Is there any clarity on the compatibility of the various CECILL licenses with more conventional ones? CECILL got an update with explicit GPL compatibility, but I haven’t seen such clarifications for e.g. CECILL-C or CECILL-B
so, while CECILL-B and CECILL-C are meant to be _comparable_ with BSD and LGPL, I’m not sure if they’re actually compatible with their analogues.
(IIRC, there’s a path to relicense any such work under CECILL 2.0 and then under GPL, but it’s very non-straightforward, and I don’t see a way to get to e.g. LGPL)
https://www.gnu.org/licenses/license-list.en.html#CeCILL-B (and CECILL-C just below)
doesn’t that forbid distributing the Coq platform, or at least combining CECILL-B,C and GPL code?
for the main CECILL license, this was fixed by releasing an update
the Coq platform is to me not a "combined/derived work", we don't fork the code and modify it. It's essentially just joint distribution. I have a hard time seeing that if I put FreeBSD and a Linux distribution on the same DVD, the whole DVD falls under the GPL.
so what is forbidden by the incompatibility?
and why did CECILL people not release updates to CECILL-B and -C?
basically, if you set up a project licensed under the GPL, I guess you can't use any CECILL-B or CECILL-C libraries in that project (bye, MathComp).
but also if I just want my project to be GPL-compatible
I guess so. Personally, let's just say that GPL-compatibility for my projects is not something I lose sleep over. It just means that someone copies my code and imposes tons of annoying extra conditions for other people using that copy.
“this license is sort-of BSD-style, so you can do pretty much anything with it, except use it in (L?)GPL code” sounds like a licensing nightmare.
fair enough, I guess — to me “GPL-incompatible” is a bit like anti-classical :-)
(that is, it forbids something that I don’t plan to do myself, but that feels like it should be legal)
I wonder how Infotheo manages these conundrums: https://github.com/affeldt-aist/infotheo/#license
IANAL, but I thought that GPL-incompatibility is only problematic when you want to publish a binary?
You can always put some GPL code that depends on a GPL-incompatible library, the only thing you don't have the right to is to compile a binary and distribute the result, or am I mistaken?
@Pierre-Marie Pédrot from https://www.gnu.org/licenses/gpl-faq.html#WhatDoesCompatMean
[GPL compatibility means] you can combine code released under the other license with code released under the GNU GPL in one larger program.
Define "combine"
A strict reading would prohibit you to have GPL incompatible code on the same hard drive as a GPL one
Looking at the infotheo link, I wonder if they have a solution
It's certainly true that some combinations are allowed
I think "combine" comes from "combined work" which I believe has some US legal definition
Linking [name of your program] statically or dynamically with other modules is making a combined work based on [name of your program]. Thus, the terms and conditions of the GNU General Public License cover the whole combination.
Coq proofs are not quite programs.
I personally have no idea what it means to "link" code in the Coq world.
I've seen people argue that "Require" counts as "dynamic linking".
otherwise, if it counted as static linking, I think we are all screwed by Coq's LGPL license (which makes non-dynamic-linking contingent on being GPL'd or LGPL'd)
oh sure
but my point was that Require
should count as (dynamic) linking
but it would be surprising if there was no linking at all, e.g., would it count as using an API? This seems optimistic
If I had to take a position, I'd believe that Requiring is the closest thing we have to dynamic link.
so, haven’t we already a plausible case that infotheo cannot be distributed?
As a binary, most definitely.
your quote mentions dynamic linking, and if Require
counts (which is plausible), we’re done.
IIRC I had found a potential fix, since CECILL licenses have clauses for relicensing and upgrading.
but exercising those clauses required sacrificing quite a few goats
so does anyone want be the bringer of bad news and open an issue? I was honestly hoping to have infotheo in the Coq platform, but if the project itself can't be distributed as a binary, you can't put it in a Docker container and so on.
from my notes: to relicense CECILL-B software, you must add a contribution under the CeCILL-v1 license, to redistribute the whole thing under CeCILL-v1 (under CeCILL-B 5.3.5), then use CeCILL-v1 upgrade clause (12.2) to upgrade to CeCILL-v2, and finally use CeCILL-v2 5.3.4 to upgrade to GPL.
