Retrospective license change heads-up: Roundcubemail changed to "GPLv3+ with exceptions and GPLv3+ and GPLv2 and LGPLv2+ and CC-BY-SA and (MIT or GPLv2)"

Jon Ciesla limburgher at
Tue Jun 18 10:54:07 UTC 2013

On Mon, Jun 17, 2013 at 10:32 PM, Adam Williamson <awilliam at>wrote:

> Hey, fun times!
> I'm not the roundcubemail maintainer, but as a user and provenpackager I
> more or less co-maintain it with Jon. I was just doing a 'routine' bump
> to 0.9.2 and noticed the license situation was rather more complex than
> appeared.
> Up to 0.9.0 our package has claimed the license to be "GPLv2". This was
> probably never strictly true, but never mind. It was the license on most
> of the core code prior to version 0.8.0 beta. Upstream in fact changed
> the license on the core code to "GPLv3+ with exceptions" at version
> 0.8.0 beta, something Jon and I presumably missed. That's the main
> change here.
> The exception in question is the following:
> "This file forms part of the Roundcube Webmail Software for which the
> following exception is added: Plugins and Skins which merely make
> function calls to the Roundcube Webmail Software, and for that purpose
> include it by reference shall not be considered modifications of
> the software.
> If you wish to use this file in another project or create a modified
> version that will not be part of the Roundcube Webmail Software, you
> may remove the exception above and use this source code under the
> original version of the license."
> Usually legal@ would have to review and approve this exception, but as
> we've actually been distributing the code for some time, it seems better
> to correct it immediately. I'm in the process of building and testing
> 0.9.2 with the license field corrected; if I don't hear otherwise I'll
> just submit it as an update as usual. If legal thinks we need to do
> anything drastic here, please advise: to me the exception doesn't seem
> like a problem in any way, it's just intended to make sure plugins and
> themes aren't automatically GPLv3+. Worst impact if it's invalid is that
> plugins and themes are actually GPLv3+, which wouldn't be a problem for
> us.
> While checking that I noticed that the overall license situation of the
> package is rather more complex. Several other Things are embedded in
> Roundcube. None of them actually happens to constitute an embedding
> violation, happily, but they do muddy the licensing waters.
> It has embedded copies of the Javascript libraries jQueryUI and tinyMCE
> (javascript is excepted from the embedding policy) and an old copy of
> the Pear library Crypt_GPG - that would be a violation, only we don't
> actually have a php-pear-Crypt-GPG package, so we're okay until it gets
> packaged. I have raised a ticket with upstream -
> - suggesting this should be
> taken out of roundcube's "no-dependencies" tarball; if that happens
> we'll have to package it ourselves and modify the roundcube package
> appropriately. These are variously licensed as LGPLv2 (tinymce and
> crypt_gpg) and "MIT or GPLv2" (jqueryui).
> RC's plugins themselves are all licensed either GPLv2 or GPLv3+. As the
> 'exception' is specifically intended to apply to RC's *core code* and
> let plugins *not* be versioned the same way if they don't want to be, it
> seems odd to suggest the GPLv3+ plugins are actually under RC's "GPLv3+
> with exceptions" license, so I'd hold them to be under pure GPLv3+,
> hence "GPLv3+ with exceptions and GPLv3+". Finally, RC's themes are
> licensed CC-BY-SA, which ultimately gives the final string "GPLv3+ with
> exceptions and GPLv3+ and GPLv2 and LGPLv2+ and CC-BY-SA and (MIT or
> GPLv2)" in all its glory. I may well have got the details a bit wrong
> there, so please, corrections welcome: I'm always around on IRC to
> discuss the details with reference to the source tarball, which is
> available at
> anyone who wants to poke at it. CCing upstream's contact email address
> for feedback from them, in case I misunderstood anything. Upstream, our
> licensing guidelines are at
> and
> , for your reference.
> Yeesh, who'd be a webapp packager.
> --
> Adam Williamson
> Fedora QA Community Monkey
> IRC: adamw | Twitter: AdamW_Fedora | adamwfedora
> --
> devel mailing list
> devel at

Good catches, thanks Adam!


in your fear, seek only peace
in your fear, seek only love

-d. bowie
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the devel mailing list