Debian Bug report logs - #815060
RM: nvidia-graphics-modules -- RoQA; Violates kernel license

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Julian Andres Klode <jak@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: RM: nvidia-graphics-modules -- RoQA; Violates kernel license

Date: Thu, 18 Feb 2016 11:28:05 +0100

Package: ftp.debian.org, src:nvidia-graphics-modules
Severity: normal

The nvidia-graphics-modules provides pre-compiled non-free
kernel modules. Several lawyers and people believe this to
be a violation of the GPL license used by the kernel.

This interpretation is consistent with our position on ZFS
modules, which we also ship in source code only.

As such, the work is not distributable and should be
removed from the archive in all suites, ASAP.

-- 
Julian Andres Klode  - Debian Developer, Ubuntu Member

See http://wiki.debian.org/JulianAndresKlode and http://jak-linux.org/.

When replying, only quote what is necessary, and write each reply
directly below the part(s) it pertains to (`inline'). Thank you.

Message #10 received at 815060@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@layer-acht.org>

To: 815060@bugs.debian.org

Cc: 815060-submitter@bugs.debian.org

Subject: citation needed?

Date: Thu, 18 Feb 2016 22:41:02 +0100

[Message part 1 (text/plain, inline)]

control: tags -1 + moreinfo

Hi Julian,

could you please cite those "lawyers and people" or explain their arguments? 
(Not that citing a lawyer neccessarily means anything, but just stating some 
lawyers think something is not even enough to think about removing a package 
from the archive.)

And the ZFS situation is not comparable because that one is about a 
incompatability of two different licences…


cheers,
	Holger

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 815060@bugs.debian.org (full text, mbox, reply):

From: Julian Andres Klode <jak@debian.org>

To: Holger Levsen <holger@layer-acht.org>

Cc: 815060@bugs.debian.org

Subject: Re: Bug#815060: citation needed?

Date: Thu, 18 Feb 2016 23:11:09 +0100

On Thu, Feb 18, 2016 at 10:41:02PM +0100, Holger Levsen wrote:
> control: tags -1 + moreinfo
> 
> Hi Julian,
> 
> could you please cite those "lawyers and people" or explain their arguments? 
> (Not that citing a lawyer neccessarily means anything, but just stating some 
> lawyers think something is not even enough to think about removing a package 
> from the archive.)

I have not done a survey but I don't know anyone disagreeing. Several distributions
were taken down for bundling Nvidia drivers AFAIK, also:

(1) The Conservancy has an active GPL Compliance Project For Linux Developers and
    already supports Christoph's lawsuit against VMWare.

(2) We lead with a bad example by engaging in this dark-grey to black area
    activities

Legal issues prevent me from saying more, but somebody else might want
to step forward.

> And the ZFS situation is not comparable because that one is about a 
> incompatability of two different licences…

In both cases, code of a GPL-incompatible license is linked to GPLed code.

Whether the incompatible license is free or non-free does not make
any difference at all.

-- 
Debian Developer - deb.li/jak | jak-linux.org - free software dev

When replying, only quote what is necessary, and write each reply
directly below the part(s) it pertains to (`inline'). Thank you.

Message #25 received at 815060@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@layer-acht.org>

To: Julian Andres Klode <jak@debian.org>

Cc: 815060@bugs.debian.org

Subject: Re: Bug#815060: citation needed?

Date: Thu, 18 Feb 2016 23:46:00 +0100

[Message part 1 (text/plain, inline)]

Hi,

On Donnerstag, 18. Februar 2016, Julian Andres Klode wrote:
> I have not done a survey but I don't know anyone disagreeing. Several
> distributions were taken down for bundling Nvidia drivers AFAIK,

urls please…

again, vmware is not zfs is not nvidia.

> Legal issues prevent me from saying more, but somebody else might want
> to step forward.

legal issues = you dont want to be accused of spreading FUD? ;)


cheers,
	Holger

[signature.asc (application/pgp-signature, inline)]

Message #30 received at 815060@bugs.debian.org (full text, mbox, reply):

From: Ben Hutchings <ben@decadent.org.uk>

To: Holger Levsen <holger@layer-acht.org>

Cc: 815060@bugs.debian.org, Julian Andres Klode <jak@debian.org>

Subject: Re: citation needed?

