plugins-bad.copyright
> 
> ,----
> | Copyright:
> | 
> |     This package is free software; you can redistribute it and/or
> |     modify it under the terms of the GNU Lesser General Public
> |     License as published by the Free Software Foundation; either
> |     version 2 of the License, or (at your option) any later version.
> `----
> 
> However, libvpx copyright:
> 
> http://packages.debian.org/changelogs/pool/main/libv/libvpx/libvpx_0.9.0-5/libvpx0.copyright
> 
> ,----
> | License:
> | 
> |   For everything not listed below:
> |     All rights reserved.
> | 
> |     Redistribution and use in source and binary forms, with or without
> |     modification, are permitted provided that the following conditions
> |     are met:
> | 
> |     - Redistributions of source code must retain the above copyright
> |       notice, this list of conditions and the following disclaimer.
> | 
> |     - Redistributions in binary form must reproduce the above
> |       copyright notice, this list of conditions and the following
> |       disclaimer in the documentation and/or other materials provided
> |       with the distribution.
> | 
> |     - Neither the name of Google nor the names of its contributors may
> |       be used to endorse or promote products derived from this software
> |       without specific prior written permission.
> | 
> |     THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
> |     "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
> |     LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
> |     FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
> |     COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
> |     INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
> |     BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
> |     LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
> |     CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
> |     LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
> |     ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
> |     POSSIBILITY OF SUCH DAMAGE.
> |  
> |     Subject to the terms and conditions of the above License, Google
> |     hereby grants to You a perpetual, worldwide, non-exclusive,
> |     no-charge, royalty-free, irrevocable (except as stated in this
> |     section) patent license to make, have made, use, offer to sell,
> |     sell, import, and otherwise transfer this implementation of VP8,
> |     where such license applies only to those patent claims, both
> |     currently owned by Google and acquired in the future, licensable by
> |     Google that are necessarily infringed by this implementation of
> |     VP8. If You or your agent or exclusive licensee institute or order
> |     or agree to the institution of patent litigation against any entity
> |     (including a cross-claim or counterclaim in a lawsuit) alleging that
> |     this implementation of VP8 or any code incorporated within this
> |     implementation of VP8 constitutes direct or contributory patent
> |     infringement, or inducement of patent infringement, then any rights
> |     granted to You under this License for this implementation of VP8
> |     shall terminate as of the date such litigation is filed.
> `----
> 
> These additional restrictions are additional restrictions imposed on the
> gstreamer package, which is forbidden by LGPL §10.

I'm not 100% sure that your analysis is correct. First of all, note that
the situation in gst-plugins-bad is as follows: there's a small plugin
that links to libvpx. It's all in the libgstvp8.so file. The plugin code
is LGPL and it's only loaded at runtime if necessary (and I agree that
GPL applications must not load it but that's their problem. LGPL
applications or applications with totem's exception clause are fine).

Now, if someone sues someone because of patents that relate to VP8 he
would loose the right to use or distribute libvpx. Fine. He wouldn't
loose the right to modify, distribute, etc the GStreamer VP8 plugin
though, he just can't use or distribute it together with libvpx anymore.
For example he could take the plugin sources and create a new GStreamer
plugin from it, that decodes Theora videos with libtheora.

The LGPL talks about "this library", and "this library" libgstvp8.so is
not related to libvpx in a way that adds additional restrictions to
libgstvp8.so.


I'll keep this bug open and at this severity to let other people allow
to discuss this problem and prevent testing migration a bit until we
found a conclusion.


(Just for the record, if necessary I, as copyright holder of the VP8
plugin sources, would be fine with licensing the VP8 plugin under a BSD
license. And I guess the single other copyright holder would be fine
with this too. Then there really shouldn't be anything to discuss here
anymore... but as said above, I don't think this is necessary)

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 583758@bugs.debian.org (full text, mbox, reply):

From: Loïc Minier <lool@dooz.org>

To: Reinhard Tartler <siretart@tauware.de>, 583758@bugs.debian.org

Subject: Re: Bug#583758: gstreamer0.10-plugins-bad: linking against libvpx makes package unredistributable

Date: Mon, 31 May 2010 10:03:49 +0200

On Sun, May 30, 2010, Reinhard Tartler wrote:
> |     Redistribution and use in source and binary forms, with or without
> |     modification, are permitted provided that the following conditions
> |     are met:
> |     - Redistributions of source code must retain the above copyright
> |       notice, this list of conditions and the following disclaimer.
> |     - Redistributions in binary form must reproduce the above
> |       copyright notice, this list of conditions and the following
> |       disclaimer in the documentation and/or other materials provided
> |       with the distribution.

 That's ok, we always comply with these terms per Debian policy.

> |     - Neither the name of Google nor the names of its contributors may
> |       be used to endorse or promote products derived from this software
> |       without specific prior written permission.

