Cleaning up licensing #288

Closed
headius opened this Issue Oct 28, 2013 · 102 comments
@headius

We need some help to tidy up licensing. Most of the original code was written by @wmeissner but there have been contributions since then. I do not have a strong preference for license, but we need it to be clear and consistent. Going back to BSD, staying on LGPL (with fixes), or choosing something like Apache-2 are all options to me.

Please make licensing updates as PRs and reference this issue.

Waiting for confirmation (on moving to BSD) from @sdaubert

@stouset

Given the Ruby community's tendency to prefer the BSD license, if it's possible I would tend to prefer that.

I'm not entirely up to speed on the current situation, however. Can you give a quick summary of the issues? If this is a scenario where the licensing issues are particularly thorny, we may be forced to go with whatever option is the least difficult.

@headius

I believe this codebase started out as BSD under @wmeissner, then changed license to LGPL at some point after contributions had been accepted from external contributors.

So we have a few options. The path we take depends on which license we want to go to (and NEVER CHANGE AGAIN).

  • For LGPL: Any users that contributed before LGPL would need to be contacted to make sure they're willing for their contributions to be licensed LGPL.
  • For BSD: Any users that contributed after LGPL would need to be contacted to make sure they're willing for their contributions to be licensed BSD.

Your point about Ruby community and BSD has a lot of merit. I wish the Ruby community preferred Apache-2, since it's a better license (patent language, etc), but at this point the path of least resistance seems to be go to back to BSD.

@stouset

How many contributors are we talking about, for either case? It looks like the license was switched to the LGPL... two years ago? Is that correct?

At the very least, we need to start going through the project and figure out which and how many lines of code seem to be "officially" under each license. In the event we can't get a release from the original authors, I assume they will need to be rewritten.

@luislavena

@headius can't you say that the original inspiration and base code was taken from Rubinius work (Evan Phoenix work) and from there extended and modified?

Originally Evan code was BSD, but later on moved to LGPL. Only problem I see with LGPL is inability to run on some environments where *GPL licenses are not allowed (the original case that triggered this)

From my personal point of view and my contributions to the project, I'm OK with BSD or Apache-2 license (if that is also an option).

We should mention all the usernames of contributors listed here:

https://github.com/ffi/ffi/graphs/contributors

And make them chime in about the license, that way we have a public record where everybody can agree (or disagree).

@enebo
ffi member

All contributors should be asked to assign their copyright to FFI project in addition to asking about their preference of licenses. This requires some level of trust but since this project was able to change licensing for nearly 3 years before it became a vocal issue I think the trust must already be there :)

@headius

@luislavena The API design and some of the .rb support code from Rubinius helped bootstrap this, but largely the implementation was done by @wmeissner on his own. Rubinius's native code depended heavily on Rubinius internals, and so it could not be reused. Also, @wmeissner first did an implementation for JRuby that reused very little code, and then did a second implementation for MRI.

BSD seems simplest still.

@headius

@stouset If we assume all commits occurring after the LGPL switch are now LGPL code, we just need to contact contributors since then. Contributors prior to that would already have agreed to their code being BSD, which I think is where we're headed.

@stouset

I've emailed you a list of contributors since 281e656 which appears to be the commit that the license was changed in. Didn't want to paste it here in case you wanted to contact the authors through another channel.

@headius

@stouset Thanks! Will have a look.

@headius

I have sent out an email to the contributors @stouset provided, and will also include the same message and list of users here to keep things public:

Dear @Burgestrand, @P3t3rU5, @Paulche, @albanpeignier, @andrewvc, @avalanche123, @blaxter, @burns, @candlerb, @ctide, @dbussink, @djberg96, @douglaswth, @drbrain, @emboss, @eradman, @flavorjones, @headius, @hobophobe, @hubertlepicki, @invalid-email-address, @kuwa72, @larskanis, @lucsky, @luislavena, @meh, @mvz, @nagachika, @nevir, @nurse, @pck, @phasis68, @postmodern, @remogatto, @rmm5t, @sadkingbilly, @sdaubert, @skoba, @stepheneb, @sunaku, @terceiro, @tmm1, @wmeissner, @wycats, @xman

We are tidying up some licensing issues with the FFI gem (https://github.com/ffi/ffi) and need your help.

