[U-Boot-Users] GPL 2 "or later" concern

[Jerry Van Baren]

Andy Green wrote:
> Jerry Van Baren wrote:
> 
>> If you have source code that is GPLv2 "or later", it is *your* option to 
>> exercise the "or later" clause on the source you hold.  If the copyright 
> ...
>> Downstream recipients cannot force *you* to exercise the "or later" 
>> clause and force you to GPLv3.  It is their option to convert the source 
>> that they hold to GPLv3, but that change flows downstream, not upstream.
> 
> Well until the GPL V3 comes out, the "or later" protocol is completely 
> untested, since this is the first chance to use it.  Here is a 
> hypothetical scenario a few months from now: that a recipient is told by 
> the distributor that he may use the given software under V3 terms if he 
> likes (this is the "or later" language in the license).  The recipient 
> says, "cool, I will modify the software you gave me under V3 terms 
> then".  Then the recipient points to section 1 of GPL V3
> 
> http://gplv3.fsf.org/gpl-draft-2006-07-27.html
> 
> ''1. Source Code ... The Corresponding Source also includes any 
> encryption or authorization keys necessary to install and/or execute 
> modified versions from source code...''
> 
> and he says "well then, can I have your signing keys so I can install my 
> version?"  The distributor smiles and says, "oh no, I gave you that 
> package under GPL v2 terms you see, there is no requirement on me to do 
> that".  The recipient says, "I don't know about that, nothing in writing 
> about it is there?  But what is in writing, on the license you gave me, 
> it says I can 'modify' the code under GPL V2 'or later'.  So I want to 
> do that under V3 terms like I said, and you offered in writing.  So your 
> keys please!"
> 
> I don't know if that would fly or not, but distribution of signed GPL V2 
> "or later" code means the signing keys are hostage to the outcome of 
> such an attempt, whereas GPL V2-only code is safe from it.

The distributor smiles and says "Sorry, you cannot take _my_ source code 
to GPLv3 since it is licensed GPLv2 _only_.  You can take the source 
code that licensed GPLv2 "or later" to GPLv3, BUT THAT IS NOT A LICENSE 
BETWEEN YOU AND ME.  Oh, and by the way, if you do that, you will not be 
able to use _my_ GPLv2 only code with it."  (See GPLv2 Section 6, GPLv3 
Section 2, and GPLv3 Section 10).

Lets say Dan Malek writes a whizzbang bootloader program named PPCBoot 
and licenses it GPLv2 "or later".

This gives you a license to use the said source code and add your 
"special sauce," as long as you abide by the rules of GPLv2 ("or later", 
but you choose to abide by GPLv2 only).  You are free to license your 
"special sauce" GPLv2 _only_ because that is also compatible with Dan's 
code.

Say you sell your widget to Joe Schmuk.  GPLv2 obligates you to provide 
both Dan's PPCBoot source code plus your "special sauce" source code to 
Joe.  The critical item here is that you are *not* sublicensing Dan's 
source - Joe's only license to Dan's source is via GPLv2 "or later" 
directly with Dan, not via you (GPLv2 Section 6, quoted below).  The way 
I read this, Joe force you abide by any GPLv3 licensing based on his 
license with Dan (PPCBoot) because you are not party to that licensing 
agreement.  In particular, if he takes his PPCBoot code, which he has 
licensed from Dan directly (per GPLv2 Section 6) and takes it GPLv3, 
that is between him and Dan, you and not involved in any way and he 
cannot force you to convert _your_ copy of PPCBoot to GPLv3 because your 
copy is separately licensed between _you_ and Dan.

----------------------------------------------------------------
   6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions.  You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.
----------------------------------------------------------------

In GPLv3, this is more explicit:
----------------------------------------------------------------
2. Basic Permissions.

[snip]
Propagation of covered works other than conveying is permitted without 
limitation. Sublicensing is not allowed; section 10 makes it 
unnecessary. Conveying is permitted under the conditions stated below.
----------------------------------------------------------------
FWIIW, GPLv3 Section 10 is the equivalent of GPLv2 Section 6, quoted 
previously, but is not a direct copy.

Joe's only license to your "special sauce" is your GPLv2 _only_ license, 
and that license is with you (Dan isn't involved).  Joe can do what he 
likes with Dan's license and you are not involved in that licensing.  To 
argue that you are involved since you conveyed the source would be to 
argue that Dell is party to the Microsoft EULA of every PC they sell 
since they were the distributor of that software.

FWIIW, the way I read GPLv2 and GPLv3, if Joe converts the source he 
licensed from Dan (PPCBoot) to GPLv3 (which he is free to do), he will 
no longer be able to use your "special sauce" code with it because the 
GPLv3 licensed code is no longer compatible with your GPLv2 "special 
sauce".  The result is Joe's conversion of Dan's license to GPLv3 only 
"hurts" him in that it increases the limitations on what he can now do 
with his copy of Dan's code.

>> P.S. I deduce you don't care, but a big part of the consternation over 
>> Linus' GPLv2 _only_ stand is because it is impossible to convert the 
>> linux kernel to GPLv3 (you would have to get all copyright holders, 
>> starting with Linus, to convert their copyrights to GPLv2 "or later" or 
>> GPLv3 only).  As a side effect of this, GPLv3 _only_ code will *not* be 
>> able to be linked with linux kernel code because GPLv3 puts more 
>> restrictions on the code than GPLv2, making it *incompatible* with 
>> GPLv2.  Only GPLv2 or GPLv2 "or later" code will be legal in the kernel 
>> (and GPLv2 "or later" is frowned on and probably isn't accepted per the 
>> stated philosophies of Linus).
> 
> Well I would say that I do care about it, but that Linus' stance makes a 
> lot of sense to me.  An interesting consideration is that the FSF has a 
> monopoly on creating GPL versions, and that if your project uses the "or 
> later" language, it can mean you can see your project being distributed 
> or modified under terms that you didn't want or ask for, depending on 
> what the FSF (ie, RMS) decide to place in the next version which is out 
> of your control.  (Admittedly the old rules are still allowed too, so 
> that should put a limit on how crazy it can get.)  But only the FSF can 
> generate a new version of the GPL which can be applied as an option to 
> all existing GPL V2 "or later" projects by magic.
> 
> -Andy

gvb