LWN: Comments on "A discussion on combining CDDL and GPL code"

A discussion on combining CDDL and GPL code

nye — Wed, 01 Jun 2016 11:06:44 +0000

>We're talking about the binary ZFS module on its own here (as per the previous poster). Even if the CDDL says that it can be distributed under the GPL, the GPL says that binaries must have source code under the GPL (or a GPL-compatible license, i.e., not the CDDL). Derivative works don't enter the discussion

Derivative works don't merely enter the discussion; they *are* the discussion. The GPL can say whatever it likes, but nothing in it can possibly apply to something that is not a derivative work.

A discussion on combining CDDL and GPL code

MattJD — Mon, 30 May 2016 21:56:38 +0000

That's not quite right, the GPL requires the entire worked to be licensed under the terms of the GPL. However, it is believed that the terms of the CDDL and the GPL are not compatible (not that the CDDL allows more, but that it has restrictions the GPL does not), and thus you can't distribute something under both licenses.

The MIT license is fine, because it allows you to distribute under basically any license (it's only restriction is basically a disclaimer, which the GPL shares in spirit (if not text), and thus imposes no further restrictions). Thus you can distribute something under the MIT license as GPL.

In both cases, what matters is that the non-GPL license imposes no more restrictions on the combined work. CDDL does, MIT doesn't.

Note: This is true for the GPL2 with Linux. Apparently the GPL3 is a little more muddy, but for the CDDL is still basically right.

A discussion on combining CDDL and GPL code

HsuYun — Mon, 30 May 2016 21:02:28 +0000

Well, then use the MIT license for the binary. I still don't really get the problem. The GPL requires you to license both the code and binary of kernel modules to be under a compatible license. The only incompatibility of the CDDL is that you _could_ license the binary under a non-free license, but if you don't do that, you actually _do_ fulfill the requirements of the GPL that you can do everything with the module you could do with a GPL licensed module. Thinking about it this way, why is it ok to distribute an MIT licensed module with the kernel, because the MIT license would also allow you to license the binary under a non-free license. Where is the flaw in my thinking here?

A discussion on combining CDDL and GPL code

pboddie — Fri, 27 May 2016 21:19:39 +0000

You are actually agreeing with me here. The assertion that anything supposedly written to work in multiple environments is, by its very nature, a completely separate work from any specific work that it might interact with (like the Linux kernel) has little or no bearing on the derived work discussion because that discussion around the GPL is all about the running system.

This has previously been discussed in the context of the Nvidia drivers which supposedly use the same code as the ones used on Windows, and so people like to claim that the Nvidia drivers could never be derived works of Linux. But the derived works discussion is not about those drivers in their "inert" state.

When considering the GPL, I like to consider the "view source" scenario: you're running Linux combined with the ZFS implementation delivered by Canonical; Linux is GPL-licensed and thus imposes certain conditions about it being combined with other things and the source code for the result being available (for further distribution under the GPL's terms); therefore, the complete source code for that running system must be available to the end-user. Can this really be satisfied if the source of the ZFS implementation cannot actually be obtained and redistributed under the GPL?

Naturally, people may argue (just as they do with the Nvidia drivers) that it's the user who combines the works and that no-one is actually distributing the combination. Others may argue that the different parts of the running system do not comprise a derived work of one of those parts. Such matters I will happily leave to the lawyers to argue about.

A discussion on combining CDDL and GPL code

asaz989 — Fri, 27 May 2016 17:25:45 +0000

That is exactly what the derived-works discussion is all about. It is widely assumed that any kernel module is a derivative work of the kernel (and hence the GPL applies), and Canonical is acting like that just ain't so. There is some arguing in the alternative going on with the "spirit of the GPL" defense, but the core issue comes down to "what is a derived work of the kernel and what is not".

A discussion on combining CDDL and GPL code

pboddie — Fri, 27 May 2016 13:12:21 +0000

Not necessarily. Who owns the copyright in the binary?

Presumably it is the copyright holder. Otherwise, "anything goes" and the consequences would be very broad indeed. For example, you could machine-translate Harry Potter, sell copies, and not get sued by its apparently-already-litigious author.