IANAL, and those clauses have some side conditions, but they _don’t_ involve “contact all contributors”
ah, the next step in automation, auto-relicensing -- a bot will add a dummy CeCILL-v1 commit to MathComp, add redistribution/licensing boilerplate, build it, then build infotheo
ROTFL
this is like where all those bots make PRs, then another bot merges and another bot celebrates with a meme
anyway, this is why it’d have been better to have a v2 of CECILL-B and CECILL-C
Our future: https://twitter.com/gabro27/status/1173547934132178944
So this just happened: - a bot found a vulnerability in a dependency - a bot sent a PR to fix it - the CI verified the PR - a bot merged it - a bot celebrated the merge with a GIF https://github.com/buildo/react-components/pull/1367 https://twitter.com/gabro27/status/1173547934132178944/photo/1
- Gabriele Petronella (@gabro27)Dafuq.
The singularity is around the corner...
licensing issues are perhaps the top GitHub issues to report if you are a jerk who likes to appear to be clever. Not much knowledge about code required, developers will inevitably find them super-annoying, and may even have to take them really seriously. Also, relatively high chance of distracting people from getting work done and sowing uncertainty and doubt among users/developers.
I can already see the software engineering paper (maybe already written?): "Our technique found 2000+ potential licensing issues among popular open source projects on GitHub, which our tool duly reported as GitHub issues containing the full legal and technical background [...] responses were regrettably not positive from most project developers."
Legalism is a plague. As a reasonably nice citizen, I break the law literally several times per day. Am I going to be tortured for eternity in the hell of business lawyers if I mistakenly compile infotheo on my computer?
I see it as yet another tool in the toolbox of state, law enforcement, big corporations, etc. They can go after you for these things if it becomes salient for another reason, e.g., to pressure you to sign some document.
my contribution to legalism is (I guess) to force/suggest that people pick some SPDX identifier, rather than writing random silly letter combinations under "license". It's not completely clear what is worse in the long run...
I doubt math-comp authors would sue somebody, but a company (no matter its size) would take a risk in using such software.
to be clear, I only looked into CECILL-B because of some code I was using in my academic project, not because of something I’m using industrially
secret industry Coq project confirmed!
So how about a Ph.D. thesis to formalize licenses in Coq :-)
it's already ongoing to formalize legal documents, although copyright law may be even harder than tax code: https://twitter.com/_protz_/status/1223263479873921024
My student Denis wrote a formal semantics for the French tax code, complete with Coq proof of soundness and SMT queries to uncover unfair tax hikes. PL for fiscal justice! https://blog.merigoux.ovh/en/2019/12/20/taxes-formal-proofs.html
- Jonathan Protzenko (@_protz_)A while back I looked into Grammatical Framework - it might work quite well with Coq. Is is a parser for natural languages with (mildly) dependently typed grammars.
you might be already aware of the autoformalization work by Kaliszyk and Urban? For example: https://arxiv.org/abs/1912.02636
bottom line: it doesn't work that well yet. But Szegedy at Google seemingly thinks autoformalization is the way forward (https://link.springer.com/chapter/10.1007/978-3-030-53518-6_1)
Karl Palmskog said:
licensing issues are perhaps the top GitHub issues to report if you are a jerk who likes to appear to be clever. Not much knowledge about code required, developers will inevitably find them super-annoying, and may even have to take them really seriously. Also, relatively high chance of distracting people from getting work done and sowing uncertainty and doubt among users/developers.
if anyone was wondering, this was a sarcastic comment, and I do think licensing issues should be reported. In my opinion, the best way to avoid licensing discussions is to use and work with projects that have simple and permissive licenses, as often as possible.
@Karl Palmskog regarding the language processing links: I am more a fan of rigid meaning definitions with GF than of machine learning - machine learning can get it arbitrarily wrong - with GF you can clearly define what you mean with certain language constructs. Of cause GF will always lead to a rather restricted language, but it can be a reasonable subset of the language which has a well defined meaning in a given domain like software licenses.
