Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LXD now re-licensed and under a CLA

stgraber.org

Post reply on HN
Print view View original

91–100 of 102 posts

Re: LXD now re-licensed and under a CLA

#91

Post by tsimionescu »

pessimizer wrote: post #71
tsimionescu wrote: post #34

Earlier quoted context omitted.

Licenses don't typically allow licensees to re-license code. You can use Apache v2 code in a proprietary or AGPL product and redistribute binaries or other source code derived from it under any other license, but you can't change the license of the original code: anyone can still use it under the Apache license. Conversely, a copyright holder may re-license code. Depending on the exact terms of the old license, this…

> Licenses don't typically allow licensees to re-license code. This still doesn't make any sense. Permissive licenses are designed to allow code to be relicensed freely, hence the term "permissive." There may be a few catches, like having to include attribution or a copy of the old license, but if those were significant, the code wouldn't be open source. How could that interpretation be compatible with the fact that…

Think about it like this. If I redistribute a BSD licensed piece of code released by the OpenBSD project, I have to include a note saying that "this product includes code from the OpenBSD project". If I allow others to redistribute my code, I still have to require those others to include this notice. I can't take the OpenBSD project's code and redistribute it under a license that says "you don't have to give any attribution".

However, as the copyright holder, the OpenBSD project can decide to relicense their code under a new license that says "no attribution is required". They can even do so selectively: they can sell you code under this license, but keep distributing the one with attribution required to others. The provenance of a copy of code becomes important in these cases, since different copies may have different license terms attached.

The MySQL project was doing exactly this before the Oracle acquisition, this is not a theoretical idea. You could get the code for free under the terms of the GPLv2 (or 3?), or you could buy a commercial license from them that allowed you to redistribute the binary with any modifications without sharing source code.

Re: LXD now re-licensed and under a CLA

#92

Post by Tomte »

shp0ngle wrote: post #41
jorams wrote: post #19

Earlier quoted context omitted.

If you add a dependency without understanding the license that dependency is released under, you should stop doing that. That counts for every license, and particularly if there is no license.

It goes transitively though. Some popular go packages grab tens (sometimes over hundres, but not as much as in node world) dependencies. NOBODY checks the license all the transitive dependencies in go world. What should or should not happen is one thing, this is the reality edit: oh but that lead me to google this neat https://github.com/google/go-licenses

Yes, that's why (apart from the Cyber Resilience Act) license scanners and SBOMs are a thing.

Re: LXD now re-licensed and under a CLA

#93

Post by shp0ngle »

DannyBee wrote: post #66
shp0ngle wrote: post #12

"As a result, Canonical cannot release LXD under the AGPLv3 license and likely never will be able to. LXD is now under a weird mix of Apache2 and AGPLv3 with no clear metadata indicating what file or what part of each file is under one license or the other." IANAL but that's not true? You can take Apache2 and relicense it under AGPL? You can take "less copyleft" license and make it "more copyleft". https://www.gnu.or…

Lawyer here "IANAL but that's not true? You can take Apache2 and relicense it under AGPL? You can take "less copyleft" license and make it "more copyleft"." No you can't. That's also not really what is happening here in the link you list. This gets complicated very quick (and 90% of HN comments in this thread are already sort of wrong), but the short version is: When you aggregate existing works into a larger work, y…

You can legally say "this whole code is AGPLv3, based on works by these people under Apache". You cannot be legally obliged to say which parts are Apache and which parts are not.

That makes no sense; that would make releasing the binaries and putting them under copyright illegal too as there is no source code.

Someone can still come and cherry-pick the old Apache code, yes. But you (canonical in this case) don't have to say which parts are which, and as the project goes on and new work is added it will be pretty hard to do.

That's basically what LibreOffice did with OpenOffice.org code...

Re: LXD now re-licensed and under a CLA

#94

Post by tarruda »

janosdebugs wrote: post #89
DannyBee wrote: post #66

Earlier quoted context omitted.

Lawyer here "IANAL but that's not true? You can take Apache2 and relicense it under AGPL? You can take "less copyleft" license and make it "more copyleft"." No you can't. That's also not really what is happening here in the link you list. This gets complicated very quick (and 90% of HN comments in this thread are already sort of wrong), but the short version is: When you aggregate existing works into a larger work, y…

If Canonical took code from Incus, wouldn't they also need to include their NOTICE file if they have one as required by the Apache license? Would not including that file constitute removal of copyright management information?

I'm curious as to what qualifies as "taking code". If you copy some code and change variable names, do some minor refactoring or reformatting, is that considered the same code?

