7 ms·

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 https://github.com/minad/mimemagic/issues/97 > I've hi

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that you're shipping mimemagic under (MIT) isn't compatible with shared-mime-info's. Seems like quite a reasonable request, even if folk don’t like the results. ..and to be clear, I’m quite sure that rolling back to the commit before the license change does exactly nothing to address the issue. You don’t magically get your MIT license back by forking before the license change was added, that’s not how it works. If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license.

gedy 6y ago
I guess this is subjective (though maybe not legally), but this lookup table of extensions to mimetypes doesn't feel like GPL "software". It's just a description of other software's conventions using the GPLed source as a reference: https://github.com/minad/mimemagic/blob/master/lib/mimemagic/tables.rb#L3 https://github.com/minad/mimemagic/blob/master/lib/mimemagic... To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list?
- imhoguy 6y ago
  vs this https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/master/data/freedesktop.org.xml.in https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/m...
  - Xylakant 6y ago
    In a twist of irony, the software for which the copyright claim breaking rails was made is hosted on the free edition of gitlab, which is based on rails.
    - Deradon 6y ago
      And according to the twitter-bio of the individual, who brought this up, he's related to Red Hat, which are also affected [^1]. [^1]https://github.com/RedHatInsights/compliance-backend/pull/795 https://github.com/RedHatInsights/compliance-backend/pull/79...
- Denvercoder9 6y ago
  > this lookup table of extensions to mimetypes doesn't feel like GPL "software". Copyright nor the GPL are limited to software, collections of data are copyrightable as well; and thus they can fall under the GPL as well. > To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list? Yes.
  - toast0 6y ago
    > collections of data are copyrightable as well Collections of data are sometimes copyrightable. Depending on the jurisdiction, it may depend on the details of the collection.
  - murderfs 6y ago
    Data in and of itself cannot be copyrighted under U.S. copyright law: "creative arrangement" of it can be, but given that the data in question was generated from XML file, I don't think you could make a claim that the arrangement was copied.
    - whimsicalism 6y ago
      ? I don't follow - it seems pretty clear that this falls under the GPL from my reading of what is copyrightable, ie. they can't copy your compilation of the data.
      - rst 6y ago
        Your reading of what is copyrightable may not be entirely in accord with the US Supreme Court's, which has ruled that mere compilations of factual data (a telephone directory in the case that set the precedent) are not copyrightable. https://en.wikipedia.org/wiki/Feist_Publications,_Inc.,_v._Rural_Telephone_Service_Co https://en.wikipedia.org/wiki/Feist_Publications,_Inc.,_v._R.... If someone is trying to apply the GPL to stuff which isn't legally copyrightable in the first place (as may be the case here), then their copyright isn't enforceable, and neither is the GPL.
  - vertis 6y ago
- boleary-gl 6y ago
  Or use another source that is non-GPL - that's proposed here: https://github.com/rails/rails/issues/41750#issuecomment-805827334 https://github.com/rails/rails/issues/41750#issuecomment-805...
- jahewson 6y ago
  I agree. Lists of facts are not eligible for copyright in the US, most famously phone books. It’s debatable as to whether or not this file is pure facts but I’m having a hard time seeing it as a “creative expression”.
alberth 6y ago
> "You don’t magically get your MIT license back by forking before the license change" Am I understanding this correctly. If for example, 15 years you have an MIT code base with only MIT code. Then yesterday, you add a few lines of GPL code. Then today, you remove 100% of the GPL code you just previously added in order to revert back your codebase to be only MIT code ... it's no longer "MIT"? The GPL has now tainted their entire existing codebase?
- psanford 6y ago
  No.
- terramex 6y ago
  No, in this hypothetical case you would be fine. Mimemagic case is more like 15 years ago you had a MIT codebase that contained hidden GPL-derived code. One day you are notified about that violation and relicense whole codebase to GPL, but the code that was already in the repository before has never been truly MIT - it was always violating GPL. To fix this you can either relicense whole codebase to GPL (what mimemagic chose) or remove GPL code from codebase, stop distribution of older versions and continue your project as MIT. Going back to older version of code does not change anything as now everybody is aware of violation so you don't even have plausible deniability. You would need to fork from commit before adding GPL code, but this is impossible for mimemagic as it contained this code since day one.
onli 6y ago