@Michael Soegtrop did you see Hales's summary on controlled natural languages? https://jiggerwit.wordpress.com/2019/06/20/an-argument-for-controlled-natural-languages-in-mathematics/
Sounds like something along those lines. I'm sure people have already tried at high abstraction level for licenses, e.g., all those summaries of Creative Commons licenses.
Michael Soegtrop said:
A while back I looked into Grammatical Framework - it might work quite well with Coq. Is is a parser for natural languages with (mildly) dependently typed grammars.
GF came out of the early work in agda and logical frameworks. So, indeed it is not far from Coq.
About CNL, the declarative mode in Coq was recently removed IIRC
https://link.springer.com/chapter/10.1007/978-3-540-68103-8_5
Here's the connection between GF and agda/alfa
https://cth.altocumulus.org/~hallgren/Alfa/Tutorial/GFplugin.html
@Karl Palmskog , @Théo Zimmermann : the majority of the work of the Coq platform is fixing opam packages - the scripts are not a big deal. I also do not want to hinder e.g. teachers in creating platform variants together with packages which have an uncommon license. In the end it is not enough code to really worry about it. As I said, 90% of the effort is writing opam patches.
Reagrding the binary installer: the expressed opinion of the FSF is that the CECILL-B and CECILL-C licenses are incompatible with any variant of GPL license, which means they are incompatible with the Coq standard library. As I read this one can't distribute Mathcomp and Coq-interval with the Coq standar dlibrary in binary form. Also as I read this .vo files are technically similar to object files and it is obvious that e.g. the matchcomp .vo files are statically linked to the coq standard library.
I think the easiest solution would be if Mathcomp and Coq-Interval would change their license to the respective GPL license they are a variant of. If this cannot be done, one has to study the license conditions very carefully.It might be OK as long as we do not change anything in MathComp or Coq-Interval - that is only deliver plain absolutely unmodified tags, but I am not sure if this is sufficient. An interesting question is e.g. if a delivery containing both source and binary is a source or a binary delivery in terms of the GPL.
All I am saying is that these things need to be clarified before we do a binary release and it might actually get a bit tricky.
Of cause I can delay any annoucement until we have discussed this.
that distributing binaries where there is dynamic linking between LGPL and non-LGPL parts leads to problems whenever the non-LGPL parts are GPL-incompatible would be complete news to me
the reason there are problems with distributing binaries for Infotheo (GPL-licensed) with MathComp (CECILL-B) is at least clear, since GPL needs everything to be GPL-compatible all the time. But LGPL as well? This would make LGPL and GPL observationally equal in my view.
https://cecill.info/licences.fr.html says GPL is compatible with Cecill-*
Do you have a pointer?
Coq and the stdlib are LGPL, which do not require derivative works to be under the same license. I mean, Coq could be linked in a proprietary software. I'm pretty sure it can be put in a bundle with Cecille licensed software, how is the platform different from Debian, Ubuntu, RHL... (I know nothing about Compcert, I'm only concerned about mathcomp).
@Enrico Tassi CECILL (without "-B" or "-C"), version 2, is indeed compatible with GPL explicitly, but to my knowledge no Coq project uses CECILL v2. "-B" and "-C" are claimed by FSF to not be compatible with GPL: https://www.gnu.org/licenses/license-list.en.html#CeCILL-B
Paolo came up with a rather ingenious way to convert any CECILL-B or CECILL-C project to GPL without changing the project upstream, but it requires actually changing the project locally: https://coq.zulipchat.com/#narrow/stream/237663-coq-community-devs.20.26.20users/topic/CECILL.20licenses.20and.20%28L%29GPL.20compatibility/near/209174197
I think we rather definitively established that using this conversion path is the only way one could legitimately co-distribute MathComp with Infotheo as .vo
files (the latter is GPL-3)
but bottom line for the projects originally discussed, my analysis disagrees with Michael's: I believe there is no obstacle to co-distribute .vo
files for Coq Stdlib (LGPL) and MathComp-* (CECILL-C or CECILL-B)
I'm sure all math comp devs would be happy to ease the distribution of MC if there was a real need by bumping the license. I'm not a big fan of cecill, but the incompatibility argument of GNU (you said FSF, not exactly the same thing) is, hem, not very fundamental and reasonably easy to comply to. 5.3.4 is essentially requiring to credit the original authors and put some stuff online. In these cases I suggest we do a reality check: did anyone claim this incompatibility in a court (because a website does not really count as a source of legislation, in any law systems I've heard of)? Also, would an entity ever start a lawsuit to obtain some credits to be put online (if they are not yet)? Lawsuits are for money, if there are no money to gain and no software to "free" (this is not my opinion, is what real lawyers told a bunch of Debian people worried of distributing software with problematic licenses).
