Callaway: The long, sordid tale of Sun RPC, abbreviated somewhat, to protect the [guilty] and the irresponsible [LWN.net]

Fedora engineering manager Tom "spot" Callaway closes the book on a multi-year effort to relicense Sun's RPC code. The license, which was originally released with the code in 1984—before there were free software licenses—had distribution restrictions that made it clearly non-free. Debian noticed it first in 2002 and Fedora started working on the problem in 2005. "So, we restarted the effort with Oracle, and on August 18, 2010, Wim Coekaerts, on behalf of Oracle America, gave permission for the remaining files that we knew about under the Sun RPC license (netkit-rusers, krb5, and glibc) to be relicensed under the 3 clause BSD license."

to post comments

Callaway: The long, sordid tale of Sun RPC, abbreviated somewhat, to protect the [guilty] and the irresponsible

Posted Aug 26, 2010 23:01 UTC (Thu) by coriordan (guest, #7544) [Link] (2 responses)

Heh. Great story.

So the problem was this restriction:

Users [...] are not authorized to license or distribute it to anyone else except as part of a product or program developed by the user.

Hard to see what the point of the restriction was. Simon Phipps' blog (linked by Callaway) is interesting too. The code was so old, no one in Sun could claim to be the authority on its ownership.

Callaway: The long, sordid tale of Sun RPC, abbreviated somewhat, to protect the [guilty] and the irresponsible

Posted Aug 26, 2010 23:41 UTC (Thu) by JoeBuck (subscriber, #2330) [Link] (1 responses)

Speaking as an Old Guy: we simply didn't know any better then. We commonly posted code to the net with some note like

Copyright (c) 1986 by Sam Spade. You can do anything you want with this as long as you don't make money off it or pretend you wrote it.

This was thought of as very permissive, but it isn't DFSG-free (the "free as in price" vs "free as in freedom" concept hadn't sunk in yet).

As for Sun's thinking, I think they wanted everyone to get the official version from them (Sun) while still allowing the freedom to package the code with other products if necessary.

Callaway: The long, sordid tale of Sun RPC, abbreviated somewhat, to protect the [guilty] and the irresponsible

Posted Aug 27, 2010 1:19 UTC (Fri) by yuhong (guest, #57183) [Link]

Yep, semi-free software. Even Linux kernel itself was originally licensed that way in the very early days like Minix was.

I feel particularly slow

Posted Aug 27, 2010 4:47 UTC (Fri) by felixfix (subscriber, #242) [Link] (14 responses)

I don't understand why the code in question wasn't simply rewritten from scratch. No one else seems to have any problem understanding this; instead all the commentary I have seen ponders licenses.

What am I missing here? Why could the code not have been just rewritten sometime in the last 25 years?

I feel particularly slow

Posted Aug 27, 2010 6:34 UTC (Fri) by NAR (subscriber, #1313) [Link] (8 responses)

What justifies rewriting a code that has been tested for 25 years? I really don't think a new license worths the new bugs.

I feel particularly slow

Posted Aug 27, 2010 7:37 UTC (Fri) by rschroev (subscriber, #4164) [Link] (7 responses)

Following that reasoning, Linus could just have copy-pasted parts from Minix instead of writing Linux completely from scratch.

I agree with felixfix: I don't understand why the code hasn't been rewritten from the beginning. It happens with so many other parts of Linux; I don't understand what's so special about RPC that prevents alternative compatible implementations.

I feel particularly slow

Posted Aug 27, 2010 10:27 UTC (Fri) by jwakely (subscriber, #60262) [Link] (3 responses)

> I don't understand what's so special about RPC that prevents alternative compatible implementations.

Did you read the link? spot said:

> 2) Replace the non-free code. The big problem here is that the Sun RPC implementation was pretty much the standard RPC implementation on *nix. There were some others, but switching to them would have been really, really, painful.

Technically nothing *prevents* alternative implementations, but that alone isn't a good enough reason to spend time doing it.

Have you rewritten it and/or resolved any issues caused by switching to another implementation? I know I haven't. So what you're saying is someone else should do all that work.

Why should anyone bother when the problem is "just" a licence issue (obviously licence issues are important, but the intention of this licence was not to prevent the code being used as it is in glibc.)

I feel particularly slow

Posted Aug 27, 2010 11:38 UTC (Fri) by rschroev (subscriber, #4164) [Link] (2 responses)

I'm not complaining. I'm not blaming anyone. I'm not saying someone should have done the work.