If they place the binary under the GPL, then they can't be sued for violating the GPL, and anybody who receives the binary under the GPL can presumably distribute it under the GPL.

I don't think that "place the binary under the GPL" makes any sense whatsoever given that the act of distribution is governed by source code distribution provisions in the GPL. In effect, "I don't have the sources, so it's OK" is making a promise you can't keep.

Now, it might be the case that someone could take a permissively-licensed work, play the "place the binary under the GPL" game, then claim that they aren't obliged to provide the source, and state that they haven't violated the licence imposed by the copyright holder and have therefore not infringed any copyrights. That would be a misuse of the GPL, but I don't know what sanctions might be imposed on someone doing such a thing. Maybe something outside of plain copyright law would apply.

A discussion on combining CDDL and GPL code

anselm — Fri, 27 May 2016 09:34:24 +0000

We're talking about the binary ZFS module on its own here (as per the previous poster). Even if the CDDL says that it can be distributed under the GPL, the GPL says that binaries must have source code under the GPL (or a GPL-compatible license, i.e., not the CDDL). Derivative works don't enter the discussion.

A discussion on combining CDDL and GPL code

sfeam — Fri, 27 May 2016 02:18:27 +0000

Haven't we been around this barn before, and before that, and before that... The GPL can say whatever it likes, but what it says is only relevant to derivative works. Co-distribution of unlinked binaries may or may not create a derivative work, but that judgment is independent of anything the GPL says.

A discussion on combining CDDL and GPL code

anselm — Thu, 26 May 2016 23:46:45 +0000

The GPL stipulates that if you distribute a binary under the GPL then you must supply the corresponding source code under the GPL. If that source code says that it can only be distributed under the CDDL then you have a problem right there.

A discussion on combining CDDL and GPL code

Wol — Thu, 26 May 2016 23:12:40 +0000

> So, any attempt to distribute a binary under the terms of the GPL will end up violating the GPL

Not necessarily. Who owns the copyright in the binary? If they place the binary under the GPL, then they can't be sued for violating the GPL, and anybody who receives the binary under the GPL can presumably distribute it under the GPL.

After all, what does "the preferred form for modification" mean? If all you've got is the binary, then it's the *only* form for modification, so "preferred" is meaningless ...

Weird result, I know, but licences don't apply to copyright holders. Too many people forget this. And when you start mixing rights, you can end up with weird combinations.

Cheers,
Wol

A discussion on combining CDDL and GPL code

pboddie — Thu, 26 May 2016 17:25:40 +0000

- The CDDL says (at least that's how I understood the article) that the executable produced from the source can be re-licensed under any license you like. "You" in this case is Canonical, so they could simply re-license the binary .ko file under the GPL

- The GPL says that if binary modules are distributed together with the kernel binary, the binary modules must also be licensed under a compatible license, not just the source of the modules.

Right. But the article points out that the source code must be distributed only under the terms of the CDDL. So, any attempt to distribute a binary under the terms of the GPL will end up violating the GPL because the source code would then only be offered under the terms of the CDDL, and the CDDL is not GPL-compatible.

A discussion on combining CDDL and GPL code

HsuYun — Thu, 26 May 2016 11:35:34 +0000

Maybe I'm missing something here, but I also don't understand why Canonicals distribution of the ZFS module violates the GPL, although for different reasons:
- The CDDL says (at least that's how I understood the article) that the executable produced from the source can be re-licensed under any license you like. "You" in this case is Canonical, so they could simply re-license the binary .ko file under the GPL
- The GPL says that if binary modules are distributed together with the kernel binary, the binary modules must also be licensed under a compatible license, not just the source of the modules.
- The binary ZFS module built from the ZFS sources by Canonical and licensed under the GPL can not be re-licensed by someone else to a license incompatible with the GPL.
Where is the conflict? Could someone please enlighten me?

A discussion on combining CDDL and GPL code

Wol — Thu, 26 May 2016 10:27:11 +0000

> In Singapore, as a condition of joining a free trade agreement with the US, copyright infringement is now a criminal offence.

Likewise, in the UK, copyright infringement for gain (which is what Canonical are doing, and they are based in the British Isles) is also a criminal offense.

