Bruce Perens: Statement on Busybox Lawsuits

And it's not that your selection of terms is unclear, it's that your understanding of copyright law in general (and Title 17 in particular) seems to be unclear.

> And in this case, seeing as the compilation is a mix of v2-only and v2+,
> the compilation licence has to be v2-only.

In the phrase "compilation license" you're confusing at least three distinct concepts: compilation copyright, derived works, and issuing a license to a copyright. (And you're probably unaware that a fourth related concept, joint copyright, even exists.)

Look, if you're really going to care you should talk to a lawyer or take a course in business law or something. But here's a 10,000 foot overview that's worth what you paid for it:

First, let's talk about licensing. One copyright can have multiple, (completely incompatible) licenses granted on it. For example, the QT project lists three:

http://qt.nokia.com/products/licensing

(Although only two actually matter since the second is convertible into the third, they probably just did the third to get the FSF to shut up.)

So QT has a commercial license, and LGPL. If you ship a modified binary without offering source code, you've violated the terms of the LGPL. If you put your source up for download for free to all and sundry, you've violated the terms of your average commercial license. And this is _fine_, because you only need _one_ valid license under which to distribute the code. When there are multiple ones, you can choose the one that best suits your needs and obey the terms of that one.

The fact that everybody who buys the commercial license ALSO gets the code under LGPL means that the code is dual licensed when they get it, and they're intentionally discarding one of those licenses. This is _normal_.

So: one copyright can have multiple licenses, and those licenses can be completely unrelated, of diffent scope, duratinon, requirements, and so on. And some of those licenses may not apply to you. Clear so far?

Now let's look at different _kinds_ of copyright a work can have. Title 17 has a "definitions" section:

http://www.copyright.gov/title17/92chap1.html#101

> A “compilation” is a work formed by the collection and assembling of
> preexisting materials or of data that are selected, coordinated, or
> arranged in such a way that the resulting work as a whole constitutes an
> original work of authorship. The term “compilation” includes collective
> works.

What that means is a compilation copyright is a copyright on the selection of elements to include, such as a short story anthology or a CD containing a dozen music tracks from various authors. It mostly becomes relevant when the person who put together the compilation contributed no actual material to the result that could form a derivative work.

Compilation copyright is about "you included substatially the same public domain stories I did in your book, that organization was copied from me". In busybox, you might be able to claim the selection of commands to implement gives you a compilation copyright, except that we implement hundreds more now the selection of commands to implement is "what's in the Single Unix Specification plus the Linux man pages", which falls under scenes a faire:

http://www.ivanhoffman.com/scenes.html

One of the _other_ failings of compilation copyright is that if you cherry-pick out the individual elements and take a significantly different subset of them (or a compile them in a different way), the compilation copyright doesn't apply. Thus if Bruce had a compilation copyright on busybox 0.0.1 or whatever it was he released and somebody grabbed just one command from that (which Bruce didn't write), whatever license terms he decided to apply wouldn't matter unless he had code in that command. It would be entirely based on what the original author had licensed the work as. (See http://www.copyright.gov/title17/92chap2.html#201 part c.)

Because of this, I've never seen a GPL enforcement action based on a compilation copyright, and when I brought it up with the SFLC three years ago they didn't want to go there. Compilation copyright is generally fairly weak and uninteresting unless you're an anthology publisher.

Open source projects such as Linux have always based their legal status on derived works. Again from the definitions section of title 17:

> A “derivative work” is a work based upon one or more preexisting works,
> such as a translation, musical arrangement, dramatization,
> fictionalization, motion picture version, sound recording, art
> reproduction, abridgment, condensation, or any other form in which a
> work may be recast, transformed, or adapted. A work consisting of
> editorial revisions, annotations, elaborations, or other modifications,
> which, as a whole, represent an original work of authorship, is a
> “derivative work”.

(For example, somebody takes an existing mozart performance and puts a drum track over it, they've created a derivative work. Now to distribute recordings of the result they need to get a license to the mozart performance _and_ issue their own license on their drum track.)