I'm saying that I'm surprised that no-one has done it. There have been other cases of rewrites because of licensing issues (e.g. Gnome was created because of licensing issues with KDE), and there are numerous examples of multiple competing implementations of the same functionality.

Knowing that, it does seems strange to me that the community has waited 25 years for Sun/Oracle to change the license, instead of rewriting the code.

I feel particularly slow

Posted Aug 27, 2010 12:07 UTC (Fri) by rahulsundaram (subscriber, #21946) [Link]

Err. Noone has been waiting for 25 years. At that time, this was considered a permissive and good license. It became and was identified to be a problem only recently, once by Debian and again within the Fedora license audit and Sun made some progress and Oracle has finished the task.

I feel particularly slow

Posted Aug 27, 2010 15:36 UTC (Fri) by ESRI (guest, #52806) [Link]

I don't think anyone prevented anyone from doing the work if they wanted.

It sounds like those who evaluated the work necessary decided working on relicensing was the most cost-effective route.

I imagine if someone had come to the opposite conclusion, the code would, in fact, have been rewritten as you suggest.

I feel particularly slow

Posted Aug 27, 2010 10:28 UTC (Fri) by NAR (subscriber, #1313) [Link]

As far as I know, at that time Minix hadn't been in production use for 25 years. Moreover, the goals of Minix (giving something to students to learn) and Linux (hobby) were also different.

I feel particularly slow

Posted Aug 27, 2010 11:09 UTC (Fri) by danpb (subscriber, #4831) [Link]

There's no technical reason why the code couldn't have been re-written from scratch as a cleanroom impl but still API compatible. portablexdr started off with the glibc XDR codebase + portability fixes for Win32/OS-X. When the license problems affecting the glibc XDR code in portablexdr were raised during Fedora package review, work did start on re-implementing all the Sun XDR code in portablexdr from scratch. This was a non-trivial undertaking, even though it focused only on the XDR bits and ignored the higher level SunRPC layer. Fortunately, the resolution of the license problems meant that this re-write effort never needed to be completed.

I feel particularly slow

Posted Aug 27, 2010 14:40 UTC (Fri) by clugstj (subscriber, #4020) [Link]

I guess it was never rewritten because:

1) It was already there and working
2) It wasn't non-free enough to justify the effort
3) Sun wasn't making a stink about it being used in conflict w/ the license
4) Sun hadn't said they wouldn't relicense the code

If the issue had come up in a high-profile law suit, I'd bet it would have been rewritten pretty damn quickly!

I wouldn't really say that anyone was 'irresponsible' in this case.

"simply" is an exaggeration

Posted Aug 27, 2010 11:09 UTC (Fri) by tialaramex (subscriber, #21167) [Link] (2 responses)

So, at first this was good enough. It's easy now to say "That isn't DFSG free", but the DFSG did not exist when this code was incorporated into GNU software, let alone when it was first written.

Thus there was never a time when the choice was between writing a new RPC implementation vs adding this poorly licensed code, the code was already there, and would have needed to be _re_written.

When you find something like this, the first question is: "Can we just get a better license?" Duplicating effort is bad engineering. This isn't some proprietary code pasted from a top secret product, it's public stuff which happens to have a rather badly written license.

I'm sure that a "No" on the re-licensing question would have resulted in rewriting the code on the spot. And then a few months of "don't use new glibc if you use RPC because it has bugs" until the new code was as good as the old. But everybody has plenty to do, so long as the answer from Sun, Oracle or whoever was "Yeah, it's on our TODO list to help you" then it wasn't a priority.

History of free licensing.

Posted Aug 27, 2010 12:19 UTC (Fri) by jg (guest, #17537) [Link] (1 responses)

IIRC, we started to put together what became the MIT license in 1985, in reaction to IBM telling us (at Project Athena) they had a corporate policy of never using code that did not have a copyright statement. So we had to figure out what to put on X, to meet our goals. Public domain wouldn't cut it.

Jerry Saltzer worked with the MIT lawyers to draft what became the X or MIT license. I remember reviewing a draft of the license and OK'ing it when he was done.

I think the first version GPL was very slightly later, but in the same era.