Cheers,
Wol

A discussion on combining CDDL and GPL code

pboddie — Wed, 25 May 2016 22:43:50 +0000

ZFS itself was written and finished as work for the Solaris kernel, thus the question of whether ZFS itself is a derived work of Linux can unambiguously be answered with “no” unless they really fucked up hard.

I don't think anybody argues that the ZFS code itself - on its own in splendid isolation - or, at least, the code of the other favourite modules featuring in the many previous discussions on this broader topic - Nvidia drivers and so on, also supposedly kernel-neutral - are derived works of Linux. But then, that's not what the derived work discussion is all about.

A discussion on combining CDDL and GPL code

mirabilos — Tue, 24 May 2016 15:38:56 +0000

This case should be rather easy, actually.

The GPL clause only triggers when *distributing* the derived work.

If the zfs.ko binary file is not a derivate of the Linux kernel (see below), then distributing it, even in binary form, is okay under the CDDL. Linking it into the Linux kernel at run-time by the user is “merely using the work” and not restricted under GPL, although it also creates a combined work of the two.

It’s just not okay to distribute that derived work (say, a kernel crashdump).

Now, as for the “see below” comment above:

• ZFS itself was written and finished as work for the Solaris kernel, thus the question of whether ZFS itself is a derived work of Linux can unambiguously be answered with “no” unless they really fucked up hard.

• A kernel module *can* be written so it works for different kernels, possibly with (e.g. BSD-licenced) adaption layers. We have this case occasionally in the Linux world.

• It is possible to write complete modules for the Linux kernel, compile them, and link them (into a .ko file, not bind them with the Linux kernel) without creating a derived work of the Linux kernel. This is most easily achieved by, well, simply using nothing from the Linux kernel (not even its header/include files) except the API definition (which is not creative enough to be a work of copyright, and/or exempt under EU interoperability stuff anyway). For example: the OpenBSD/zaurus bootloader is a kernel module for Linux 2.2 – the boot process looks like this:

$ su
# insmod zbsdmod.o
# cat bsd >/proc/zboot

The code: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/arch/zau... (note that, while compat_linux.h has #include for Linux 2.4 headers, they are #if 0’d, and the module only works with the stock Linux 2.2 anyway)

• It may be possible to write LKMs using Linux’ headers without creating a derived work of the Linux kernel, but, especially with the Linux developers’ tendence to put lots of “static inline” functions into them, I wouldn’t dare, personally. Or strip them out and ship my own copy, with just the interface.

• The question now is whether zfs.ko did any of that. I haven’t looked at the code, and probably won’t, but this gives everyone who wishes to do so a recipe.

Enjoy!

A discussion on combining CDDL and GPL code

paulj — Mon, 23 May 2016 11:01:23 +0000

The statutory damages risk makes for a compelling argument, indeed.

You still need to persuade a court that there has been a copyright violation though, in distributing a derivative of CDDLed and GPLed works. I think the Eblen Moglen and Mishi Choudhary paper is more examining that question, than the damages issue, if I understand correctly (also, I don't think the paper is taking the firm position on the CDDL/GPL issue that this LWN article seems to paint; if Choudhary took a firm stance in the talk, the paper does not have it). That paper makes an interesting point on literal readings: under a very literal reading, one could not combine BSD or other code considered "GPL compatible" with GPL code, without explicit relicensing to GPL.

Interesting stuff.

A discussion on combining CDDL and GPL code

paulj — Mon, 23 May 2016 08:30:03 +0000

Oracle have copyright in GPLed code in the Linux kernel, don't they? Or is that code trivial enough to not worry about?

A discussion on combining CDDL and GPL code

nybble41 — Mon, 23 May 2016 02:09:42 +0000

US law encompasses both civil and criminal varieties of copyright infringement. However, the idea of statutory damages is only applicable to civil cases. Damages—and for that matter niceties like standing and even proportional response—aren't really a factor in criminal cases regardless of jurisdiction, just whether the law was broken and whatever punishment the law prescribes for such offenses.

