By Jonathan Corbet
August 12, 2009
Certain unwelcome stories seem to never really go away. One may think that
an issue has been resolved, only to be attacked by a zombie version years
later. It has been almost exactly three years since LWN last
wrote about license problems with
cdrtools; the combination of GPL- and CDDL-licensed code in that
package rendered the whole undistributable. Linux distributors responded
by switching to cdrkit - a fork of cdrtools taken from a release prior to
the problematic license changes - and it seemed like the problem was
solved in an optimal way. The community had eliminated a licensing problem with an important
package and disconnected from a difficult upstream maintainer at the same
time.
But these problems are never solved, it seems. In June, Jörg
Schilling, the author of cdrtools, wandered
into the fedora-legal list with a request for Fedora to resume shipping
the "original, legal" cdrtools software. After a discussion of the type
that typically follows Jörg around, Tom "spot" Callaway stepped in
with a definitive response (short version:
"no") which pretty much brought the discussion to an end.
Life got quiet again until early July, when Luis Medinas suggested that openSUSE might want to switch
back to cdrtools. That was Jörg's cue to make one of his predictable
appearances, inspiring an
even longer and stronger version of the kind of discussion that tends to
follow him around. This time Jörg made a
direct lawsuit threat against SUSE, but showed his forgiving side too:
Anyway, if you are showing good will with fixing the current
problem by starting to distribute the legal original software
again, I may give you some time to recover from the mistake of
switching to the illegal fork.
One might well wonder about the reversal of roles here; now it's
Jörg who is complaining about the legality of cdrkit. His complaints
have been posted to the web. They include the fact that the "wodim" CD
recorder packaged in cdrkit is installed as "cdrecord" (a GPL violation, he
says), the lack of detailed change information within the source files, the
failure to print a copyright notice "as intended by the original author,"
an (unspecified) failure to distribute "complete" source, and a couple of
alleged violations of German copyright law (which, it seems, forbids any
change which Jörg disapproves of). All told, it is a long series of
complaints resulting from a simple fork of a GPL-licensed program.
Most observers do not take these claims seriously. The complaint
about the cdrecord binary is (somehow) based on the preamble of the GPL -
which is not part of the binding terms. Section 2a of the GPL does
require dated notifications of changes, but it's a rare project which
carries those notifications within the source files themselves, as
Jörg is demanding.
The complaint about copyright notices is interesting. Cdrecord has
traditionally been a verbose utility, and that verbosity has extended to
Jörg's thoughts about Linux distributors and kernel developers. For
example, version 2.01.01a01 (from 2004) would print things like:
Warning: Running on Linux-2.6
There are unsettled issues with Linux-2.5 and newer.
If you have unexpected problems, please try Linux-2.4 or Solaris.
SuSE Linux is known to ship bastardized and defective versions of cdrecord.
SuSE is unwilling to cooperate with the authors.
If you like to have a working version of cdrtools, get the
original source from ftp://ftp.berlios.de/pub/cdrecord/
(The current version, 2.01.01a63, has lost some of that language).
The
removal of some of that verbosity is what he is complaining about. But GPL
section 2c only requires the printing of "an appropriate copyright notice"
(not any specific notice),
and it only applies to programs which read commands interactively,
which wodim does not do. So this claim, like the others, has
failed to create widespread worry.
In short, many in the community seem to see Jörg as a sort of comic
figure, but that should not be allowed to obscure an important fact: there
are some points worth noting behind his complaints. These include:
- Jörg alleges that openSUSE is
shipping two related, legally problematic packages: vcdimager
and libcdio.
Both packages are GPL-licensed and hosted with the GNU project, but
other distributions have recognized problems with them;
Debian has shipped a
patched version since 2004, and Fedora users must get it from an
external repository. Fedora also does not ship libcdio, which is
alleged to have suffered a license change which is not acceptable to
the original author of the code.
- Cdrkit is nearly unmaintained. The mailing
list for changes is a quiet and lonely place. Jörg states
that hundreds of unfixed bugs have been introduced into cdrkit. The
reality, as shown by distribution bug trackers, is a bit less
spectacular, but it is true that some bugs exist which might not be
present in cdrecord - which is actively maintained by Jörg.
The first issue needs to be taken seriously; it is never a good idea to
distribute code with problematic or disputed licensing. The fix here is
relatively straightforward: stop distributing that code if the license
cannot be verified, and, possibly, reimplement it (as Sun is said to have
done with libcdio).
The second may be harder. The freedom to fork a package out from under an
uncooperative maintainer is one of the fundamental features of free
software. But forking is expensive; it only works if somebody else does
the work which has been pulled away from that maintainer. An unmaintained
fork is just more dead code. If cdrkit reaches a point where it fails to
work for users, distributors will be left with an unpalatable choice:
continue to ship unmaintained code, or go back to the original, with its
difficult maintainer and incompatible licensing. It would be much nicer to
find somebody willing to put some time into this important tool. CD recording is a detailed
and tricky task, but we have plenty of people in our community with the
necessary skills to work in that area.
(
Log in to post comments)