> If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license. This depends. Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for their usage back then. You can in general never retroactively change a license, so their usage back then was certainly valid. You can [be forced to] stop using a license and re-license future versions of an artefact, and also possibly have to stop distributing the old versions. But that's on the gem's author, not Rails, and would likely not even impact future usage of the old, already obtained versions. If the original author wanted to claim damages under GPL from Rails, he would have to do so via the gem's author. And even then: What damages? And would the projects have had to know? None and no is the likely answer, safe juridical incompetence/corruption like in the Oracle-API case. It would be further be complicated by the file in question being a database file. You typically can not license databases in a meaningful way under GPL. Even if you could, reading a GPL'd database has no chance of carrying GPL code obligations over to the consuming program. As always with those questions, this might depend on your specific jurisdiction. Also, it means in no way that it is not the ethically right thing to swap the dependency to one that does not have this issue. PS: Also consider that in most uses of Rails, GPL or MIT does not change much, as accessing a server running GPL software does not trigger GPL's distribution clause (you want the AGPL for that). This already limits the impact here. The Github thread has comments in the direction of all Rails projects having to be open source now if the license changed to GPL. Not only can the license of old versions not change, this is also not the effect GPL would have.
- tsbinz 6y ago
  > Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for their usage back then. > You can in general never retroactively change a license, so their usage back then was certainly valid. I would ask a lawyer about that. As it has been explained to me, the original author didn't have the right to distribute it under the MIT license, so they (rails) never had a valid license. It's similar with images, even when you grab it off flickr or another page and it specifies a license you like, that does not mean that whoever posted it there actually had the right to do that, and if they didn't, you can get sued.
smarx007 6y ago
One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something. The original request in https://github.com/minad/mimemagic/issues/97 https://github.com/minad/mimemagic/issues/97 that you linked to was very polite and professional. 1) A time extension to remove the GPLed code could be politely requested. I know that the copyright belongs to all contributors but getting on good terms with the maintainer could be a solid first step. I think just opening a PR with that file deleted (and tests failing) could have been interpreted as a willingness to comply with the request in good faith. 2) A request to relicense the XML file in question under LGPL could have been sent to the original project (could be problem without CLAs, but still worth a try). Then the library could have been relicensed under LGPL. 3) Gem users could have been notified. Some prominent people from those projects could have helped with (1) and joined a kind request (2) to the original project. At least that's how we'd (try to) handle it on our project under Eclipse Foundation (though we used to have a GPL code scanning for releases in the first place until very recently) if such situation arose. Anyway, talking to people first before doing something quickly is often a good idea.
- ericbarrett 6y ago
  > One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something. Once you've been informed of a violation, you have a legal duty to act, no? Regardless of whether counter-action is immediately threatened. (Not a lawyer, not legal advice)
  - cwyers 6y ago
    The question is, what act do you take? It's possible to negotiate and get a grace period to get into compliance, for instance.
  - ysavir 6y ago
    At the end of the day, it's people involved, and people have the capacity for understanding and empathy. A safe course of action would be for the maintainer to respond with a message like "thank you for bringing this to my attention. Many products and services depend on this package and would be disrupted by any immediate action. I will bring this to their attention and work with them to remove the dependency as swiftly as possible and then remove all available versions of this package from where they are hosted." If someone brings lawyers to the table due to lack of immediate action, maybe then we can proceed to a more immediate, if disruptive, course. But no need to rush there if there's no external pressure to act that fast.
jakelazaroff 6y ago
IANAL but I don't think it works like that. Using GPL code in non-GPL project doesn't mean your code is automatically licensed under the GPL, it just means you're violating the license of the original code. How that shakes out — whether you have to re-license your project or just remove the offending code — ultimately depends on the two parties and the court system.
hartator 6y ago
> You don’t magically get your MIT license back by forking before the license change was added, that’s not how it works. And all RoR apps don't magically became open source because one of the depencies got contaminated by GPL. It's up to the courts to decide not parties who don't haven't standing.
rocqua 6y ago
This is what I personally dislike about GPL it is a viral license, without any 'cure'. Especially the more aggressive licenses feel like a ransom. Either accept gpl, or spend the rest of time trying to quarantine gpl from your projects. This is a huge unilateral attempt to make FOSS a certain way. And I don't think this kind of unilateral action does anything but set bad blood.