Note that every compilation copyright is _on_ a derivative work, but not every derivative work has a compilation copyright claimed on it.

The thing about a derivative work is that the copyrights of the contributions remain distinct, and each is licensed separately. The copyrights on each contribution to the derivative work must be licensed under compatible terms in order for the derivative work as a whole to be copied and distributed.

So just as one copyright can have multiple licenses, one derivative work is made up of multiple copyrights, ideally each licensed under the same terms. (Simply put, multiple copyrights, one license.) Ok?

Derivative works are the "boolean and" of copyrights, and it fails closed. Violate the license to one component, and you have infringed that copyright, and the owner of that copyright has standing to sue. This makes the addition of new licenses extremely difficult, and makes dropping licenses in a multi-license scenario easy. Making it hard to add new licenses (such as proprietary commercial ones) is generally what open source projects want (unless they're using BSD licensing where the license itself is "do what you will, just don't sue me"), so it's how open source developers arrange their projects.

For example, if you put together a derived work combining public domain code, code dual licensed under GPL and some other license (such as Perl, which is dual GPL and Artistic), and code that's only under GPLv2, you have a number of different licenses on the _components_, but only one license under which the derived work as a whole can be shipped.

If a recipient of that derived work wants to pick it apart and grab individual chunks and argue that those components are in the public domain or usable under the terms of the Artistic, that's their right to do so. It's also their problem to do the analysis to prove the provenance of that part of the code.

The BusyBox project's git repository currently has 10,866 commits in it. That means Erik Andersen and his successors have created over 10,000 distinct derived works, and if you want to pull any chunk from the current version and go "this was originally BSD licensed, I want to use it in my BSD licensed project" (such as networking/traceroute.c) you have to go through and find all changes to that chunk since it was so licensed and either remove those changes or get permission to use them under BSD from whoever owns that change's copyright (the source control commit messages should record who wrote it).

Of course it's way easier (and more sure) to just go find the older copy before it was modified into a derived work that included changes from authors who only licensed their copyrights under GPlv2. And as I said, those old versions are still there in the downloads directory, and in the repository, and so on.

What open source projects generally try to _avoid_ is a "joint copyright", which is the "boolean or" case. That's where there's one copyright shared by multiple authors. That means each copyright holder has an equal right to the resulting work, and thus each of them individually can issue a license to the whole work all by themselves under any terms they like. (There's just the one copyright to be licensed, so any license covers the whole thing. Who's owed what share of any royaltaies from such licensing is another matter.)

The FSF never wanted to deal with any of this and forced all their contributors to sign over their copyrights (not just grant compatible licenses to them in non-centralied regimes such as Linux). That way FSF code has one copyright owner, which can thus issue new licenses on a whim.

Of course if you remember reading about the SCO/Novell case on Groklaw, signing over copyrights requires a "written instrument of conveyance", I.E. they have to keep actual signed pieces of paper on file in a physical filing cabinet, and that bureaucracy was one of the main limiting factors preventing their development process from scaling. (The other was Richard Stallman's ego, but let's not go there.)

(At least you're not one of the people who try to drag contract law into it. And I've skirted the whole "copyright doesn't cover _use_" morass. Some lawyer somewhere needs to do a "copyright and licensing for open source developers" class. I've arranged a few panels at Penguicon and Linucon, often with Eric Raymond's wife Cathy, who is a Lawyer. But that's just poking at the problem...)

Sigh. Let the SFLC or the Linux Foundation deal with it...

> (imho, but that's only ho, they should have said "we've accidentally
> mixed some v2-only into a v2+ project, so all new code must be v2+ as
> per the original but the project is actually v2-only unless and until
> somebody bothers to do something about it.)

You mean like we publicly discussed doing on the busybox mailing list three years ago, in a number of different threads I pointed to earlier in this discussion?

http://lists.busybox.net/pipermail/busybox/2006-August/05...

So your advice is we should have taken an option we discussed at length, for several months, and decided against months before His Special-ness ever showed up.

Rob