Date: Thu, 18 Feb 2016 23:10:26 +0000

[Message part 1 (text/plain, inline)]

On Thu, 18 Feb 2016 22:41:02 +0100 Holger Levsen <holger@layer-acht.org> wrote:
> control: tags -1 + moreinfo
> 
> Hi Julian,
> 
> could you please cite those "lawyers and people" or explain their arguments? 
> (Not that citing a lawyer neccessarily means anything, but just stating some 
> lawyers think something is not even enough to think about removing a package 
> from the archive.)
> 
> And the ZFS situation is not comparable because that one is about a 
> incompatability of two different licences…

It is very much comparable.  The CDDL is a free software licence but it
has different requirements from the GPL and doesn't allow relicensing
to follow the GPL's copyleft provision, so you can't distribute a work
derived from two works under the two licences.  Similarly, the Nvidia
licence says we have no right to source code for, or even the right to
attempt to decompile, the binary blob they provide, and doesn't allow
relicensing either the blob or provided source code to follow the GPL's
copyleft provision.  Once they are combined with a GPL'd work, the
combination is not legally distributable.

As for the idea that the nvidia kernel driver is an independent work:
the part provided as source code uses Linux specific kernel APIs such
as procfs, CPU hotplug notifiers and seq_file, and provides wrappers
for the console_lock and console_unlock functions that can then be
called by the blob.

Ben.

-- 
Ben Hutchings
Once a job is fouled up, anything done to improve it makes it worse.

[signature.asc (application/pgp-signature, inline)]

Message #35 received at 815060@bugs.debian.org (full text, mbox, reply):

From: "Paul R. Tagliamonte" <paultag@gmail.com>

To: Ben Hutchings <ben@decadent.org.uk>, 815060@bugs.debian.org

Cc: Holger Levsen <holger@layer-acht.org>, Julian Andres Klode <jak@debian.org>

Subject: Re: Bug#815060: citation needed?

Date: Thu, 18 Feb 2016 19:12:55 -0500

[Message part 1 (text/plain, inline)]

As a non-ftpmaster decision (feel free to poke an actual master), and 100%
only me, as a human, I agree with everything Ben said.

   Paul
On Feb 18, 2016 6:15 PM, "Ben Hutchings" <ben@decadent.org.uk> wrote:

> On Thu, 18 Feb 2016 22:41:02 +0100 Holger Levsen <holger@layer-acht.org>
> wrote:
> > control: tags -1 + moreinfo
> >
> > Hi Julian,
> >
> > could you please cite those "lawyers and people" or explain their
> arguments?
> > (Not that citing a lawyer neccessarily means anything, but just stating
> some
> > lawyers think something is not even enough to think about removing a
> package
> > from the archive.)
> >
> > And the ZFS situation is not comparable because that one is about a
> > incompatability of two different licences…
>
> It is very much comparable.  The CDDL is a free software licence but it
> has different requirements from the GPL and doesn't allow relicensing
> to follow the GPL's copyleft provision, so you can't distribute a work
> derived from two works under the two licences.  Similarly, the Nvidia
> licence says we have no right to source code for, or even the right to
> attempt to decompile, the binary blob they provide, and doesn't allow
> relicensing either the blob or provided source code to follow the GPL's
> copyleft provision.  Once they are combined with a GPL'd work, the
> combination is not legally distributable.
>
> As for the idea that the nvidia kernel driver is an independent work:
> the part provided as source code uses Linux specific kernel APIs such
> as procfs, CPU hotplug notifiers and seq_file, and provides wrappers
> for the console_lock and console_unlock functions that can then be
> called by the blob.
>
> Ben.
>
> --
> Ben Hutchings
> Once a job is fouled up, anything done to improve it makes it worse.

[Message part 2 (text/html, inline)]

Message #40 received at 815060@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@layer-acht.org>

To: Ben Hutchings <ben@decadent.org.uk>

Cc: 815060@bugs.debian.org, Julian Andres Klode <jak@debian.org>

Subject: Re: citation needed?