gedy 6y ago

I guess this is subjective (though maybe not legally), but this lookup table of extensions to mimetypes doesn't feel like GPL "software". It's just a description of other software's conventions using the GPLed source as a reference: https://github.com/minad/mimemagic/blob/master/lib/mimemagic/tables.rb#L3 https://github.com/minad/mimemagic/blob/master/lib/mimemagic... To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list?

imhoguy 6y ago
vs this https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/master/data/freedesktop.org.xml.in https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/m...
- Xylakant 6y ago
  In a twist of irony, the software for which the copyright claim breaking rails was made is hosted on the free edition of gitlab, which is based on rails.
  - Deradon 6y ago
    And according to the twitter-bio of the individual, who brought this up, he's related to Red Hat, which are also affected [^1]. [^1]https://github.com/RedHatInsights/compliance-backend/pull/795 https://github.com/RedHatInsights/compliance-backend/pull/79...
Denvercoder9 6y ago
> this lookup table of extensions to mimetypes doesn't feel like GPL "software". Copyright nor the GPL are limited to software, collections of data are copyrightable as well; and thus they can fall under the GPL as well. > To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list? Yes.
- toast0 6y ago
  > collections of data are copyrightable as well Collections of data are sometimes copyrightable. Depending on the jurisdiction, it may depend on the details of the collection.
- murderfs 6y ago
  Data in and of itself cannot be copyrighted under U.S. copyright law: "creative arrangement" of it can be, but given that the data in question was generated from XML file, I don't think you could make a claim that the arrangement was copied.
  - whimsicalism 6y ago
    ? I don't follow - it seems pretty clear that this falls under the GPL from my reading of what is copyrightable, ie. they can't copy your compilation of the data.
    - rst 6y ago
      Your reading of what is copyrightable may not be entirely in accord with the US Supreme Court's, which has ruled that mere compilations of factual data (a telephone directory in the case that set the precedent) are not copyrightable. https://en.wikipedia.org/wiki/Feist_Publications,_Inc.,_v._Rural_Telephone_Service_Co https://en.wikipedia.org/wiki/Feist_Publications,_Inc.,_v._R.... If someone is trying to apply the GPL to stuff which isn't legally copyrightable in the first place (as may be the case here), then their copyright isn't enforceable, and neither is the GPL.
- vertis 6y ago
boleary-gl 6y ago
Or use another source that is non-GPL - that's proposed here: https://github.com/rails/rails/issues/41750#issuecomment-805827334 https://github.com/rails/rails/issues/41750#issuecomment-805...
jahewson 6y ago
I agree. Lists of facts are not eligible for copyright in the US, most famously phone books. It’s debatable as to whether or not this file is pure facts but I’m having a hard time seeing it as a “creative expression”.

alberth 6y ago

> "You don’t magically get your MIT license back by forking before the license change" Am I understanding this correctly. If for example, 15 years you have an MIT code base with only MIT code. Then yesterday, you add a few lines of GPL code. Then today, you remove 100% of the GPL code you just previously added in order to revert back your codebase to be only MIT code ... it's no longer "MIT"? The GPL has now tainted their entire existing codebase?

psanford 6y ago
No.
terramex 6y ago
No, in this hypothetical case you would be fine. Mimemagic case is more like 15 years ago you had a MIT codebase that contained hidden GPL-derived code. One day you are notified about that violation and relicense whole codebase to GPL, but the code that was already in the repository before has never been truly MIT - it was always violating GPL. To fix this you can either relicense whole codebase to GPL (what mimemagic chose) or remove GPL code from codebase, stop distribution of older versions and continue your project as MIT. Going back to older version of code does not change anything as now everybody is aware of violation so you don't even have plausible deniability. You would need to fork from commit before adding GPL code, but this is impossible for mimemagic as it contained this code since day one.

