Lmoments3 license conflict

[saschahofmann]

Setup Information

• Xclim version: 0.47.0

Context

A few versions ago, xclim adopted lmoments3 as a core dependency.
Lmoments3 has the GPL 3 license which in my understanding means that every library that has it as a core dependency needs to also be GPL 3 because its a contaminating license. Xclim however has the Apache 2.0 license. I am not sure what are the implications for us who use xclim but as a result also import lmoments3? Any chance lmoments3 could also adapt Apache 2.0?

Thanks for providing us with these amazing tools ✌️

[aulemahal]

Good point. lmoments3 is kinda dead though. However, we (ouranos) do control the fork that publishes to pypi. For the last year, I think we are the only contributors/maintainers to the package, so you don't be afraid of us suing ourselves about this ;).

But, @Zeitsperre is there a possibility to change the license? Would we need the approval of the original creators?

[Zeitsperre]

@saschahofmann

Thanks for raising this discussion point. You're absolutely right that lmoments3 can't be a core dependency under the current licensing scheme. It's clear that we are violating GPLv3, so that needs to be fixed ASAP.

Following from @aulemahal, I was also under the impression that because we currently hold the maintenance responsibilities for lmoments3 that we didn't need to follow this limitation, but for those who use license verification tools (like FOSSA, which we currently use, yikes), that need to ensure that their core dependency stack is free from GPL'd code, this is a major problem.

Indeed, we would need to contact all previous maintainers and contributors to change the license of lmoments3, so I don't think we can go that route. Would it make more sense to simply make it an optional library again, or does that still cause issues for us?

@saschahofmann do you have any knowledge of how to resolve this without changing licenses?

This should be addressed before the next release.

[aulemahal]

@saschahofmann Yes indeed, to be clear we need to convince:
@monocongo, @faph and @samgillespie.

[saschahofmann]

Totally understand. I think if you were to change it back to an optional library, it'd be nice to include a way to enable us to use distributions that we can implement ourselves?

[Zeitsperre]

@saschahofmann

The main problem I see is that loading a GPL'd library within your code base via import is considered "linking". Whether that is creating an integration or aggregation is up for debate.

My impression (IANAL) is that going back to dynamically linking to it again as an optional dependency (locally-imported within an optional function) is the easiest way out of this sticky situation for the time being. A standard installation of xclim would then provide no GPL'd software. I still need to read more.

[saschahofmann]

I am looking at the original fortran code here which has a pretty short disclaimer
I

BM SOFTWARE DISCLAIMER

LMOMENTS: Fortran routines for use with the method of L-moments

Permission to use, copy, modify and distribute this software for any purpose
and without fee is hereby granted, provided that this copyright and permission
notice appear on all copies of the software. The name of the IBM Corporation
may not be used in any advertising or publicity pertaining to the use of the
software. IBM makes no warranty or representations about the suitability of
the software for any purpose. It is provided "AS IS" without any express or
implied warranty, including the implied warranties of merchantability, fitness
for a particular purpose and non-infringement. IBM shall not be liable for any
direct, indirect, special or consequential damages resulting from the loss of
use, data or projects, whether in an action of contract or tort, arising out of
or in connection with the use or performance of this software.

Without having done it before, maybe nowadays it's easy to transpile to python and release that under the Apache 2.0 license. I might look into this should there be no movement on the lmoments3 repo.

[aulemahal]

hmm I fear a very useful part of lmoments is the wrapping it does into scipy.stats, which wouldn't be covered by transpiling the Fortran code I think.

[Zeitsperre]

@saschahofmann

If you can't reach them through the information on the readme. I can help and try find some information. The two extra people you are talking about would be Sam Gillespie and Florenz A.P. Hollebrandse right?

If you were willing to follow up with the other maintainers of lmoments3, I think it's safe to say that @aulemahal, @huard, and I would be willing to effect the license change.

[saschahofmann]

Moving the discussion to the lmoments3 library Ouranosinc/lmoments3#12

[Zeitsperre]

Ok, so I have some good news and bad news.

The bad news: It looks like the Apache v2.0 license is only compatible with GPLv3 in one direction (Apache-licensed software being integrated into GPLv3'd software) : https://www.apache.org/licenses/GPL-compatibility. This means that we might need to make some breaking changes in the immediate future:

• The lmoments3 based functions cannot remain in xclim. My understanding is that there is no way around this, beyond making subprocess.run() calls to lmoments3. The fact that we don't import Copyleft-licensed libraries is why we can safely list things like pylint in our dev dependencies (no dynamic-linking or code extensions; just software being called)
• (Unless the upstream license is modified) the lmoments3-xclim integration code can ONLY be licensed under GPLv3. It's clear that this code is a modification of existing GPLv3-licensed code. There is not much to debate.
• (Unless the upstream license is modified) using lmoments3 constitutes the downstream user and associated projects needing to be comfortable with the GPLv3. I can't think of any other interpretation.

The good news: There is nothing preventing us from integrating xclim as an optional component in lmoments3. We hold the maintenance rights to the library and under the Apache-V2.0 license, we can dynamically link/integrate xclim without any issues. I'm not sure how this coudl work (might require some changes on the xclim end).

@aulemahal How complicated would it be to pass lmoments3 distribution code to an indice externally?

[Zeitsperre]

Some more contextual information: https://opensource.stackexchange.com/a/6036/14792

[faph]

Could I just get a point of clarification please?

Am I understanding it correctly that lmoments3 as a library is a dependency of xclim, another library? If so, xclim is never bundled or distributed with lmoments3 itself?

If that's the case, end users are OK to install them side by side on their own machine without further distributing. Is that correct?

[faph]

I see, I think the mere import statements can be interpreted as being enough to make the whole thing linked under GPL.

[saschahofmann]

Yes I am quite confident that importing and in this case even using functionality of lmoments3 inside xclim code is not "communication at arms length", hence xclim would need to adapt the GPL-3 license itself or remove the dependency.

[saschahofmann]

I think the second point is along the lines of what @Zeitsperre is suggesting:
Remove the dependency of lmoments3 from xclim but enable users to provide a distribution function (that could come from lmoments3) to the relevant functions. This solves the problem for xclim but of course users like myself who would like to use xclim with lmoments3 now need to publish their programs under GPL-3

[faph]

Got you. I responded on the lmoments3 thread. I am happy to surrender my rights under the GPL if that is possible...

[Zeitsperre]

Hi @faph, thanks for your time! Yes, the fact that we extended lmoments3 in xclim is the issue at hand. This completely took me by surprise as well. I've studied some (environmental) law in a previous life, but that doesn't make for much of a software licensing expertise.

Whether or not we can change the license, there are clearly some changes that should be made in xclim regardless. We would need to have the consent of all parties who contributed to the Python code base (the original code in FORTRAN is under a more permissive license, thankfully). Assuming we have that, we would simply need to update our licensing as well as the authorship and rights in the README.

[samgillespie]

I'm also comfortable with these licensing changes, I'm happy for this code to be as freely distributable as possible.

[Zeitsperre]

Xclim has refactored the way that lmoments3 can be passed to its internals to not infringe on the GPLv3 license. Until the license can be changed in lmoments3, this discussion is resolved. Thanks, everyone!