basically, Paolo's conversion path ("-B or -C" to full GPL) is something that could be done by anyone, at any time, from any revision of MathComp.
I think most people consider FSF to be the ultimate authority on what is compatible with GPL or not (they have some very experienced copyright lawyers on staff). But probably, -B/-C vs. GPL has not been tested in court.
I'd be willing to take a bet that the Debian legal team will go with FSF's interpretation of CECILL-B/CECILL-C compatibility with GPL. Hence, they would not want to package MathComp together with Infotheo. So we are basically discussing and operating in the shadow of the law, regardless of what the law says.
regarding "GNU says" vs. "FSF says":
This page is maintained by the Free Software Foundation's Licensing and Compliance Lab.
The whole license stuff is indeed quite annoying - in the end it is all source and nobody wants to take any rights of anybody and still we are having issues.
My summary line: I haven't though this through (had to many technical issues up to now) and before we do a binary release we have to think this through and document the rationale.
I think worst case we have the option to deliver certain pieces as source and compile them on the machine of the user if needed.
The whole relicensing plan of @Paolo Giarrusso is way over complicated. CeCILL is one of these licenses which has an "or-later" clause by default:
12.3 Any Software distributed under a given version of the Agreement may
only be subsequently distributed under the same version of the Agreement
or a subsequent version.
You don't have to modify the software to distribute it under the new version of CeCILL which is compatible with the GPL. Furthermore, you don't have to go further than this. GPL-compatibility is GPL-compatibility. Why would you ever need to relicense to the (L)GPL itself?
And yes, if that helps we could ask the math-comp maintainers themselves to upgrade the license version in the repository.
EDIT: no in fact, he was right, because only the main (GPL-like) CeCILL license has a v2 version.
Anyway, I agree that certain questions may need to be clarified but I'd like to avoid any public announcement that because of these questions we might never provide a binary installer for the platform.
Furthermore, it's not like these questions do not already apply to the Windows installer. So it would be pretty inconsistent to announce this, and release 8.12.1 with the usual Windows installer with add-ons just a few days later.
@Théo Zimmermann : OK, I will remove this message and just say "we are working on it".
Regarding the licensing stuff I suggest the following:
I would appreciate it if someone could help with the first two points above.
@Théo Zimmermann : I adjusted the ReadMe and also changed the beta1 tag to the new commit. Can you please check if this is OK now?
@Michael Soegtrop You haven't yet removed or adjusted the sentence "It is not yet decided if also Windows and Mac installers will be created. The main issue here is not technical but some unresolved questions on license compatibility of binary distributions." from the release notes (https://github.com/coq/platform/releases/tag/v8.12.0%2Bbeta1). Did you intend to do this as well?
@Théo Zimmermann : ah yes sorry - I thought you meant the similar comment in the ReadMe. I now also adjusted the release text.
Théo Zimmermann said:
The whole relicensing plan of Paolo Giarrusso is way over complicated. CeCILL is one of these licenses which has an "or-later" clause by default:
12.3 Any Software distributed under a given version of the Agreement may only be subsequently distributed under the same version of the Agreement or a subsequent version.