A couple years ago, the codebase was switched to LGPL by its primary contributor. Because some of the original code was BSD licensed, and because that is a license that Rubyists are more comfortable with, we would like to revert to BSD.

You are being emailed because your contributions to ffi/ffi came after the LGPL switch, and we need your permission to go back to BSD.

PLEASE COMMENT on this issue saying you consent to having your contributions licensed under BSD:

Thanks so much for your help!

@rmm5t

I consent to having my contributions licensed under BSD.

@ctide

I consent to having my contributions licensed under BSD.

@sunaku

I consent to having my contributions licensed under BSD.

@aniederl

I consent to having my contributions licensed under BSD.

@drbrain

I consent to having my contributions licensed under BSD.

@pck

I consent to having my contributions licensed under BSD.

@Burgestrand

I consent to having my contributions licensed under BSD.

Actually, I’m fine with any of the three mentioned choices.

@avalanche123

I consent to having my contributions licensed under BSD.

@headius

I consent to having my contributions licensed under BSD.

(Might as well make it official)

@P3t3rU5

I consent to having my contributions licensed under BSD.

@ghost

I consent to having my contributions licensed under BSD.

@hobophobe

I consent to having my contributions licensed under BSD.

@tmm1

I consent to having my contributions licensed under BSD.

@blaxter

I consent to having my contributions licensed under BSD.

@lucsky

(raises right hand and put left hand on the pickaxe)

I consent to having my contributions licensed under BSD.

@Paulche

I consent to having my contributions licensed under BSD.

@candlerb

I consent to having my contributions licensed under BSD.

@douglaswth

I consent to having my contributions licensed under BSD.

@stouset

@headius I'll start matching usernames to the email addresses I provided you earlier, so we can contact them out of band if they don't get in touch soon. Also so we can start determining which lines of code are still in license limbo.

@headius

@stouset Ok, sounds good. There are several contribs that do not match github names or who contributed under bogus email addresses, so I'm not sure what we can do for them.

@headius

@stouset FWIW, I did email all the addresses you sent me with the same text as above. So we'll give it a day or two to settle down and then see who we have not heard from.

@stouset

Ah, ok. No worries then. I'll still start work on determining which lines may need to be rewritten.

Can you copy/paste any email responses you get here, just so there's an authoritative, public place to track all replies?

@djberg96

I consent to having my contributions licensed under BSD.

@headius

@stouset I will ask folks who reply by email to respond here on the record.

@stouset

@albanpeignier's 1 contribution was merged post-LGPL, but technically written against the BSD license. Can probably scratch that off the list.

@cfis

I consent to having my contributions licensed under BSD.

@luislavena

I consent to having my contributions licensed under BSD.

@phasis68

I consent to having my contributions licensed under BSD.

@sadkingbilly

Hmm, I don't think I ever contributed to this project, was this email sent to me by mistake?

@headius

@stouset Ok thanks...I'll remove him from the call list.

@terceiro

I consent to having my contributions licensed under BSD.

@luislavena

@sadkingbilly one commit is shown for you:

https://github.com/ffi/ffi/commits?author=sadkingbilly

It was committed by @terceiro but mention you as author.

@dbussink

I consent to having my contributions licensed under BSD.

@stouset

@flavorjones' has no contributions during the LGPL days.

@sadkingbilly

@luislavena Ok, some dark magic here, I only had that github account for ~6 months, but that looks like something I might have done 2 years ago :-).

Anyway, I consent to having my contributions licensed under BSD.

