Incorrect/mixed licensing headers in some source files

Bug #1167034 reported by Alec Leamas
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Odoo Server (MOVED TO GITHUB)
Fix Released
Medium
OpenERP's Framework R&D

Bug Description

IN 7.0 there are license conditions where I cannot understand the effective license.

In the first example a AGPL license block is pasted above a the original LGPL2.1+ license. What the is effective license for the file in this case (AGPL 3.0+ ? LGPL 2.1+)? This is for
- report/render/rml2html/rml2html.py
- report/render/rml2pdf/utils.py

In the next example the license roughly says "some portions of this file is AGPL2.1+, some portions are LGPL 2.1+". What is the effective license in this case? This is about a large number of files, see the "AGPL (v2.1 or later) LGPL (v2.1 or later)" header in the attachment. One example is
- .../openerp_report_designer/bin/script/NewReport.py

I get the impression that OpenERP, SA have tried to relicense the original work in these cases. I'm by no means a lawyer, but it looks like these attempts has not been done in a proper way, and that thus any distribution of these files are problematic from a legal point of view(?). For Fedora, this is certainly is problem, and will most likely block the packaging of version 7.0.

I suggest OpenERP, SA sticks to the original LGPL 2.1+ license adds it's copyright notice to the existing licerse block. Or contacts the original author to get a permission to relicense completely. Or possibly clarifies the license in some other way.

Here are lso a large number of files without license clause. GIven the complicated licensing with at least three licenses in use, this also makes it harder to understand the legal status of the package. See attachment.

Revision history for this message
Alec Leamas (leamas-alec) wrote :
Revision history for this message
Alec Leamas (leamas-alec) wrote :

Opps right comment in wriong bug. Please discard comment #2

Revision history for this message
xrg (xrg) wrote : Re: [Bug 1167034] Re: Bad licensing

On Wednesday 10 April 2013, you wrote:
> ** Attachment added: "License check output"
>
> https://bugs.launchpad.net/openobject-server/+bug/1167034/+attachment/3635
> 899/+files/licensecheck.txt

Some quick notes:

server/*/services/websrv_lib.py MUST be LGPL'd . I wrote that lib and
explicitly wish it to be available for any GPL or non-GPL project.

addons/document[_ftp|_webdav]? Shall have the [A]GPL license like the rest of
OpenERP. That means, I permit OpenERP SA. to change their license from GPLv2
to [A]GPLv3, in accordance with the rest of OpenERP.

What I (as a copyright holder) do NOT permit is to have any other 3rd party,
proprietary or non-GPL (aka "Enterprise") license ..

server/*/report/rml2pdf: You should investigate more. We'd better trace the
origins of that code to ensure it is not derived from the closed-source
utility offered there: http://www.reportlab.com/software/reportlab-plus/

Revision history for this message
Alec Leamas (leamas-alec) wrote : Re: Bad licensing

Hi Panos! Long time, no see:)

About rml2pdf: as far as I'm concerned, I trust the license data stated by OpenERP. That is, the responsibility to find out whether rpm2pdf really is LGPL/ AGPL/whatever is OpenEPR, SA's since they define the license.

I really don't question the license terms as such, just tries to understand what the license texts mean and their implications. Currently, the provisionary answer is that current license conditions blocks use of OpenERP 7.0 in Fedora. Since this is just about licensing, the conclusion should be valid for all distros.

As for relicensing addons/docuement/[_ftp|_webdabv] stuff I have no opinion about this. Even if these files are relicensed, there's still a lot of GPLv2+ and GPLv3+ files. Although somewhat complicated. this is perfectly OK to package and distribute.

The problem is the files with multiple licenses with no clue about what license applies to what code.

Revision history for this message
Alec Leamas (leamas-alec) wrote :

I also note that websrv_lib.py seems to have a GPL license, which contradicts Pano's requirement on LGPL. However, this is between Panos and OpenERP; I have no part in this discussion. As of 7.0, this file clearly has a GPLv2+ license.