You don't have to modify the software to distribute it under the new version of CeCILL which is compatible with the GPL. Furthermore, you don't have to go further than this. GPL-compatibility is GPL-compatibility. Why would you ever need to relicense to the (L)GPL itself?
And yes, if that helps we could ask the math-comp maintainers themselves to upgrade the license version in the repository.
I did bring up the topic at the MathComp meeting, but we did not even discuss it, because MC is under CeCILL-B (which is not CeCILL) and there is no version 2 of CeCILL-B. CeCILL-B is BSD-like, while CeCILL is GPL-like. For sure I can't upgrade CeCILL-B to v2 because there is no such a thing, and we are not "upgrading" a BSD license to a GPL one. I'm lost in this conversation.
Thanks for the feedback and sorry for the confusion then. I'll look into it more closely.
Enrico Tassi said:
https://cecill.info/licences.fr.html says GPL is compatible with Cecill-*
In fact, this claim is only made for the main (CeCILL v2) license, so this is consistent with the info on the FSF website.
This topic was moved here from #coq-community devs & users > CECILL licenses and (L)GPL compatibility by Théo Zimmermann
So I tried to read everything again and I have to agree that the situation is seriously messed up.
Regarding the CeCILL-B / GPL incompatibility which affects infotheo, the simplest solution to me would be a relicensing of infotheo. If the authors are few enough they can decide the relicensing together to any license. If they really wish to keep the strong copyleft aspect they could relicense to CeCILL v2 (which is compatible with math-comp's license and also with the GPL). But relicensing to a permissive license would be even better.
[Off-topic]: We should really discuss if we wish to include strong-copyleft-licensed libraries in the platform.
Regarding whether math-comp license would be incompatible with stdlib's license LGPL v2.1 and whether Require
counts as dynamic linking or not: LGPL does not mandate dynamic linking and basically the dynamic linking clause does not apply if you provide the source code for everything. So no, I really don't think there are any issues with math-comp + stdlib binary distribution.
Finally, I am really surprised that the concerns raised by the FSF regarding the GPL-incompatibility of CeCILL-B and -C and the fact that these licenses were never OSI-approved did not concern the French institutions that created this family of licenses enough to publish a new version for those as well.
Maybe someone should write to Inria management about this...
Oh but in fact, that's interesting: CeCILL-B and -C were published at the same date as CeCILL v2 (in 2006). Why were there never OSI-approved, I have no idea.
@Théo Zimmermann so you’re also wishing for a V2 of the B and C variants? Thanks for confirming
Yes, despite all the trouble that the FSF has created for everyone, CeCILL arrived much later and only added to the mess. FSF is the leading authority regarding GPL-compatibility and GPL is the historic and most used copyleft license, so also the license every other free software license should be compatible with. It would really be a shame if Inria and its partners did not fix the mess they made despite having the power. But the fact that there was no release for the last 14 years (despite the FSF note which probably is quite ancient) does not give me high hopes.
The legit part of considering writing a new GPL license is that the big fat warning "this comes as is, your problem" is not really valid in Europe, IIRC. You can't give someone a drink of yours, tell him "use at your own risk", and be clean if the drink was poison. So that clause is not valid. From this to going the full distance of writing another license is another story, and doing it without chatting with FSF enough to make it compatible, well, it's as silly as it sounds.
Anyway, I take the massage that MC wise, licensing is not problematic for the platform.
@Paolo Giarrusso what @Théo Zimmermann suggests, is that the -B variant is already as good as a V2 (well, there was no V1, but since its only version was released at the same time of the v2, it is likely not to contain any problematic section).
Agreed that it's legit. Too bad they didn't talk with the FSF first indeed.
But I'm not saying that the -B variant doesn't contain the problematic section, the description of the FSF regarding this problematic section is precisely about the -B and -C variants.
@Enrico Tassi what might be appropriate from the MathComp side: add a big fat warning somewhere in the documentation not to license a project that uses MathComp under the GPL - even if it hasn't been established in court that "-B" is incompatible with GPL, that FSF says it's incompatible should scare everyone away from using MC+GPL nevertheless
@Enrico Tassi If you happen to be willing to track down all copyright owners, a relicensing of math-comp under "your choice of CeCILL-B or BSD3" or whatever permissive license you wish (BSD3 is just the most similar) would be great for the ecosystem.