A discussion on combining CDDL and GPL code

karath — Sun, 22 May 2016 04:55:34 +0000

All armchair lawyers should be very aware that every jurisdiction is different, some in small degrees and some in fundamentally qualitative approach. In Singapore, as a condition of joining a free trade agreement with the US, copyright infringement is now a criminal offence. Sentencing can include both fines and prison terms. My understanding is that this was imposed by the sponsors in the US as an attempted lever to eventually get a similar measure enacted into US Federal law - something that has been rejected when attempted in the past.

A discussion on combining CDDL and GPL code

nybble41 — Sun, 22 May 2016 03:49:59 +0000

The term is statutory damage, not statutory fine, and it's a purely a matter of civil law. The idea is that each infringement is assumed to be a set amount of damage without requiring proof of such damages by the copyright holder. (If proof of damage were required, as a just law would require, we could dispense with the entire concept of copyright—as there is no such thing as actual damage due to copyright infringement.)

A discussion on combining CDDL and GPL code

giraffedata — Sun, 22 May 2016 03:08:03 +0000

OK. That kind of copying isn't usually the kind that authors of open source code worry about, but it's certainly a valid example of statutory damages being real.

I'm not sure what you're trying to say by there being no such thing as actual damage from making a copy, but suffice it to say that people regularly win sums in court much larger than statutory damages to compensate them for the damage done to them by other people making copies.

A discussion on combining CDDL and GPL code

giraffedata — Sun, 22 May 2016 03:03:46 +0000

Thanks. That sort of blows a hole in the idea that if the copyright holder isn't damaged then there is no liability and makes us rely for CDDL-GPL compatibility on the hypothetical power of a court to enforce the spirit of a copyright license, expanding the permission to copy beyond what the copyright holder actually said.

A discussion on combining CDDL and GPL code

happylemur — Sun, 22 May 2016 01:13:57 +0000

This case is probably the highest-profile example of statutory damages for copyright infringement: https://en.wikipedia.org/wiki/Capitol_Records,_Inc._v._Th...

A discussion on combining CDDL and GPL code

smoogen — Sat, 21 May 2016 19:38:48 +0000

I don't know either. I thought that copyright statutory fines were criminal violations and not civil.

A discussion on combining CDDL and GPL code

nybble41 — Sat, 21 May 2016 18:22:46 +0000

> I can't recall ever hearing about someone suing for statutory damages for copyright violation.

Statutory damages are basically the only kind a copyright holder *can* sue for, since there is no such thing as actual damage from making a copy, whether authorized or not. All those high-profile "piracy" cases where individuals were threatened with fines on the order of hundreds of thousands or even millions of dollars for copying a handful of songs or videos were founded on statutory damages. Of course, such cases require solid evidence and generate a lot of negative PR, so more recently they've been focusing on pressuring ISPs into serving as their extra-judicial enforcement wing and "persuading" individuals to settle rather than suffer the legal expense of defending themselves.

A discussion on combining CDDL and GPL code

giraffedata — Fri, 20 May 2016 22:59:02 +0000

That's a good point. The paper doesn't mention that loophole. A lot of times statutory damages are just for measuring damages while liability itself requires that there be proof of nonzero damage. But I don't know.

I can't recall ever hearing about someone suing for statutory damages for copyright violation.

A discussion on combining CDDL and GPL code

mjg59 — Fri, 20 May 2016 22:08:47 +0000

> If you copy without permission, but the copyright holder isn't hurt by your doing so, you can't lose a lawsuit over it.

Is that true? Copyright infringement carries statutory damages in several jurisdictions.

A discussion on combining CDDL and GPL code

giraffedata — Fri, 20 May 2016 22:05:16 +0000

I don't even know why they brought up the "spirit" thing, because 1) that really isn't the law; and 2) the damages issue covers the matter just fine.

The paper simply states the conclusion that all western legal systems let courts follow the spirit instead of the letter of legal documents to prevent injustice - it doesn't back it up with anything and that is far different from the law that I know. The only time I've seen a court openly rewrite an unambiguous term of a contract is when the result of the literal reading would be absurd (which implies the people who wrote it would be shocked). I don't know copyright licenses, but I presume the bar is even higher there, because authors have a fundamental right to be selfish and withhold their work from anyone, so I can't see it being called injust for a license to fail to give someone permission to copy under whatever circumstance.

