Re: AdaCore ... the Next SCO?

["Ludovic Brenta" <ludovic@ludovic-brenta.org>]

Michael Bode a écrit :
> And even if you find the actual rights holder (and you/he/someone can
> prove he really is the actual rights holder) he might be believing in
> the FSF interpretation and tell you to look into the headers, because
> that's were he wrote the license.

If he says "look in the headers", that is a valid response provided he
knows exactly what the headers contain *in your copy of the software*.
If he doesn't know (i.e. if your copy is not crypto-signed with his
key), then that's equivalent to giving you blanket approval to do
whatever you want.  If he says "GPL", then it's GPL.

The reasons why the headers have no legal force, and for the blanket
approval above, according to Robert Dewar at FOSDEM 2006, are:
- because anyone besides the copyright holder may have changed them in
the software.
- because license terms can change with the weather, or be different
for each licensee. They can even change after a licensee has had a
license for some time.

This is true of all software, free or proprietary, cost or no cost. So
basically, the user needs assurance about two things: who the copyright
holder really is, and what license terms are applicable at any given
point in time and for this particular licensee.

To give proper assurance on both accounts, I think that the copyright
holder should crypto-sign his software, and grant a perpetual,
non-revokable, immutable license to everyone. Unfortunately, the GPL
(GNAT-modified or not) is revokable and mutable (think "or any later
version"), so it is possible that it not apply to all licensees.

Debian crypto-signs all software it carries, but that doesn't make it
the copyright holder, and does not guarantee that the license terms
shipped with the software are really applicable. It only guarantees who
did the packaging, and suggests that the Debian maintainer has done his
best. The final authority is the copyright holder.

In the case of AdaCore, there is past evidence that suggests, but does
not prove for lack of crypto signatures, that AdaCore is indeed the
copyright holder of most of the software they offer on their CVS or web
servers (but not GNAT itself, which belongs to the FSF). I think that
AdaCore could successfully convince a court that they are indeed the
copyright holder. If that's the case, then they are the ultimate
authority on the license terms.

The problem is that AdaCore have destroyed confidence in the license
terms they apply to their software.

My interpretation of the license change is this:

- if I download anything from AdaCore, I receive it under the terms of
the pure GPL, no matter what the headers say. I have a statement from
them in my records to back this claim (unfortunately, it is not
crypto-signed, so one could argue it has no legal force either :))

- the software I downloaded in the past, and which is now in Debian
Sarge, was under the terms of the GMGPL, and by these terms I am
allowed to redistribute this software under GMGPL terms. I think this
is correct because AdaCore has not explicitly revoked my GMGPL license
to this old software (I also have emails on record to back this claim).
The software in Sarge is crypto-signed with my GPG key, do if you get
the software from Debian, you have assurance that *I* am redistributing
the software to *you* under the GMGPL terms.

But let me reiterate: I don't think AdaCore will sue anyone. In fact,
this whole ongoing conversation is evidence that several people are
going out of their way to be really, really honest and respectful of
AdaCore's copyright, and trying to understand the ramifications. I know
many people who wouldn't be so considerate.

> I imagine Linus Torvalds answering millions of requests if kernel
> x.y.z *really* is GPL or maybe something else because license notices
> in the sources "have no legal force". He will send you to hell.

Actually, the situation of the Linux kernel is quite uncertain, as
there are many copyright holders, not all of whom can be reached, and
it would be impossible to get assurances for every bit of the kernel.
But, as for the portions that Linus owns, I think it would be easy to
convince a court that he is the copyright holder.

More importantly, there is no question, currently, about which license
terms are applicable to the Linux kernel. Everyone is convinced that
the GPL version 2 (and not a later version) is applicable, and I think
a court could be convinced easily, since Linus has public statements on
record to that effect.

> So *if* one would believe the "no legal force" thing, the logical
> consequence is to use commercial shrink-wrap EULA software and avoid
> OSS at any cost.

No; the problem remains the same whether or not the software is free or
open-source. You can buy pirated copies of Microsoft Windows,
shrink-wrapped, in China and other places, or you can get pirated
software bundled with a new computer from some small vendors. And the
license terms, theoretically, could change because of your name or
nationality or the weather in Iceland. In fact, the licence terms of
Microsoft Windows have changed in the past ("Software Assurance" they
called it, how ironic), and could change again in the future. So,
theoretically, you are still and always responsible for getting a
proper license statement from the copyright holder.

-- 
Ludovic Brenta.