The original plans had called for the third draft of the GNU General Public
License update to come out late last year. Needless to say, things didn't
happen that way. Between trying to address concerns raised from various
directions and responding to the Microsoft/Novell deal, the Free Software
Foundation ended up having to slip its schedule; as a result, eight months
have passed since the second
was released. One could well argue that
a major license update should not be made in a hurry, and thus the delays
are not problematic. In any case, the wait is over: the new
is available. In many ways, the draft resembles its
predecessors; in others, it has changed significantly. This article will
focus on the differences.
One area of conflict has been the anti-DRM provisions. The relatively
uncontroversial language stating that GPLv3-licensed works are not
"technological measures" has been reworked slightly to give it a more
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under
article 11 of the WIPO copyright treaty adopted on 20 December
1996, or similar laws prohibiting or restricting circumvention of
The previous draft had been specific to the DMCA, but anti-circumvention
laws are a global issue, so this change makes sense.
The "anti-tivoization" provisions have been the source of much of the
disagreement over this license. The new draft changes those sections
significantly - though the intent remains the same, and people who did not
like the previous versions are unlikely to feel better about the new
language. In previous drafts, signing keys required to convince hardware
to run a given binary were deemed to be part of the source code, and thus a
required part of the (required) source distribution. The drafters decided
that extending the definition of "source code" in this way was not the best
idea. So, instead, we now have "installation information":
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to
install and execute modified versions of a covered work in that
User Product from a modified version of its Corresponding Source.
The information must suffice to ensure that the continued
functioning of the modified object code is in no case prevented or
interfered with solely because modification has been made.
The license goes on to say that, if GPLv3-licensed code is shipped as part
of a product, the installation instructions must be made available as well.
Actually, it's not anywhere near that simple, for a couple of reasons. The
first is this concept of a "user product," which is new in this draft:
A "User Product" is either (1) a "consumer product", which means
any tangible personal property which is normally used for personal,
family, or household purposes, or (2) anything designed or
sold for incorporation into a dwelling.
The actual requirement for the shipping of installation information is:
If you convey an object code work under this section in, or with,
or specifically for use in, a User Product, and the conveying
occurs as part of a transaction in which the right of possession
and use of the User Product is transferred to the recipient in
perpetuity or for a fixed term (regardless of how the transaction
is characterized), the Corresponding Source conveyed under this
section must be accompanied by the Installation Information.
One might well wonder what is going on here. In the explanation materials
sent to LWN with the license draft, the FSF states:
After some discussion with committees, we discovered that the
proposals in the second discussion draft would interfere with a
number of existing business models that don't seem to be dangerous.
We believe that this compromise will achieve the greatest success
in preventing tivoization.
The nature of these innocuous business models is not spelled out. What it
comes down to, though, is that gadgets intended to be sold to businesses
will be exempt from the "installation instructions" requirements. This
seems strange; it may well be businesses which would have the most use for
the ability to change the code running in devices they purchase. The FSF
has been saying that the right to replace the software in a device is
required for true software freedom; why is that right now less important
for devices which are not "user products"?
This exemption could prove to be a big loophole.
Many years ago, your editor bought a digital audio tape deck. The rules
for DAT decks in those days specified that they must implement the "serial
copy management system" - a couple of bits in the digital audio data stream which
indicated whether another deck was allowed to record that stream or not. It turned
out that decks intended for "professional use" were exempt, however -
musicians, after all, might actually want to make copies of their work. As
far as your editor could tell, the difference between "professional" and
"consumer" decks (at the low end, anyway) consisted of a pair of rack-mount
ears; "professional" decks were available at the local guitar shop.
Anybody could get a SCMS-free deck with little trouble. The exemption for
devices which are not "user products" looks similar; with
this language, the FSF may well be setting us up for a flood of "business
use" gadgets which happen to available at the local big-box technology
The "additional terms" section has been simplified a bit. The second draft
included the optional requirement that, if the covered code is used to
implement a web service, the users should be able to get the source via
that service. This requirement, intended to close the "web services
loophole," is absent from the third draft.
The termination rules still allow any copyright holder to terminate the
license if it is violated. There is a new escape clause, though:
However, if this is your first violation of this License with
respect to a given copyright holder, and you cure the violation
within 30 days following your receipt of the notice, then your
license is automatically reinstated.
An opportunity to fix a GPL violation is consistent with how the license
has been enforced so far.
The patent language has changed significantly as well. The second draft
included a covenant not to enforce any relevant patents against recipients of
the software; in the third draft, instead, an explicit patent license is
granted. This change is apparently intended to make the patent grant
language look more like that found in other licenses.
The change which will attract the most attention, though, is the
language aimed at the Microsoft/Novell deal; it does not look like
anything found elsewhere. It starts by broadening the definition of a
"patent license" to include things like covenants not to sue, thus covering
the Novell non-license. There is a clause saying that if you distribute
covered code under the protection of such a license, you must arrange for
all recipients - anywhere - to have the same protection. Then there's this
You may not convey a covered work if you are a party to an
arrangement with a third party that is in the business of
distributing software, under which you make payment to the third
party based on the extent of your activity of conveying the work,
and under which the third party grants, to any of the parties who
would receive the covered work from you, a patent license (a) in
connection with copies of the covered work conveyed by you, and/or
copies made from those, or (b) primarily for and in connection with
specific products or compilations that contain the covered work,
which license does not cover, prohibits the exercise of, or is
conditioned on the non-exercise of any of the rights that are
specifically granted to recipients of the covered work under this
The FSF is still considering whether it should grandfather in deals made
before this draft was released.
The restriction to deals involving software companies is strange; it will
just cause the next deal to be done by way of a patent-troll
corporation. The prohibition only applies if the payments are based on the
number of copies distributed, meaning that the next such deal will look
like a fixed-sum payment - we will never know how that sum was calculated.
There are enough loopholes in this section that
it seems unlikely to slow down the next patent shakedown in any significant
way. If the grandfather clause is added, it will not even affect Novell,
the target of this whole thing.
There is an interesting new exception in this draft:
Notwithstanding any other provision of this License, you have
permission to link any covered work with a work licensed under
version 2 of the Affero General Public License, and to convey the
resulting combination. The terms of this License will continue to
apply to your covered work but will not apply to the work with
which it is linked, which will remain governed by the Affero
General Public License.
The posted version of the Affero
GPL is version 1; your editor was not able to find any mention of
a second version anywhere. The FSF must know something the rest of us are
not yet privy to.
Finally, there is explicit support for signing away the right to decide on
future license changes to others:
If the Program specifies that a proxy can decide whether future
versions of the GNU General Public License shall apply, that
proxy's public statement of acceptance of any version is permanent
authorization for you to choose that version for the Program.
There are various other tweaks - providing source by way of a network
server is now officially allowed, for example. In many ways, GPLv3 is
shaping up exactly as it was supposed to: it is bringing the license up
to contemporary, worldwide standards and is evolving in response to input
from the community. Your editor anticipates that the new anti-DRM and
anti-Novell language will be the subject of significant criticism,
however. They are developing the complex, baroque nature of code which has
been repeatedly patched far beyond its original design. That language may
require some work yet.
The current plan calls for the FSF to accept comments on this draft for the
next 60 days, after which the final draft will be released. One month
later - around the end of June - the GPLv3 will become official. The FSF
claims to be actively looking for comments, so now is the time for anybody
who has remaining concerns to speak up. Regardless of whether certain
high-profile projects move to GPLv3, we all will be working with code
covered by this new license. It's important that we help the FSF get it
to post comments)