But the damages angle accomplishes the same thing. If you copy without permission, but the copyright holder isn't hurt by your doing so, you can't lose a lawsuit over it. If your copying accomplished the same goals of the copyright holder as if you had done what you had to to get permission, it would be hard for the copyright holder to win a lawsuit.

A discussion on combining CDDL and GPL code

clopez — Fri, 20 May 2016 03:28:21 +0000

The CDDL is not beeing violated (not even in literal strict interpretation) by Canonical. So i dont think Oracle can claim any damage to Canonical at all.

What is beeing violated is the GPL, but only if you argue that ZoL is a derivated works of the Linux Kernel.

So, in my opinion (IANAL) the only who can claim damages to Canonical is some of the Kernel developers because of an infringement of the GPL derivative works terms.

But in order to do that they first have to demonstrate that ZoL is a derivative works of the Linux Kernel. And arguing that is going to be difficult given what the main author of the Linux Kernel (Torvalds) said previously about AFS: https://lkml.org/lkml/2003/12/3/228

A discussion on combining CDDL and GPL code

smoogen — Thu, 19 May 2016 23:52:44 +0000

What I was taught in Physics is completely different from what actual physics is like. The people I know who went to Law school constantly talk about what they were taught about contract law or criminal law or other parts doesn't actually match what they really work in. Yes it is close enough but there is only so much the legal spherical chickens really match what happens.

The core issue is how much the court system is going to treat the GPL like a contract and how much of it various other types of legal matters. The fact that it is going to be up to Oracle to decide on one side if they have any victims they want to get money from and on the other side kernel authors who will have to show they have enough standing is going to be a long complicated game. And in the meantime, I expect Canonical has done its math and decided that it isn't likely Oracle will sue, or that Linus is going to sue.. so they can get enough usage out of it to make a larger bit of the pie.. because frankly they know that a large majority of their users's don't care about licensing at all. So all upsides for them.

None of this is meant to be an endorsement. I don't like it, but I am not a lawyer and I have come to realize that law is so unlike how they teach you in the mundane classes that my best bet is to usually assume that whatever I think it should be like is really wrong.

A discussion on combining CDDL and GPL code

rahulsundaram — Thu, 19 May 2016 23:07:41 +0000

> Er, which one am I? :)

Aging developer lawyer? :-)

A discussion on combining CDDL and GPL code

rfontana — Thu, 19 May 2016 21:28:50 +0000

I am wondering how many of the attendees were older lawyers versus developer-lawyers.

Er, which one am I? :)

A discussion on combining CDDL and GPL code

rahvin — Thu, 19 May 2016 21:23:02 +0000

What I was taught about contract law doesn't support that. Contracts are viewed by the courts by their plain language and violating terms isn't a matter of looking at the spirit. A software license is and is not a contract so they are a bit of a special case but I just don't see the courts looking at this in a loose way where the license is absolutely specific about the requirement.

You might be able to argue the spirit thing as part of a damages review or fair use type defense but IMO the courts are going to take the license and it's strict conditions pretty seriously. And IMO you want those strict conditions or as the article says, the bad actors take the loose view and suddenly the license isn't worth anything.

A discussion on combining CDDL and GPL code

smoogen — Thu, 19 May 2016 12:36:39 +0000

I am wondering how many of the attendees were older lawyers versus developer-lawyers. Developer-lawyers tend to see Laws like strongly typed languages or at most a weakly typed language which an interpreter can be defined. [This also shows up in young lawyers as it makes it easier to approach to the reality..] Older lawyers don't see it as even a weakly typed language. It has rules and a set language but they have gotten used to the fact that exception violations rarely cause a complete fault but more of a "meh, ok lets just work with that and keep going" type of code execution.

In the end, I expect that Eblen's interpretation of how contract and licencing law will actually be interpreted by courts is closer to reality than what I would like it to be. The fact that the GPL and the CDDL are mutually incompatible will end up be 'written' over at some point and the universe will move on.