In any case, we were all figuring this stuff out in that era. That we all didn't yet know what a mess the lawyers had created for us in copyright and then in patents, is in retrospect unsurprising.
- Jim

Corporate policy

Posted Aug 27, 2010 23:58 UTC (Fri) by dfsmith (guest, #20302) [Link]

As an IBM employee* who has just gone through the "Certificate of Originality" procedure we have for software here, I can attest to some of the reasoning why the copyright statement is necessary. It basically boils down to "if it doesn't say who wrote it and owns it, it may be in violation of someone else's license". I.e., even if code says "public domain", we can't ship it because we can't know if it was copied from another source.

* I am not writing officially for IBM here (we have a communications department for that), nor am I in legal but this may be enlightening anyway.

RE: I feel particularly slow

Posted Aug 27, 2010 16:44 UTC (Fri) by trondmy (subscriber, #28934) [Link] (1 responses)

Aside from the fact that others have pointed out about rewrites being painful, there is another fact: until about 2 years ago, nobody in the Linux world actually cared about Sun's TI-RPC implementation.

It was only when people started working on adding IPv6 support to the kernel's RPC implementation that we also started looking into using TI-RPC for the user-space utilities.
Before that, the IPv4-only RPC implementation that is included part of glibc was quite sufficient (although that too is derived from an older Sun implementation, and has had its own separate history of licensing issues).

RE: I feel particularly slow

Posted Aug 29, 2010 2:22 UTC (Sun) by Duncan (guest, #6647) [Link]

Thanks for that clarification. It explains a bit, as even if it's not a practical issue due to non-assertion, it's hard to imagine the FSF core folks failing to address the issue. But if for most of its life it wasn't particularly critical code anyway, but rather, could be dropped without much worry if worse came to worse, priorities on it could indeed drop as well. Only when it finds a more critical use does priority get high enough to followup and actually get the issue resolved.

It /is/ comforting to read (in Simon Phipps blog, early 2009, in the context of his announcement of the BSD relicensing that ultimately fell thru) that both Debian and Fedora were planning on dropping the code if it wasn't relicensed.

Duncan

Callaway: The long, sordid tale of Sun RPC, abbreviated somewhat, to protect the [guilty] and the irresponsible

Posted Aug 28, 2010 17:24 UTC (Sat) by tdz (subscriber, #58733) [Link] (1 responses)

I wouldn't have expected such a license problem in a GNU package, especially not in one of the core parts of the system. It's good to see this solved, but it also makes me wonder how many other (and possibly unknown) license issues exist.

Callaway: The long, sordid tale of Sun RPC, abbreviated somewhat, to protect the [guilty] and the irresponsible

Posted Aug 28, 2010 18:16 UTC (Sat) by rahulsundaram (subscriber, #21946) [Link]

These are just bugs. I wouldn't be surprised to find more.

Callaway: The long, sordid tale of Sun RPC, abbreviated somewhat, to protect the [guilty] and the irresponsible

Posted Aug 28, 2010 19:38 UTC (Sat) by branden (guest, #7029) [Link] (3 responses)

I'm happy for Anthony Towns that this was finally, conclusively proven to have never been a problem in the first place.

Oh, wait.

Callaway: The long, sordid tale of Sun RPC, abbreviated somewhat, to protect the [guilty] and the irresponsible

Posted Aug 28, 2010 19:54 UTC (Sat) by rahulsundaram (subscriber, #21946) [Link] (1 responses)

Reference needed I guess.

Callaway: The long, sordid tale of Sun RPC, abbreviated somewhat, to protect the [guilty] and the irresponsible

Posted Aug 29, 2010 2:13 UTC (Sun) by Duncan (guest, #6647) [Link]

See the link to Simon Phipps blog (from 2009) in the first comment. Look near the bottom of the comments there (and follow the blog's links to the old Debian debate if desired).

The short of it, apparently (I didn't trace all the way back to the Debian debate), is that Debian Legal said there was a problem, Anthony Towns (Debian release team) said there wasn't. Turns out Debian Legal was correct.

Still, it's a somewhat oblique reference few not familiar with Debian and their efforts to ensure they ship exclusively free software in main, would get. (I'm not a Debian guy, I do Gentoo, but I'm concerned enough about software freedom and familiar enough with Debian's efforts in that regard to recognize the reference, even before I learned the mid-level detail by following the links part way back.)

Callaway: The long, sordid tale of Sun RPC, abbreviated somewhat, to protect the [guilty] and the irresponsible

Posted Aug 30, 2010 6:16 UTC (Mon) by motk (subscriber, #51120) [Link]

Good! Let the hate flow through you!