[personal profile] mjg59
There was another upsurge in discussion of Android GPL issues last month, triggered by couple of posts by Edward Naughton, followed by another by Florian Mueller. The central thrust is that section 4 of GPLv2 terminates your license on violation, and you need the copyright holders to grant you a new one. If they don't then you don't get to distribute any more copies of the code, even if you've now come into compliance. TLDR; most Android vendors are no longer permitted to distribute Linux.

I'll get to that shortly. There's a few other issues that could do with some clarification. The first is Naughton's insinuation that Google are violating the GPL due to Honeycomb being closed or their "license washing" of some headers. There's no evidence whatsoever that Google have failed to fulfil their GPL obligations in terms of providing source to anyone who received GPL-covered binaries from them. If anyone has some, please do get in touch. Some vendors do appear to be unwilling to hand over code for GPLed bits of Honeycomb. That's an issue with the vendors, not Google.

His second point is more interesting, but the summary is "Google took some GPLed header files and relicensed them under Apache 2.0, and they've taken some other people's GPLv2 code and put it under Apache 2.0 as well". As far as the headers go, there's probably not much to see here. The intent was to produce a set of headers for the C library by taking the kernel headers and removing the kernel-only components. The majority of what's left is just structure definitions and function prototypes, and is almost certainly not copyrightable. And remember that these are the headers that are distributed with the kernel and intended for consumption by userspace. If any of the remaining macros or inline functions are genuinely covered by the GPLv2, any userspace application including them would end up a derived work. This is clearly not the intention of the authors of the code. The risk to Google here is indistinguishable from zero.

How about the repurposing of other code? Naughton's most explicit description is:

For example, Android uses “bootcharting” logic, which uses “the 'bootchartd' script provided by www.bootchart.org, but a C re-implementation that is directly compiled into our init program.” The license that appears at www.bootchart.org is the GPLv2, not the Apache 2.0 license that Google claims for its implementation.

, but there's no indication that Google's reimplementation is a derived work of the GPLv2 original.

In summary: No sign that Google's violating the GPL.

Florian's post appears to be pretty much factually correct, other than this bit discussing the SFLC/Best Buy case:

I personally believe that intellectual property rights should usually be enforced against infringing publishers/manufacturers rather than mere resellers, but that's a separate issue.

The case in question was filed against Best Buy because Best Buy were manufacturing infringing devices. It was a set of own-brand Blu Ray players that incorporated Busybox. Best Buy were not a mere reseller.

Anyway. Back to the original point. Nobody appears to disagree that section 4 of the GPLv2 means that violating the license results in total termination of the license. The disagreement is over what happens next. Armijn Hemel, who has done various work on helping companies get back into compliance, believes that simply downloading a new copy of the code will result in a new license being granted, and that he's received legal advice that supports that. Bradley Kuhn disagrees. And the FSF seem to be on his side.

The relevant language in v2 is:

You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License.

The relevant language in v3 is:

You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License

which is awfully similar. However, v3 follows that up with:

However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.

In other words, with v3 you get your license back providing you're in compliance. This doesn't mesh too well with the assumption that you can get a new license by downloading a new copy of the software. It seems pretty clear that the intent of GPLv2 was that the license termination was final and required explicit reinstatement.

So whose interpretation is correct? At this point we really don't know - the only people who've tried to use this aspect of the GPL are the SFLC, and as part of their settlements they've always reinstated permission to distribute Busybox. There's no clear legal precedent. Which makes things a little awkward.

It's not possible to absolutely say that many Android distributors no longer have the right to distribute Linux. But nor is it possible to absolutely say that they haven't lost that right. Any sufficiently motivated kernel copyright holder probably could engage in a pretty effective shakedown racket against Android vendors. Whether they will do remains to be seen, but honestly if I were an Android vendor I'd be worried. There's plenty of people out there who hold copyright over significant parts of the kernel. Would you really bet on all of them being individuals of extreme virtue?

Date: 2011-09-01 10:23 pm (UTC)
From: [identity profile] http://users.livejournal.com/joshua_/
Would you really bet on all of them being individuals of extreme virtue?


I would.

I have been calling for kernel developers who are willing to threaten HTC for almost a year now, and as far as I can tell, nobody cares enough to do it. In the mean time, the community is forced to wait three months or reimplement support for new devices -- either of which are a substantial setback to competing implementations of Android (i.e, CyanogenMod).

Should one bet on it? No. Does HTC bet on it? Yes... and sadly, they keep winning.
From: (Anonymous)
If you are right about the above then this should worry anyone distributing the Linux kernel as one slip up could tie you up in a legal quagmire...

Thanks for writing this.

Date: 2011-09-02 12:34 pm (UTC)
From: (Anonymous)
(Sorry I don't have an appropriate OpenID account handy to use, and I don't have a dreamwidth.org account creation code. This is Bradley M. Kuhn writing.)

Matthew, first, thank you so much for writing this blog post. I'm always very appreciative of Linux developers who want to do something about GPL enforcement.

Second, I think you've framed this issue well. As you know, I've asked those who support this "magic rights restoration" theory to produce the court case and/or law journal argue they are relying on regarding their GPLv2 Section 4 restoration theory. I'd love to read it if/when they provide it.