 That's an acceptable limitation, you would fall under trademark anyway

> |     THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
> |     "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
> |     LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
> |     FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
> |     COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
> |     INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
> |     BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
> |     LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
> |     CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
> |     LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
> |     ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
> |     POSSIBILITY OF SUCH DAMAGE.

 Usual disclaimer

> |     Subject to the terms and conditions of the above License, Google
> |     hereby grants to You a perpetual, worldwide, non-exclusive,
> |     no-charge, royalty-free, irrevocable (except as stated in this
> |     section) patent license to make, have made, use, offer to sell,
> |     sell, import, and otherwise transfer this implementation of VP8,
> |     where such license applies only to those patent claims, both
> |     currently owned by Google and acquired in the future, licensable by
> |     Google that are necessarily infringed by this implementation of
> |     VP8. If You or your agent or exclusive licensee institute or order
> |     or agree to the institution of patent litigation against any entity
> |     (including a cross-claim or counterclaim in a lawsuit) alleging that
> |     this implementation of VP8 or any code incorporated within this
> |     implementation of VP8 constitutes direct or contributory patent
> |     infringement, or inducement of patent infringement, then any rights
> |     granted to You under this License for this implementation of VP8
> |     shall terminate as of the date such litigation is filed.

 So basically the problem is with this patents section.  In Debian, my
 understanding is that we dont really consider software patents of any
 interest unless there's active enforcement of some patents because it
 would put the ftpmasters or the mirror admins at risk.  We mostly
 weight the risk of including patented code rather than the implications
 for patents in licenses.

 My personal recommendation would be to ask ftpmasters whether they see
 any patent risk with the VP8 bits (I think not since we have libvpx)
 and whether they mind the mixture of LGPL with patents-legalese.

On Sun, May 30, 2010, Sebastian Dröge wrote:
> (Just for the record, if necessary I, as copyright holder of the VP8
> plugin sources, would be fine with licensing the VP8 plugin under a BSD
> license. And I guess the single other copyright holder would be fine
> with this too. Then there really shouldn't be anything to discuss here
> anymore... but as said above, I don't think this is necessary)

 Relicensing would make matters simpler and would probably void this
 discussion.

   Cheers,
-- 
Loïc Minier

Message #20 received at 583758@bugs.debian.org (full text, mbox, reply):

From: Sebastian Dröge <slomo@circular-chaos.org>

To: Loïc Minier <lool@dooz.org>, 583758@bugs.debian.org, control@bugs.debian.org

Cc: Reinhard Tartler <siretart@tauware.de>

Subject: Re: Bug#583758: gstreamer0.10-plugins-bad: linking against libvpx makes package unredistributable

Date: Fri, 04 Jun 2010 06:14:38 +0200

[Message part 1 (text/plain, inline)]

severity 583758 important
thanks

Ok, after some further thoughts I'm lowering the severity of this to
important. IMO the patent license is definitely not incompatible with
the GPLv3 and LGPLv3 and the GStreamer license is LGPLv2 or any later
version.

Reason for this is, that everybody seems to agree that the (L)GPLv3 is
compatible with the Apache License 2.0, which has a very similar, but
slightly stricter (because of "each Contributor" instead of only
Google), patent license paragraph:

> 3. Grant of Patent License. Subject to the terms and conditions of
> this License, each Contributor hereby grants to You a perpetual,
> worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except
> as stated in this section) patent license to make, have made, use,
> offer to sell, sell, import, and otherwise transfer the Work, where
> such license applies only to those patent claims licensable by such
> Contributor that are necessarily infringed by their Contribution(s)
> alone or by combination of their Contribution(s) with the Work to
> which such Contribution(s) was submitted. If You institute patent
> litigation against any entity (including a cross-claim or counterclaim
> in a lawsuit) alleging that the Work or a Contribution incorporated
> within the Work constitutes direct or contributory patent
> infringement, then any patent licenses granted to You under this
> License for that Work shall terminate as of the date such litigation
> is filed.


I'm keeping the severity at important because GPLv2 incompatibility is
still a problem. There are some GPLv2-only packages out there
unfortunately, but this is not really a new problem.

[signature.asc (application/pgp-signature, inline)]

Message #27 received at 583758-close@bugs.debian.org (full text, mbox, reply):

From: Sebastian Dröge <slomo@debian.org>

To: 583758-close@bugs.debian.org

Subject: Bug#583758: fixed in libvpx 0.9.0-6

Date: Fri, 04 Jun 2010 21:50:03 +0000

Source: libvpx
Source-Version: 0.9.0-6

We believe that the bug you reported is fixed in the latest version of
libvpx, which is due to be installed in the Debian FTP archive:

libvpx-dev_0.9.0-6_amd64.deb
  to main/libv/libvpx/libvpx-dev_0.9.0-6_amd64.deb
libvpx-doc_0.9.0-6_all.deb
  to main/libv/libvpx/libvpx-doc_0.9.0-6_all.deb
libvpx0-dbg_0.9.0-6_amd64.deb
  to main/libv/libvpx/libvpx0-dbg_0.9.0-6_amd64.deb
libvpx0_0.9.0-6_amd64.deb
  to main/libv/libvpx/libvpx0_0.9.0-6_amd64.deb
libvpx_0.9.0-6.debian.tar.gz
  to main/libv/libvpx/libvpx_0.9.0-6.debian.tar.gz
libvpx_0.9.0-6.dsc
  to main/libv/libvpx/libvpx_0.9.0-6.dsc