Hum, the problem is that the copyright owners are Microsoft and Inria. In particular that license was picked at the time of the join lab.
I guess I'll go for the warning with a pointer to https://www.gnu.org/licenses/gpl-faq.html#GPLIncompatibleLibs (btw you can use GPL, but you have to write down an exception).
Karl Palmskog said:
I'd be willing to take a bet that the Debian legal team will go with FSF's interpretation of CECILL-B/CECILL-C compatibility with GPL. Hence, they would not want to package MathComp together with Infotheo. So we are basically discussing and operating in the shadow of the law, regardless of what the law says.
It's worse than this. They seem to consider that CeCILL-B is not a free software license, so this would jeopardize any packaging attempt of the platform into Debian (see https://github.com/coq/coq/issues/9281), although it was already discussed at the time that there is a trivial upgrade path (to CeCILL-C) that allows to get rid of this clause (see the e-mail sent to the mailing list by the author of this issue).
And to clarify: I wasn’t wishing for a GPL-ed math-comp, and my “license hack” wasn’t meant as a good idea, and I’d hope something simpler is possible.
But if the CeCILL authors acknowledged FSF’s concerns enough to create a CeCILL-V2, it’s even more unfortunate that -B and -C don’t have compatibility clauses.
Théo Zimmermann said:
It's worse than this. They seem to consider that CeCILL-B is not a free software license, so this would jeopardize any packaging attempt of the platform into Debian (see https://github.com/coq/coq/issues/9281), although it was already discussed at the time that there is a trivial upgrade path (to CeCILL-C) that allows to get rid of this clause (see the e-mail sent to the mailing list by the author of this issue).
This time you are stretching it too much. What the FSF qualifies as free software (or GPL compatible) is not what Debian considers as free (that is DFSG). As I wrote in the issue there, Debian accepted CeCILL-B software before. The license has been considered DFSG compliant by the authoritative Debian team (which is not the debian-legal mailing list: there is no professional lawyer on debian-legal, just in case you were mislead by the name of the list, it's just a place where certain discussions start and hopefully where they stay...).
What the GPL incompatibility may prevent is to package and redistribute infoteo without having its license to be amended (via an exception, or by adding to the GPL the funny redistribution "via a website" clause that is in CeCILLE). In that respect I see the relevance for the platform. Also changing MC license would fix that, but I'm afraid it is not the easiest of options.
The email sent by Benjamin to debian-legal got no answer. He proposed the upgrade path, but nobody acknowledged it was possible AFAICT.
for extra clarity, Infotheo is currently not even a candidate to join the Platform (although I personally would like for it to join, if legal issues can be resolved). My main use of it was to illustrate potential legal issues the platform could be subject to as it grows.
Thanks for clarifying that it is considered DFSG compliant. FSF does make the distinction between free and GPL compatible, but I wasn't talking about this.
I am one of the authors of infotheo which is mentioned as part of the problem but I actually missed most of this conversation. I have now contacted the other authors to inform them and to look for a solution.
(It looks like I was not "subscribed" to the stream actually. I am not sure what it means but that would maybe explained why I did not see the conversation.)
affeldt-aist said:
I am one of the authors of infotheo which is mentioned as part of the problem but I actually missed most of this conversation. I have now contacted the other authors to inform them and to look for a solution.
fwiiw, we agreed on relicensing to LGPL
MIT or MPL 2 is recommended over LGPL:
https://github.com/coq-community/manifesto
(yes, I did see that, still...)
I missed the discussion. Do you disagree, or was LGPL the best compromise?
Maybe the latter (I am not the only ingredient in the decision process). No disagreement with the manifesto anyway.
at least we are near-100% LGPL is GPL-compatible, and quite-near-100% it can be distributed together in binary form with CECILL-B/C, so altogether a big improvement!
Last updated: Jun 05 2023 at 10:01 UTC