Revision history for this message
Alec Leamas (leamas-alec) wrote :

Discussion in fedora-legal mailing list: http://lists.fedoraproject.org/pipermail/legal/2013-April/002125.html.

Conclusion is as I feared: these licenses are simply not usable, and cannot go into Fedora (and really no other distro). I suggest that:

- The first two examples are relicensed using the original LPGL license, adding OpenERP's copyright notice
- Likewise with the .../openerp_report_designer/* files
- That the discussion between Pano and OpenERP, SA about websrv.py is resolved.

My assessment is that distributing these files will cause legal problems unless these issues are resolved. The packaging of 7.0 for Fedora is blocked by this bug.

What I do here is questioning whether it's legal to distribute this package. This is no minor issue, and I would appreciate a reaction from the copyright owners.

Revision history for this message
Alec Leamas (leamas-alec) wrote :
Revision history for this message
Alec Leamas (leamas-alec) wrote :
Revision history for this message
Alec Leamas (leamas-alec) wrote :
Revision history for this message
Alec Leamas (leamas-alec) wrote :

These four patches should fix this issue. Of course, since this about licensing I cannot apply them myself.

Revision history for this message
Olivier Dony (Odoo) (odo-openerp) wrote :

Hi Alec,

You're right these files have received incorrect license headers at some point and we need to correct them. Thanks a lot for spending the time to track them, researching the proper way to fix them and submitting the patches!
Your patches look good to me after a quick scan, I'll double-check and apply them as soon as possible in the 7.0 branches. They're indeed quite low-risk in terms of features ;-)

@Panos: thanks for your input on this, it's very appreciated!

Note: the rml2pdf/rdf2html stuff was written by Fabien Pinckaers as part of his master's thesis at UCL before the creation of TinyERP/OpenERP, as an open source alternative to ReportLab's closed-source libraries.

Changed in openobject-server:
assignee: nobody → OpenERP's Framework R&D (openerp-dev-framework)
importance: Undecided → Medium
milestone: none → 7.0
status: New → Confirmed
summary: - Bad licensing
+ Incorrect/mixed licensing headers in some source files
Revision history for this message
Olivier Dony (Odoo) (odo-openerp) wrote :

Alec, your patches have landed in 7.0 at the following revisions:
 - server: rev 4951 rev-id: <email address hidden>
 - addons: rev 9051 rev-id: <email address hidden>

Thanks for reporting and providing the fix (and for your patience! :-))

Changed in openobject-server:
status: Confirmed → Fix Released
Revision history for this message
Alec Leamas (leamas-alec) wrote :

Thanks for fixing, I'll resume the 7.0 packaging for Fedora later this week.

If you really appreciate my patches, perhaps you could have a look at bug 993414 ? This is by no means a blocker, but a pain in the ass. For that, I have no patches but instead the commands to apply; it should also be a quick fix.

Revision history for this message
Alec Leamas (leamas-alec) wrote :

Reopening. Unfortunately, my last patch was not complete and did not update five files. Attaching new patch. which fixes this.

I will take this bug as a clear message of OpenERP, SA's intent to relicense these files according to this patch and will continue the Fedora packaging on these premises. That said, this is still a legal issue and thus not trivial.

Changed in openobject-server:
status: Fix Released → New
Revision history for this message
Alec Leamas (leamas-alec) wrote :
Revision history for this message
Olivier Dony (Odoo) (odo-openerp) wrote :

Thanks for the update! I've applied your new patch verbatim to the openobject-addons branch, but I modified the openobject-server part to match what we did to the other rml2html/rm2pdf files last time: keep only the LGPL license and discard the AGPLv3 boilerplate. Any particular reason why this time you had kept the AGPLv3 license instead for the rml2pdf/utils.py file?

The updated revisions:
- server 7.0: 4964 rev-id: <email address hidden>
- addons 7.0: 9081 rev-id: <email address hidden>

Changed in openobject-server:
status: New → Fix Released
Revision history for this message
Alec Leamas (leamas-alec) wrote :

No, I probably just got it wrong. As long as the licenses re consistent, this is basically your show and and have really no opinion. Thanks for fixing

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.