Re: LXD now re-licensed and under a CLA

#95

Post by diffeomorphism »

stgraber wrote: post #29
kragen wrote: post #21

the main reason there's a version 2 of the apache license is to ensure that it's clearly legal to incorporate apache-licensed code into gpled systems such as this new version of lxd it is correct that the ubuntu company cannot prohibit people from copying and modifying stephane's code, or indeed the entire previous version of lxd, under the terms of the apache license. but they can certainly keep using his code in ne…

Anyone is welcome to use my code in a proprietary piece of code, indeed the Apache2 license allows it. What it doesn't allow is for my code to be re-licensed to AGPLv3 nor can they grant themselves a license to do whatever they want (their CLA). So indeed they could keep importing Incus bugfixes and new features into LXD, but that code would need to have an exception carved out in their current contribution requireme…

> What it doesn't allow is for my code to be re-licensed to AGPLv3 nor can they grant themselves a license to do whatever they want (their CLA).

According to

https://softwarefreedom.org/resources/2007/gpl-non-gpl-colla...

it does both with minor caveats.

For the "relicensing" it will have to preserves license information, e.g.

> (C) new guy AGPL license text

> Also incorporates work with the following license

> (C) stgraber apache license text

In practice that is the same as being AGPL licensed because doing otherwise would violate new guy's license.

For the CLA nobody ever suggested they can do "whatever they want". What seems entirely possible however is for them to offer an entirely apache2 licensed version (the original version is apache2 and, only at their discretion, so are all future changes) as well as an AGPL licensed version.

Re: LXD now re-licensed and under a CLA

#97

Post by kragen »

pessimizer wrote: post #79
kragen wrote: post #78

Earlier quoted context omitted.

i guess you could comply by leaving the apache 2 license in there but then not say which files it applies to, but then you'd be licensing the whole work under the apache 2 license i don't think you can comply by just removing the apache 2 license you're right about 'jeez' and i've removed it

LGPLv3 is more restrictive than Apache 2. The point as that every source file will be under LGPLv3, because it will be Apache 2 code mixed with LGPLv3 code. The Apache 2 code will remain Apache 2 code, but in a pointless way.

agreed, once further modifications accrete

Re: LXD now re-licensed and under a CLA

#98

Post by contact9879 »

tarruda wrote: post #94
janosdebugs wrote: post #89

Earlier quoted context omitted.

If Canonical took code from Incus, wouldn't they also need to include their NOTICE file if they have one as required by the Apache license? Would not including that file constitute removal of copyright management information?

I'm curious as to what qualifies as "taking code". If you copy some code and change variable names, do some minor refactoring or reformatting, is that considered the same code?

It'd be considered a derivative work.

Re: LXD now re-licensed and under a CLA

#99

Post by bscphil »

shp0ngle wrote: post #93
DannyBee wrote: post #66

Earlier quoted context omitted.

Lawyer here "IANAL but that's not true? You can take Apache2 and relicense it under AGPL? You can take "less copyleft" license and make it "more copyleft"." No you can't. That's also not really what is happening here in the link you list. This gets complicated very quick (and 90% of HN comments in this thread are already sort of wrong), but the short version is: When you aggregate existing works into a larger work, y…

You can legally say "this whole code is AGPLv3, based on works by these people under Apache". You cannot be legally obliged to say which parts are Apache and which parts are not. That makes no sense; that would make releasing the binaries and putting them under copyright illegal too as there is no source code. Someone can still come and cherry-pick the old Apache code, yes. But you (canonical in this case) don't have…

Your point is why I've always said that the "you can't relicense" people are playing a smoke and mirrors sideshow, and trying to skate by on technicalities.

No you can't literally make it the case that the code that used to be licensed as Apache is now licensed GPL. On the other hand you are free to convey that code under the terms of the GPL, without clearly specifying to others exactly which lines of code are Apache, except insofar as that license requires you to to do so. And you're free to create a combined work that the GPL (or another compatible license) applies to, and require a CLA for contributions to that combined work. In fact the Apache 2.0 license says you're free to "provide additional or different license terms ... for any such Derivative Works as a whole" (my emphasis).

But nobody ever thought you can "change the license" in that overly-literal sense, so far as I know. It's not what people who say "relicensing" mean in the software world, and the lawyers who talk as if we did completely miss the point.

> You cannot be legally obliged to say which parts are Apache and which parts are not.

This is not strictly accurate, in that you can't remove existing copyright statements from the source form of the work, under Apache 2.0:

> You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works

That would presumably include copyright statements placed on the original source files, if those exist. But you aren't obligated to do the work of explaining to others exactly which source lines have which copyright, as Apache does not obligate you to do so.

Re: LXD now re-licensed and under a CLA

#100

Post by creatonez »

jraph wrote: post #11

Is this FUD? [edit: it's not, see the replies - I kept my original comment below because that's what people answered to, but I no longer agree with it] --- The linked announcement says > Going forward, any contribution to LXD will be made under AGPLv3 by default. The author of a change remains the copyright holder of their code (no copyright assignment). Emphasis mine. No copyright assignment. So, Canonical now contr…

> Contributors may contribute in Apache 2 if they wish but probably won't bother.

They couldn't make a contribution under Apache 2 that is a derivative of AGPLv3 code. It will have to be bound by the licenses of both at the same time (or be based on a clean-room implementation of the AGPL code additions -- good luck with git merge)

Post reply on HN