@stouset

@headius @postmodern's two contributions were likewise merged during LGPL, but written against BSD.

@stouset

@headius @remogatto has no contributions during the LGPL days.

@headius

@stouset You keep saying MIT (license) but you mean BSD, right? I don't think the project was ever licensed under MIT.

@stouset

Yeah, I'm an idiot. Sorry. Edited my previous comments to remove confusion.

@stouset

@headius @wycats also has no contributions during the LGPL days.

@headius

I will update description with remaining folks who have not confirmed, and we'll just whittle people away.

@mvz

I consent to having my contributions licensed under BSD.

@meh

I consent to having my contributions licensed under BSD.

@headius

If someone wants to help tidy up license-related stuff in docs and code headers, now would be a good time to start working on that PR :-)

@stouset

I've run the commit IDs against the remaining contributors. Here's the number of LGPL lines remaining in the repo, by author.

   1 @hubertlepicki
@ghost

I consent to having my contributions licensed under BSD.

@emboss

I consent to having my contributions licensed under BSD.

@douglaswth

@sadkingbilly The old commit has an email address that you have now claimed is yours in Github, no special black magic at all.

@stepheneb

I consent to having my contributions licensed under BSD.

@skoba

I consent to having my contributions licensed under 3 or 2 clause BSD license.

@headius

FWIW, it looks like it was 3-clause BSD before, so that's what we'll return to.

@nevir

I consent to having my contributions licensed under BSD.

@postmodern

@headius is there a legal reason why we are switching licenses?

@eradman

I consent to having my contributions licensed under BSD.

@headius

@postmodern IANAL so I can't comment on whether there's a valid legal reason. What I know is that when the code moved to LGPL it's unclear whether all past contributors agreed to that change. It seems simplest to get recent committers to agree to just switch back to BSD. Changing to LGPL requires as much work and taints the project (in many minds) by attaching it to GPL. Changing to anything else would require consent from every history contributor.

@luislavena

@postmodern this was raised due several concerns about not clear licensing, not maintaining of original code licensing and not clear for contributors which license the code was released in.

@postmodern

@headius @luislavena code with the LGPL header is under the LGPL. As for changing the license, the best resource I could find was catb. Also, a perception that LGPL "taints" a project is not a valid legal reason. ;)

@drbrain

@postmodern you don't need a legal reason to change a license. Provided all the contributors agree, a license can be changed for any reason at all.

If we lack consent then two options remain, either abandon the license change or remove the contributions of those that do not consent.

@luislavena

@postmodern IANAL, like @headius said. Let's not turn the issue into a discussion of the legality or not of LGPL. As expressed at the top of the issue, current licensing might have not been clear to the contributors, wasn't transparently communicated to the users and translated into other issues for some inadvertently using this project in their projects.

@xman

I consent to having my contributions licensed under BSD or LGPL.

@postmodern

@luislavena since I've tangled with the GPL before, a few clarifications. rubygems.org does list ffi as LGPL-3, the repository has a COPYING file in it, and source files have the LGPL header. I consider that standard license advertisement to contributors. Also, the LGPL license explicitly allows for commercial linking/inheritance. The few companies that completely avoid GPL/LGPL, do so mainly because of the so-called "Tivoization" clause that was introduced in v3. Imho, LGPLv3 should not affect your average end-user/developer/startup.

I just want to make sure there are concrete legal benefits to the project, and that we're not just Appealing to Popularity. Going from dual-licensed to single-license seems reasonable.

@luislavena

@postmodern the project was not LGPL at the beginning: https://twitter.com/luislavena/status/394228584199372800

Let's not turn this into a debate about good vs evil in licensing.

@postmodern

@luislavena I assume we already checked whether or not @wmeissner cleared the BSD->LGPL change with existing contributors/copyright holders? I assure you, I wasn't trying to reframe this debate, just pointing out some facts about the LGPLv3.

@nagachika

I consent to having my contributions licensed under BSD.