onli 6y ago

> If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license. This depends. Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for their usage back then. You can in general never retroactively change a license, so their usage back then was certainly valid. You can [be forced to] stop using a license and re-license future versions of an artefact, and also possibly have to stop distributing the old versions. But that's on the gem's author, not Rails, and would likely not even impact future usage of the old, already obtained versions. If the original author wanted to claim damages under GPL from Rails, he would have to do so via the gem's author. And even then: What damages? And would the projects have had to know? None and no is the likely answer, safe juridical incompetence/corruption like in the Oracle-API case. It would be further be complicated by the file in question being a database file. You typically can not license databases in a meaningful way under GPL. Even if you could, reading a GPL'd database has no chance of carrying GPL code obligations over to the consuming program. As always with those questions, this might depend on your specific jurisdiction. Also, it means in no way that it is not the ethically right thing to swap the dependency to one that does not have this issue. PS: Also consider that in most uses of Rails, GPL or MIT does not change much, as accessing a server running GPL software does not trigger GPL's distribution clause (you want the AGPL for that). This already limits the impact here. The Github thread has comments in the direction of all Rails projects having to be open source now if the license changed to GPL. Not only can the license of old versions not change, this is also not the effect GPL would have.

tsbinz 6y ago
> Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for their usage back then. > You can in general never retroactively change a license, so their usage back then was certainly valid. I would ask a lawyer about that. As it has been explained to me, the original author didn't have the right to distribute it under the MIT license, so they (rails) never had a valid license. It's similar with images, even when you grab it off flickr or another page and it specifies a license you like, that does not mean that whoever posted it there actually had the right to do that, and if they didn't, you can get sued.

smarx007 6y ago

One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something. The original request in https://github.com/minad/mimemagic/issues/97 https://github.com/minad/mimemagic/issues/97 that you linked to was very polite and professional. 1) A time extension to remove the GPLed code could be politely requested. I know that the copyright belongs to all contributors but getting on good terms with the maintainer could be a solid first step. I think just opening a PR with that file deleted (and tests failing) could have been interpreted as a willingness to comply with the request in good faith. 2) A request to relicense the XML file in question under LGPL could have been sent to the original project (could be problem without CLAs, but still worth a try). Then the library could have been relicensed under LGPL. 3) Gem users could have been notified. Some prominent people from those projects could have helped with (1) and joined a kind request (2) to the original project. At least that's how we'd (try to) handle it on our project under Eclipse Foundation (though we used to have a GPL code scanning for releases in the first place until very recently) if such situation arose. Anyway, talking to people first before doing something quickly is often a good idea.

ericbarrett 6y ago
> One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something. Once you've been informed of a violation, you have a legal duty to act, no? Regardless of whether counter-action is immediately threatened. (Not a lawyer, not legal advice)
- cwyers 6y ago
  The question is, what act do you take? It's possible to negotiate and get a grace period to get into compliance, for instance.
- ysavir 6y ago
  At the end of the day, it's people involved, and people have the capacity for understanding and empathy. A safe course of action would be for the maintainer to respond with a message like "thank you for bringing this to my attention. Many products and services depend on this package and would be disrupted by any immediate action. I will bring this to their attention and work with them to remove the dependency as swiftly as possible and then remove all available versions of this package from where they are hosted." If someone brings lawyers to the table due to lack of immediate action, maybe then we can proceed to a more immediate, if disruptive, course. But no need to rush there if there's no external pressure to act that fast.

jakelazaroff 6y ago

IANAL but I don't think it works like that. Using GPL code in non-GPL project doesn't mean your code is automatically licensed under the GPL, it just means you're violating the license of the original code. How that shakes out — whether you have to re-license your project or just remove the offending code — ultimately depends on the two parties and the court system.

hartator 6y ago

> You don’t magically get your MIT license back by forking before the license change was added, that’s not how it works. And all RoR apps don't magically became open source because one of the depencies got contaminated by GPL. It's up to the courts to decide not parties who don't haven't standing.

rocqua 6y ago

This is what I personally dislike about GPL it is a viral license, without any 'cure'. Especially the more aggressive licenses feel like a ransom. Either accept gpl, or spend the rest of time trying to quarantine gpl from your projects. This is a huge unilateral attempt to make FOSS a certain way. And I don't think this kind of unilateral action does anything but set bad blood.