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 583758@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sebastian Dröge <slomo@debian.org> (supplier of updated libvpx package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Fri, 04 Jun 2010 22:34:15 +0200
Source: libvpx
Binary: libvpx-dev libvpx0 libvpx0-dbg libvpx-doc
Architecture: source all amd64
Version: 0.9.0-6
Distribution: unstable
Urgency: low
Maintainer: Sebastian Dröge <slomo@debian.org>
Changed-By: Sebastian Dröge <slomo@debian.org>
Description: 
 libvpx-dev - VP8 video codec (development files)
 libvpx-doc - VP8 video codec (API documentation)
 libvpx0    - VP8 video codec (shared library)
 libvpx0-dbg - VP8 video codec (debugging symbols)
Closes: 583758
Changes: 
 libvpx (0.9.0-6) unstable; urgency=low
 .
   * debian/patches/*:
     + Update to upstream GIT 09202d80716ef7e2931de60c66b6fb2383f52613.
   * debian/copyright:
     + Update for the new, improved and GPL compatible
       license (Closes: #583758).
Checksums-Sha1: 
 ae161ae1a70c4ddf226fac634db3146f74764354 1158 libvpx_0.9.0-6.dsc
 e5ce11050c3838143fced77c0b3215bbb27f781d 140903 libvpx_0.9.0-6.debian.tar.gz
 5176443ed5949607a48d561fcd994524cac36bab 226782 libvpx-doc_0.9.0-6_all.deb
 f5ebd5bdb4f8af76423361ca6fd53810cb493fd4 306682 libvpx-dev_0.9.0-6_amd64.deb
 b9df7f62e13fb3b16596762626f40a51b7e57120 236700 libvpx0_0.9.0-6_amd64.deb
 f4d023bb65b8516e35e70c8f244a4a0ce59ced40 502514 libvpx0-dbg_0.9.0-6_amd64.deb
Checksums-Sha256: 
 f18307ae4ef2d065aca53f08700a08af6447b76788e0b5c81dfa22cba0d8ae2d 1158 libvpx_0.9.0-6.dsc
 72062a36dbca4d0b4b4fce2ec021eb5b9f65be42df7f3166696a9bed77b35841 140903 libvpx_0.9.0-6.debian.tar.gz
 2ed43043dca38dd346dd65920dae32506faf3a48131c59818c2fcb1239a14db0 226782 libvpx-doc_0.9.0-6_all.deb
 87883bec566569356305cda9e8d20f2d5cf34900bb41440f15c47feb291c84c3 306682 libvpx-dev_0.9.0-6_amd64.deb
 d43ce029d589e0cf63d55ee8029af8b1a3bea908412e5f9bd5c48035e03fb7f2 236700 libvpx0_0.9.0-6_amd64.deb
 c0dcaf76d62d6859c77de626c541c1bde5e88a4b93b7eeaef96b3a4318f35a88 502514 libvpx0-dbg_0.9.0-6_amd64.deb
Files: 
 aa5f3ec8cfe618281c94e9dd32243587 1158 video optional libvpx_0.9.0-6.dsc
 56ac8612f4312aeef22e9e53773597a5 140903 video optional libvpx_0.9.0-6.debian.tar.gz
 0510b640b1a470d987c186c2dbf83561 226782 doc optional libvpx-doc_0.9.0-6_all.deb
 5735fe7fb54e15b5a969b5abcda37419 306682 libdevel optional libvpx-dev_0.9.0-6_amd64.deb
 3f1e078a69985fc7d66b107b8fdd2b0c 236700 libs optional libvpx0_0.9.0-6_amd64.deb
 f39dcb7aba754583aeb9ff0eae21ab30 502514 debug extra libvpx0-dbg_0.9.0-6_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkwJZc4ACgkQBsBdh1vkHyF1CgCgie6LBrLfgE3QEK5d/5Sk+sdJ
keQAnRevbr9/+2lyeI8L/RPhLW+U9kXH
=KOhT
-----END PGP SIGNATURE-----

Message #52 received at 583758-done@bugs.debian.org (full text, mbox, reply):

From: Sebastian Dröge <slomo@circular-chaos.org>

To: 583758-done@bugs.debian.org

Subject: Re: libvpx license is GPL incompatible

Date: Sun, 06 Jun 2010 10:23:18 +0200

[Message part 1 (text/plain, inline)]

This can be closed now...

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.