@wycats

I consent to having my contributions licensed under BSD.

@kuwa72

I consent to having my contributions licensed under BSD.

@flavorjones

I may not have any relevant commits, but if so: I consent to having my contributions licensed under BSD.

@remogatto

I consent to having my contributions licensed under BSD.

@nurse

I consent to having my contributions licensed under BSD.

@larskanis

Wow, all the high society of ruby development in one thread 👍

I consent to having my contributions licensed under BSD.

@headius

@postmodern I'd say the LGPL to BSD move (return, really) is motivated by a few factors:

  • Original codebase was BSD and not all contributors consented to moving to LGPL.
  • Going back to BSD seems easier than moving forward to LGPL.
  • libffi itself is MIT licensed, which is closer to BSD.
  • GPL-related licenses scare some users away.

The main legal reason to adjust the license is because we'll finally have all contributors on the same page, agreeing to the same license.

@actsasbuffoon

@headius It appears that you're updating the issue as people sign off. I just wanted to point out that rmm5t and xman have both consented in this thread, but haven't yet been scratched off the list. That brings us down to three outstanding contributors.

@headius

@actsasbuffoon Thanks, I knew I'd missed a couple.

@stouset

Excellent. @sdaubert has 1,768 LOC in the repository as it currently stands (compared to 1 LOC for the other guy), so if we can get in contact with him we should be good to go.

@headius

By my count we're still missing: @andrewvc, @hubertlepicki, @sdaubert

@headius

Anything in the neighborhood of a few lines of code would likely be considered a "trivial change" for licensing/copyright/ownership purposes, so perhaps we only need confirmation from @sdaubert if the other two have only trivial changes.

@stouset

@headius The code from the one commit by @andrewvc is no longer in the latest version of the repo. It was nuked in this commit.

@headius

Ok confirmed, we're down to just @sdaubert. However he does not appear to have been active on Github for some time, and his changes were zero-sum renaming in code (trivial) or documentation (probably trivial). I'll keep trying to contact him but I think we may be good to go.

@stouset

@headius And @hubertlepicki's one commit is just a doc fix, so is probably easy to classify as a trivial change.

@stouset

Here's the list of non-comment, non-blank lines of code in the current master branch that were contributed by @sdaubert.

@andrewvc
@sdaubert

I consent to having my contributions licensed under BSD.

@stouset

The only remaining LOC not accounted for is a one-line doc fix, and could be considered a trivial change. I think we're covered.

@postmodern

@headius did you verify that @wmeissner went from BSD->LGPL without asking any of the previously contributors? If the previous contributors can verify they never received an email about the license change, than this seems reasonable. I assume you've secured the consent of @wmeissner. Also, do you need my consent?

@headius

@postmodern Yes, @wmeissner has given his consent, and it would be good to get your consent, even though none of your commits came after the license change.

I'm checking to confirm that some old contributors did not explicitly consent to the license change. I and several others made that assumption, but I want to confirm it.

Regardless, given how pervasive FFI use has become, I think avoiding *GPL in the "ffi" gem's license is still the best plan.

@headius

I have made a pass at replacing the LGPL license with BSD throughout the codebase, and I'm going to mark this fixed. If there's any additional changes needed to migrate, file new issues/PRs for those please.

Thanks everyone for your help and patience with this, and thanks to all contributors who provided their consent.

@headius headius closed this Oct 29, 2013
@stouset

👍

Thanks for the hard work. It's awesome that this was resolved so quickly.

@rosenfeld

Out of curiosity, what is the problem with LGPL? @luislavena said "Only problem I see with LGPL is inability to run on some environments where *GPL licenses are not allowed (the original case that triggered this)". What is this original case? Which environments don't allow LGPL that affected this library?

@hubertlepicki

oh wow, I'm the one left.

I consent to having my contributions licensed under BSD.

@headius

@hubertlepicki Hahah...thanks :-)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment