GPL 3 compatibility

[orblivion]

I noticed that libzim is licensed under GPL 2. Kiwix, a project that depends on it (and it seems you work closely with them), is licensed GPL 3. Or at least, the latest versions of the Kiwix codebase is GPL 3. GPL 2 and GPL 3 are not compatible with each other.

Can libzim be changed to "GPL 2 or later"? Xapian (another Kiwix dependency), for instance, does this.

[kelson42]

@mgautierfr @julianharty So, what do we have for alternatives here? We have also the "problem" with Kiwix-apache. The point is that 90% of the code of the libzim has been written by Tommi who is not active in the project anymore. To my opinion "GPL2 or later" is the best solution, not fan from moving to LGPL or having a dual licensing.

[mgautierfr]

There are different "solutions" here :

• Move to GPLv2 +. This would allow GPLv3(+) software to use libzim (It would be in fact a implicit re-licensing to GPLv3 each time we link with libzim). Moving to GPLv3 would also allow apache2.0 projects to use libzim.
• Move to Lesser GPL. it would allow any project to link to the lib, whatever is its licences (GPLv3, Apache, Proprietary). But only dynamic linking would be allowed.
• Move to LGPLv2+ (or LGPLv3(+)) to allow dynamic linking with all projects and static linking with GPLv3 project (and Apache2.0 project if we move to LGPLv3)
• Dual licensing (but it seems a bit overkill to me and without any added value)

Beside agree on where we are moving on, we also need the agreement of all copyrights holders (developers) of the project to do the re-licensing of libzim. The full list is (in order of appearance) :

• Tommi Mäkitalo (@maekitalo),
• Emmanuel Engelhart (@kelson42)
• Kiran Mathew Koshy (@kiranmathewkoshy)
• C. Scoot Ananian (@cscott)
• Matthieu Gautier ( @mgautierfr)
• Kunal Mehta ( @legoktm )
• Vasudev Kamath (No github account, but commit was introduced with @legoktm PR)

As side comment, keep in mind that even if the problem with kiwix-apache seems related this is a different one. kiwix-apache links with kiwix-lib, not directly with libzim. So if we ends to have libzim kiwix-lib compatible with libzim and kiwix-apache compatible with kiwix-lib, we are good. We don't have to think about kiwix-apache and libzim compatibility (even if I've spoken about Apache licences here).

[cscott]

Out of curiosity, why did kiwix move to GPL 3? Since libzim was GPL2, it seemed it was kiwix changing its license that caused the original problem?

It looks like at this point we'd have to contact a number of people and get them to consent to a license change. Completely apart from any arguments one may have about the merits of the different licenses, I'm curious to know if the # of folks who have contributed to Kiwix under GPLv3 are more/less/the same as the number of folks listed by @mgautierfr above.

[kelson42]

@cscott Kiwix project has been started years before the openzim project. The problem seems to be as old as libzim itself. Except Matthieu and me, nobody has participate to Kiwix source code.

[cscott]

So it seems that @kelson42 officially licensed it under GPLv2 with ee61250 -- before that point there was a COPYING file but the individual files all had "GPLv2+" licenses, for example: https://github.com/openzim/libzim/blob/a1d413d05f361b265d486ce3010f6e078d905a0a/src/file.cpp

So @maekitalo 's contributions look to have been GPLv2+ from the start, at least.

Kiwix was put under GPLv3 by @kelson42 in kiwix/libkiwix@8f11852 and kiwix/kiwix-xulrunner@d0f2456 . Prior to that it appears to be GPLv2+, at least judging from https://github.com/kiwix/kiwix-xulrunner/blob/7b3cb562464356d21c28cba3776f888b51200f5d/kiwix/README

So the most straightforward thing to do seems to be to make zimlib GPLv2+ again, like it was originally, and get releases from those folk who contributed to it after kiwix/libkiwix@8f11852 changed the license from GPLv2+ to GPLv2-only.

[legoktm]

I'm more than happy to re-license all of my contributions as GPL v2 or any later version.

[julianharty]

Here are my thoughts on this topic at the moment (they may be refined during the discussion and based on wisdom and advice from people who understand software licensing better than I do).

Firstly, I think there's a typo in @mgautierfr 's recent comment earlier in this discussion which seems worth clarifying...

@mgautierfr wrote: "So if we ends to have libzim compatible with libzim and kiwix-apache compatible with kiwix-lib, we are good."

Should this instead read?: "So if we ends to have kiwix-lib compatible with libzim and kiwix-apache compatible with kiwix-lib, we are good."

I'll assume so.

The next clarification is what is: what is Kiwix in the context of this discussion?

• is it github.com/kiwix ? (and the predecessor e.g. on SourceForge)?
• or is it a more specific subset of the codebase?

I ask as there are clearly many more than 2 contributors to the set of various kixix codebases on github.com Github lists 33 'people' currently https://github.com/orgs/kiwix/people (perhaps some of these haven't contributed, nonetheless way more than 2 people have contributed across the various kiwix projects) even this file https://github.com/kiwix/kiwix-tools/blob/master/src/server/kiwix-serve.cpp has multiple contributors as git blame shows. I've picked this file in particular as I used it as a source when creating kiwix-apache with the OK of @kelson42 in particular. Although the discussion here is orthogonal to the kiwix-apache source it'd be good to address any licensing and copyright permissions in that file (kiwix-serve.cpp) in tandem with addressing the licensing of libzim and kiwix-lib.

------- My current perspective -------
In terms of general contributions (including mine) to various kiwix codebases (e.g. kiwix-android) I'm willing to do so under the various licenses we agree on. For kiwix-apache my impression is that for it to be accepted by users of Apache modules the most acceptable license for those people will be an Apache license (Version 2.0).

From what I can tell, there are various views on whether it's OK to use a GPL licensed library as part of code released under Apache 2.0. For instance, point 5 in https://www.whitesourcesoftware.com/whitesource-blog/top-10-apache-license-questions-answered/ indicates the mix on Apache 2.0 with GPLv2 isn't acceptable. I don't know enough to be able to make sense of transitive dependencies e.g. if libzim is released under GPLv2+ and kiwix-apache uses kixix-lib (say released under GPLv3 or LGPLv3) do we fulfil the requirements that'll keep both Apache fans and GPL fans happy (i.e. would they both agree that kiwix-apache complies with their various expectations and interpretations)?

BTW: I've just opened kiwix/libkiwix#60 to track the licensing request for kiwix-lib

I'm willing to ask some legal gurus involved in FSFE (of which I'm a member too) for their perspective. Perhaps it's worth waiting until we've reached an initial decision on the appropriate license for libzim?

[kelson42]

Thank you for all the valuable contributions to that ticket. As a side remark, I want to say that kiwix-xulrunner is end-of-life, so it does not matter so much.

To my opinion moving libzim (and kiwix-xulrunner) to GPLv2+ seems to me to me the best option. Then we need to decide the license of kiwix-lib.

[mgautierfr]

Lot of things here :

Context

The next clarification is what is: what is Kiwix in the context of this discussion?

is it github.com/kiwix ? (and the predecessor e.g. on SourceForge)?
or is it a more specific subset of the codebase?

It depends of the context :)

But kiwix-lib, kiwix-xulrunner, kiwix-android and kiwix-tools are all subsets of kiwix code base. So they all inherit the licence of kiwix, which is GPLv3+

The only code base that use directly libzim is kiwix-lib. All other project are using kiwix-lib (and so inderectly libzim). (I exclude kiwix-xulrunner of the discussion here. It is a abandoned project from my pov)

Typos

@mgautierfr wrote: "So if we ends to have libzim compatible with libzim and kiwix-apache compatible with kiwix-lib, we are good."

Should this instead read?: "So if we ends to have kiwix-lib compatible with libzim and kiwix-apache compatible with kiwix-lib, we are good."

Yes, definitely, I've change my comment to avoid confusion.

zimlib licence

tlwr : zimlib seems to be actually GPLv2+

So it seems that @kelson42 officially licensed it under GPLv2 with ee61250 -- before that point there was a COPYING file but the individual files all had "GPLv2+" licenses, for example: https://github.com/openzim/libzim/blob/a1d413d05f361b265d486ce3010f6e078d905a0a/src/file.cpp

The commit you're pointing changes the README file. The COPYING do not change and never change since its first introduction by @maekitalo with commit 6453e09

This file is the GPL2 licence but in section 9 it is stated that it is in the program that the exact version to use is defined. As all file headers have GPLv2+ version it seems to me that the zimlib is actually GPLv2+.

So, it seems that we have nothing to do to allow kiwix-lib to use libzim. Both licences are compatible.

But if we want to allow code in others licences than GPLv2+ (including GPLv3) link with libzim (and this is a open question), we must move to Lesser GPLv2+. (Same for kiwix-lib)

kiwix-apache licence

We mix a bit discussion about different project, but it is probably better to not separate the discussion here.

I've picked this file in particular as I used it as a source when creating kiwix-apache with the OK of @kelson42 in particular

If kiwix-apache is base on a file in GPLv3+ licence you cannot make kiwix-apache with Apache licence. This is the main purpose on copyleft licence : be sure that you cannot remove the copyleft clause. The OK of @kelson42 will no change anything here, he is not the only copyright holder so he cannot re-licence the code.

[cscott]

On Jul 11, 2017 4:58 AM, "Matthieu Gautier" <notifications@github.com> wrote: The commit you're pointing changes the README file. The COPYING do not change and never change since its first introduction by @maekitalo <https://github.com/maekitalo> with commit 6453e09 <6453e09> This file is the GPL2 licence but in section 9 it is stated that it is in the program that the exact version to use is defined. As all file headers have GPLv2+ version it seems to me that the zimlib is actually GPLv2+. So, it seems that we have nothing to do to allow kiwix-lib to use libzim. Both licences are compatible. It's not quite that simple. An explicit license for the overall work takes precedence over the individual licenses for the source files. (The COPYING file is sometimes treated as an implicitly statement of license if no other statement is present, but that's not the case here; and it doesn't clarify GPLv2-only vs GPLv2+ in any case.) So some files were individually GPLv2+ but the combined work was (after the readme) GPLv2. Further contributions that did not contain explicit license text are then assumed to have been contributed under the license of the project as a whole. So we still do need to clarify with all contributors *who did not put explicit license terms on their code* after Kelson's change to the readme that they are willing to relicense, since they contributed to a project whose overall license was GPLv2-only at the time. (Contributors to a single file whose header text already specified GPLv2+ may be an exception.) I don't expect this to be a huge issue in practice. I'll gladly relicense my patches GPLv2+, and Kunal has also already agreed. But I believe strongly in respecting individual's copyrights. It is not right to slap a new license on their code when it was not 100% clear (ie, with an explicit license in their contributed code files) that they were contributing under terms other than those stated in the project README. Let's treat our volunteers with respect.

[mgautierfr]

Further contributions that did not contain explicit license text are then assumed to have been contributed under the license of the project as a whole. [...] (Contributors to a single file whose header text already specified GPLv2+ may be an exception.)

But if the contribution was made on several files all with a GPLv2+ licence ?

But I believe strongly in respecting individual's copyrights. It is not right to slap a new license on their code when it was not 100% clear (ie, with an explicit license in their contributed code files) that they were contributing under terms other than those stated in the project README. Let's treat our volunteers with respect.

I totally agree with you here. But I think that there is nothing to do as I understand that we are in GPLv2+ already.
But I'm not a lawyer. We better have to ask to someone who knows. I will ask to FSF what they think about this.

[cscott]

On Jul 11, 2017 8:18 AM, "Matthieu Gautier" <notifications@github.com> wrote: Further contributions that did not contain explicit license text are then assumed to have been contributed under the license of the project as a whole. [...] (Contributors to a single file whose header text already specified GPLv2+ may be an exception.) But if the contribution was made on several files all with a GPLv2+ licence ? I agree this is likely an exception. There is also often an exception for very short contributions (a few lines of patch) for being not substantial enough for copyright. But we'd need to dive into the details there and catalog the various people's contributions. It might be easier just to get most folks explicit permission to relicense to GPLv2+ and then look harder only at those contributors we are not able to get in touch with. But I believe strongly in respecting individual's copyrights. It is not right to slap a new license on their code when it was not 100% clear (ie, with an explicit license in their contributed code files) that they were contributing under terms other than those stated in the project README. Let's treat our volunteers with respect. I totally agree with you here. But I think that there is nothing to do as I understand that we are in GPLv2+ already. But I'm not a lawyer. We better have to ask to someone who knows. I will ask to FSF what they think about this. Never a bad idea, but again I don't think we'll actually have much of a problem here in practice. I'm just saying let's carefully cross the Ts and dot the Is. --scott

[kelson42]

I think will all agree that GPLv2+ should be (if not "is") the license of the libzim. To get to a perfectly clean solution it seems that I need to clarify with Vasudev and Kiran, which I will do. For the rest, and assuming everbody agrees, what needs concretely to be changed on the code base?

[cscott]

https://fedoraproject.org/wiki/Licensing:FAQ?rd=Licensing/FAQ#How_do_I_figure_out_what_version_of_the_GPL.2FLGPL_my_package_is_under.3F
https://www.gnu.org/licenses/gpl-faq.html#LicenseCopyOnly

You should add a license statement to every file. It is also best to update the README to clearly express the intention that the combined work is licensed under GPLv2+, since individual files (and library dependencies) have have different GPL-compatible licenses (public domain, LGPL, etc). The README also documents the default in case a future contributor adds a new file w/o an explicit license notice.

[kelson42]

I have asked Vasudev and Kiran if they agree with this move (see PR).

[kelson42]

@cscott @mgautierfr @orblivion So I have done (after asking the few last contributors) a few changes. How does it looks like for you now?

[orblivion]

Looks good to me! Thanks for doing this.

[cscott]

Looks good to me.

[kelson42]

Thank you all for your collaboration on this. I invite you to look at the ticket about kiwix-lib licensing kiwix/libkiwix#60