For my part, I've been doing GPL enforcement successfully for more than a decade, and every lawyer I've ever worked with in the USA has indicated that the traditional FSF interpretation on this issue is correct. IANAL, but as I understand it, copyright law is pretty straightforward in the USA: you need a license to copy, modify or distribute. If you lose your license, only the copyright holder can give you a new license.

In fact, in 12 years of enforcement in the USA and hundreds of GPL enforcement matters, I've never have a GPL violator disagree with this interpretation. In fact, in my enforcement efforts on behalf of various BusyBox copyright holders, we often use GPLv2 Section 4 to say: "Well, we won't give you back a license to our copyrights unless you come into compliance on Linux and other GPL'd software as well". Nothing in GPL other than Section 4 allows us to hold up such a requirement. And, you'll find that we've been very successful on this.

Violations are abound, as other commentors note. I'm fond of saying my queued list of violations is greater than 300, and FSF and Conservancy, the only two non-profits currently engaged in GPL enforcement on behalf of the community, have limited resources to pursue more violations.

Finally, please note that some folks who support this GPLv2 Section 4 "magic rights restoration" theory actually consult for GPL violators and help them when they are sued by organizations like Conservancy. Obviously the "magic rights restoration" theory is valuable to violators, so I'm not surprised that violators' advocates support it.

Thanks for the analysis.

Date: 2011-09-02 05:04 pm (UTC)
From: (Anonymous)
(Apologies -- I don't have a dreamwidth.org account creation code. This is Edward J. Naughton writing.)



Matthew, thanks for noticing my posts and for sharing your insights. I've got a few quick comments.

First, on whether Google and its Android OEMs are in compliance with the obligation in GPLv2 to provide Corresponding Source: It's true, as I noted in my post, that Google has made some GPL'd code available on the AOSP, but when the code was released it came with the caveat that it won't "work on actual hardware." (See http://groups.google.com/group/android-building/browse_thread/thread/6a3b3a1c225a11f5/6410b44798c19d61?#6410b44798c19d61) That's not Corresponding Source in accordance with the GPLv2: "The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable." And, of course, a number of Android device makers and distributors haven't provided even this much.

I think your ultimate conclusion is correct: Android distributors should be concerned about their noncompliance. But I don't think it's fair to suggest that any copyright holder or user who complains about the noncompliance or takes action to enforce the GPL lacks virtue or is engaged in a shakedown. Aren't they just holding Google or the Android distributor to the terms under which they got the code?

Thanks again.

Edward J. Naughton

Date: 2011-09-02 05:17 pm (UTC)
From: [identity profile] printf.net
There's plenty of people out there who hold copyright over significant parts of the kernel. Would you really bet on all of them being individuals of extreme virtue?

"And if you think your answer's yes, I can send you links to kernel code that might change your mind.."

Bizarre

Date: 2011-09-04 07:38 am (UTC)
From: (Anonymous)
Permanent license termination is a pretty bizarre interpretation of the GPL, as I see it. I've written a lot of GPL code and it never occurred to me that that was even a possible interpretation. It seemed obvious that you got a new license if you were in compliance.

It is kind of odd to think that you don't. Let's say that that is the case - you violate the GPL, then return to compliance, and you no longer have a license. Let's even say that if you download another copy, that doesn't give you another license. But what about if a new version of the software comes out - does the lack of license somehow persist? Taking it further, let's say that someone else forks that project, and you download that - do you not have a license there? Or if someone else uses a small part of the original project in some other project - can you never use that new project? All of this is quite ridiculous, and goes entirely against the spirit of the GPL.

The reasonable interpretation is that you lose your license if you violate the terms. But anyone can get a new license for that code at any time. That's what the license says. As long as you are in violation, though, any new license would be immediately terminated. But once you return to compliance, all is good.

P.S. That the GPL3 clarifies this doesn't mean that it was a problem with GPL2. Just that it is worth clarifying the original intent. The same is true for several other clarifications in the GPL3.

- kripken

Date: 2011-09-04 07:58 am (UTC)
From: (Anonymous)
Besides people, there are lots of corporations which hold copyright over significant parts of the kernel, including some which have already shown a willingness to file lawsuits against Android makers (Oracle and now Microsoft for instance, though Android devices are not likely to include btrfs or Hyper-V drivers).

bootchartd claim is bogus

Date: 2011-10-20 02:08 pm (UTC)
From: (Anonymous)
I'm not sure how many people actually looked into the bootchartd claim, but its bogus. The original was a script and the new version is a binary. It was a reimplementation that was discussed and shared in public. The only issue with it is an unfortunate comment that can easily be misinterpreted. I only know this because I too was upset about it and wanted to find the history of it before complaining too loud. In the end, it wasn't relicensed, it was rewritten. Anyone who digs up the history of the issue will come to the same conclusion.

Profile

Matthew Garrett

About Matthew

Power management, mobile and firmware developer on Linux. Security developer at Nebula. Member of the Linux Foundation Technical Advisory Board. Ex-biologist. @mjg59 on Twitter. Content here should not be interpreted as the opinion of my employer.

Expand Cut Tags

No cut tags