Date: Fri, 19 Feb 2016 01:17:18 +0100

[Message part 1 (text/plain, inline)]

control: tags -1 - moreinfo

Hi Ben,

On Freitag, 19. Februar 2016, Ben Hutchings wrote:
> [...]  Similarly, the Nvidia
> licence says we have no right to source code for, or even the right to
> attempt to decompile, the binary blob they provide, and doesn't allow
> relicensing either the blob or provided source code to follow the GPL's
> copyleft provision.  Once they are combined with a GPL'd work, the
> combination is not legally distributable.
> 
> As for the idea that the nvidia kernel driver is an independent work:
> the part provided as source code uses Linux specific kernel APIs such
> as procfs, CPU hotplug notifiers and seq_file, and provides wrappers
> for the console_lock and console_unlock functions that can then be
> called by the blob.

thanks for taking the time to briefly explain the problems at hand.


cheers,
	Holger

[signature.asc (application/pgp-signature, inline)]

Message #47 received at 815060@bugs.debian.org (full text, mbox, reply):

From: "Bradley M. Kuhn" <bkuhn@ebb.org>

To: 815060@bugs.debian.org

Subject: Encouraging removal of nvidia kernel modules from Debian non-free archive.

Date: Sat, 20 Feb 2016 09:34:48 -0800

I'm speaking here as a Debian user and Free Software citizen, although I
cannot deny nor set aside that I have much professional experience with
the issue at hand.  Here is my personal opinion, which I say on behalf
of myself only, not my employer or other orgs I volunteer for (also,
IANAL and TINLA):

First, I think Ben's explanation on the problems are salient.  But, more
importantly and generally, IMO, Debian should err on the side of caution
in these situations.  Until a few days ago, I had no idea that Debian
*ever* shipped (even in non-free, which admittedly I don't use ;),
GPL-incompatible .ko files like these.  I think ever doing so is just a
mistake because the risk is more than Debian should want to take.

The politics of GPL-incompatible Linux modules is heated, and there are
admittedly different opinions about the issue.  You can probably guess
my opinion and belief.  But, I don't think it behooves Debian to place
itself in the middle of that debate and take on risk, merely to ship
something that is known to be at *best* non-free.  Now that Ben, a
copyright holder in Linux, has come forward to say he believes
distribution of these modules in Debian is a GPL violation, I think
Debian must respect his wishes and remove the modules from the archive.
-- 
   -- bkuhn

Message #52 received at 815060@bugs.debian.org (full text, mbox, reply):

From: Stefano Zacchiroli <zack@debian.org>

To: 815060@bugs.debian.org

Subject: Re: Bug#815060: Encouraging removal of nvidia kernel modules from Debian non-free archive.

Date: Sat, 20 Feb 2016 22:02:59 +0100

[Message part 1 (text/plain, inline)]

On Sat, Feb 20, 2016 at 09:34:48AM -0800, Bradley M. Kuhn wrote:
> I'm speaking here as a Debian user and Free Software citizen, although I
> First, I think Ben's explanation on the problems are salient.  But, more
> importantly and generally, IMO, Debian should err on the side of caution
> in these situations.

FWIW I agree with this.

And, to follow-up onto Holger's reasonable "[citation needed]" request,
I don't think that legal advice, or legal opinions in general, should be
the primary input that Debian uses to decide on this specific matter.

There are expert FOSS lawyers that consider proprietary Linux kernel
modules to be GPL violations in a number of circumstances, and others
with opposed views. And there are no relevant legal ruling yet AFAIK.

What is certain however is that a significant amount of Linux kernel
developers do consider proprietary modules like the nvidia one to be GPL
violations that infringe on their copyrights. Those developers
contribute code to the Linux kernel considering that 3rd party modules
should be released as Free Software too. Some of them also put money and
energies into fighting those who try to get away with proprietary
modules, free riding on their work.

Morally, I've no doubt on which side of those fights Debian should be.
And by distributing proprietary modules we are not helping our fellow
Free Software developers, quite the contrary.  But even putting moral
considerations aside for a moment, Debian should not be in the political
position of being cross with Linux kernel developers on the ground of
alleged copyright infringement. The political/legal Free Software
battleground is already enough of a mess; we should not contribute to
make it worse by risking community infights.

Especially when there is a technical alternative that provides an almost
identical user experience for Debian users who need nvidia.ko: a
downloader/installer package like nvidia-graphics-drivers used to be
many years ago [1,2].

Cheers.

[1]: http://sources.debian.net/src/nvidia-graphics-drivers/1.0.7174-3/debian/changelog/#L352-L354
[2]: http://sources.debian.net/src/nvidia-kernel-src/1.0.2880-1/debian/changelog/
-- 
Stefano Zacchiroli  . . . . . . .  zack@upsilon.cc . . . . o . . . o . o
Maître de conférences . . . . . http://upsilon.cc/zack . . . o . . . o o
Former Debian Project Leader . . . . . @zacchiro . . . . o o o . . . o .
« the first rule of tautology club is the first rule of tautology club »

[signature.asc (application/pgp-signature, inline)]

Message #57 received at 815060@bugs.debian.org (full text, mbox, reply):

From: Julian Andres Klode <jak@debian.org>

To: Stefano Zacchiroli <zack@debian.org>, 815060@bugs.debian.org

Subject: Re: Bug#815060: Encouraging removal of nvidia kernel modules from Debian non-free archive.

Date: Sat, 20 Feb 2016 22:46:21 +0100

On Sat, Feb 20, 2016 at 10:02:59PM +0100, Stefano Zacchiroli wrote:
> Especially when there is a technical alternative that provides an almost
> identical user experience for Debian users who need nvidia.ko: a
> downloader/installer package like nvidia-graphics-drivers used to be
> many years ago [1,2].

We already provide -dkms and -source packages as well, so users can
build these (nondistributable) modules themselves just fine. 

-- 
Debian Developer - deb.li/jak | jak-linux.org - free software dev

When replying, only quote what is necessary, and write each reply
directly below the part(s) it pertains to (`inline'). Thank you.

Message #62 received at 815060@bugs.debian.org (full text, mbox, reply):

From: Andreas Beckmann <anbe@debian.org>

To: 815060@bugs.debian.org

Cc: Stefano Zacchiroli <zack@debian.org>, Ben Hutchings <ben@decadent.org.uk>, "Bradley M. Kuhn" <bkuhn@ebb.org>, Julian Andres Klode <jak@debian.org>, Holger Levsen <holger@layer-acht.org>, "Paul R. Tagliamonte" <paultag@gmail.com>

Subject: Re: Bug#815060: Encouraging removal of nvidia kernel modules from Debian non-free archive.

Date: Mon, 22 Feb 2016 03:25:32 +0100

Control: reassign -1 ftp.debian.org
Control: clone -1 -2 -3
Control: reassign -2 release.debian.org
Control: tag -2 jessie
Control: retitle -2 RM: nvidia-graphics-modules/340.96+3.16.0+1
Control: reassign -3 release.debian.org
Control: tag -3 wheezy
Control: retitle -3 RM: nvidia-graphics-modules/304.131+3.2.0+1

Hi all,

thanks for your reasoning.

Bye-bye prebuilt modules.


Andreas

Message #71 received at 815060-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 815060-close@bugs.debian.org

Cc: nvidia-graphics-modules@packages.debian.org, nvidia-graphics-modules@packages.qa.debian.org

Subject: Bug#815060: Removed package(s) from unstable

Date: Sat, 27 Feb 2016 00:48:46 +0000

We believe that the bug you reported is now fixed; the following
package(s) have been removed from unstable:

nvidia-graphics-modules | 352.79+4.3.0+1 | source
nvidia-kernel-4.3.0-1-686 | 352.79+1+1+4.3.3-7 | i386
nvidia-kernel-4.3.0-1-686-pae | 352.79+1+1+4.3.3-7 | i386
nvidia-kernel-4.3.0-1-amd64 | 352.79+1+1+4.3.3-7 | amd64
nvidia-kernel-586 | 352.79+4.3.0+1 | i386
nvidia-kernel-686 | 352.79+4.3.0+1 | i386
nvidia-kernel-686-pae | 352.79+4.3.0+1 | i386
nvidia-kernel-amd64 | 352.79+4.3.0+1 | amd64
nvidia-kernel-dummy | 352.79+4.3.0+1 | amd64

------------------- Reason -------------------
RoQA; Violates kernel license
----------------------------------------------

Note that the package(s) have simply been removed from the tag
database and may (or may not) still be in the pool; this is not a bug.
The package(s) will be physically removed automatically when no suite
references them (and in the case of source, when no binary references
it).  Please also remember that the changes have been done on the
master archive and will not propagate to any mirrors until the next
dinstall run at the earliest.

Packages are usually not removed from testing by hand. Testing tracks
unstable and will automatically remove packages which were removed
from unstable when removing them from testing causes no dependency
problems. The release team can force a removal from testing if it is
really needed, please contact them if this should be the case.

We try to close bugs which have been reported against this package
automatically. But please check all old bugs, if they were closed
correctly or should have been re-assigned to another package.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 815060@bugs.debian.org.

The full log for this bug can be viewed at https://bugs.debian.org/815060

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Paul Richards Tagliamonte (the ftpmaster behind the curtain)

Send a report that this bug log contains spam.