Retrospective license change heads-up: Roundcubemail changed to "GPLv3+ with exceptions and GPLv3+ and GPLv2 and LGPLv2+ and CC-BY-SA and (MIT or GPLv2)"

[Jon Ciesla]

On Mon, Jun 17, 2013 at 10:32 PM, Adam Williamson <awilliam at redhat.com>wrote:

> Hey, fun times!
>
> I'm not the roundcubemail maintainer, but as a user and provenpackager I
> more or less co-maintain it with Jon. I was just doing a 'routine' bump
> to 0.9.2 and noticed the license situation was rather more complex than
> appeared.
>
> Up to 0.9.0 our package has claimed the license to be "GPLv2". This was
> probably never strictly true, but never mind. It was the license on most
> of the core code prior to version 0.8.0 beta. Upstream in fact changed
> the license on the core code to "GPLv3+ with exceptions" at version
> 0.8.0 beta, something Jon and I presumably missed. That's the main
> change here.
>
> The exception in question is the following:
>
> "This file forms part of the Roundcube Webmail Software for which the
> following exception is added: Plugins and Skins which merely make
> function calls to the Roundcube Webmail Software, and for that purpose
> include it by reference shall not be considered modifications of
> the software.
>
> If you wish to use this file in another project or create a modified
> version that will not be part of the Roundcube Webmail Software, you
> may remove the exception above and use this source code under the
> original version of the license."
>
> Usually legal@ would have to review and approve this exception, but as
> we've actually been distributing the code for some time, it seems better
> to correct it immediately. I'm in the process of building and testing
> 0.9.2 with the license field corrected; if I don't hear otherwise I'll
> just submit it as an update as usual. If legal thinks we need to do
> anything drastic here, please advise: to me the exception doesn't seem
> like a problem in any way, it's just intended to make sure plugins and
> themes aren't automatically GPLv3+. Worst impact if it's invalid is that
> plugins and themes are actually GPLv3+, which wouldn't be a problem for
> us.
>
> While checking that I noticed that the overall license situation of the
> package is rather more complex. Several other Things are embedded in
> Roundcube. None of them actually happens to constitute an embedding
> violation, happily, but they do muddy the licensing waters.
>
> It has embedded copies of the Javascript libraries jQueryUI and tinyMCE
> (javascript is excepted from the embedding policy) and an old copy of
> the Pear library Crypt_GPG - that would be a violation, only we don't
> actually have a php-pear-Crypt-GPG package, so we're okay until it gets
> packaged. I have raised a ticket with upstream -
> http://trac.roundcube.net/ticket/1489182 - suggesting this should be
> taken out of roundcube's "no-dependencies" tarball; if that happens
> we'll have to package it ourselves and modify the roundcube package
> appropriately. These are variously licensed as LGPLv2 (tinymce and
> crypt_gpg) and "MIT or GPLv2" (jqueryui).
>
> RC's plugins themselves are all licensed either GPLv2 or GPLv3+. As the
> 'exception' is specifically intended to apply to RC's *core code* and
> let plugins *not* be versioned the same way if they don't want to be, it
> seems odd to suggest the GPLv3+ plugins are actually under RC's "GPLv3+
> with exceptions" license, so I'd hold them to be under pure GPLv3+,
> hence "GPLv3+ with exceptions and GPLv3+". Finally, RC's themes are
> licensed CC-BY-SA, which ultimately gives the final string "GPLv3+ with
> exceptions and GPLv3+ and GPLv2 and LGPLv2+ and CC-BY-SA and (MIT or
> GPLv2)" in all its glory. I may well have got the details a bit wrong
> there, so please, corrections welcome: I'm always around on IRC to
> discuss the details with reference to the source tarball, which is
> available at
>
> http://downloads.sourceforge.net/roundcubemail/roundcubemail-0.9.2-dep.tar.gzfor anyone who wants to poke at it. CCing upstream's contact email address
> for feedback from them, in case I misunderstood anything. Upstream, our
> licensing guidelines are at
> https://fedoraproject.org/wiki/Packaging:LicensingGuidelines and
> https://fedoraproject.org/wiki/Licensing:Main , for your reference.
>
> Yeesh, who'd be a webapp packager.
> --
> Adam Williamson
> Fedora QA Community Monkey
> IRC: adamw | Twitter: AdamW_Fedora | identi.ca: adamwfedora
> http://www.happyassassin.net
>
> --
> devel mailing list
> devel at lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/devel


Good catches, thanks Adam!

-J

-- 
http://cecinestpasunefromage.wordpress.com/
------------------------------------------------
in your fear, seek only peace
in your fear, seek only love

-d. bowie
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/devel/attachments/20130618/76f8f03e/attachment.html>