3 ms·

deploying AGPL software is complicated

by afiori 3y ago

orthoxerox 3y ago
Not really, just push the tarball with sources to nginx when you deploy a specific commit.
- sitzkrieg 3y ago
  yea this is definitely user friendly and realistic
  - jen20 3y ago
    If you make modifications, and deploy them in a way accessible to a given user, the changes must be made available to that user. I fail to see what is unrealistic about that, or indeed user-unfriendly, unless you consider the user to be the developer and not the person on the other end of the wire.
  - post-it 3y ago
    Glad you agree.
- arlcode 3y ago
  You don't even need to do that immediatly afaik. You can wait for the first person to request the source and do it then manually (or link to the nginx github). Most likely that will never happen for most people who deploy it. After all it's a pretty good price for what you are getting in exchange.
- yencabulator 3y ago
  There are AGPL software vendors who think making HTTP requests to their AGPL software forces you to license the client as AGPL too.
eatonphil 3y ago
Why do you say that? (Or to anyone, why do people think this?) I don't know anything about AGPL.
- chii 3y ago
  It's not complicated, unless what you intend to do when deploying AGPL software is actually to try circumvent the license in some way; e.g., you would like some proprietary modifications to be added but still comply with the AGPL requirements.
  - JamesDeansSon 3y ago
    [flagged]
josephcsible 3y ago
The AGPL's extra requirements only apply if you modify the program. If you don't, then deploying it is just as easy as deploying an MIT-licensed program.
- afiori 3y ago
  I believe that the AGPL has the same boundaries as the GPL that is if you for example run a nodejs server using a single AGPL package in your node_modules then users should be able to download the source code of your entire node app.
  - josephcsible 3y ago
    But now you're talking about using an AGPL library in your own program, rather than deploying just an AGPL-licensed program.
    - afiori 3y ago
      libraries are software
      - josephcsible 3y ago
        Yes, but my point is there's a difference between "just deploy their software" and "combine their software with your software and deploy the result".
        afiori 3y ago
        I agree, but for example it is not obvious whether you can deploy mixed licenses with docker-compose.
    - andrewl-hn 3y ago
      When you include an AGPL library your program becomes a derivative work, so the rest of your program becomes AGPL-licensed as well. The boundaries of what part of the system should or should not be included are vague, because *GPL licenses are written with C semantics in mind. So, while having a library directly in the same running process definitely makes you work a derivative, it's not clear if you the same is true if the library is a part of a different process and your program talks to it via an IPC, a filesystem, a database, an API, etc. Depending of the interpretation you may have toped-source just a tiny part of your program running on a server, or all server-side and client-side code and all supplemental scripts, tools, etc. needed for the system to run. So, it's legally ambiguous, and since no-one has legally tested the waters the interpretation of the license can be very different, but most people prefer to stay away from AGPL code altogether.

deploying AGPL software is complicated

by afiori 3y ago

deploying AGPL software is complicated

orthoxerox 3y ago

Not really, just push the tarball with sources to nginx when you deploy a specific commit.

sitzkrieg 3y ago
yea this is definitely user friendly and realistic
- jen20 3y ago
  If you make modifications, and deploy them in a way accessible to a given user, the changes must be made available to that user. I fail to see what is unrealistic about that, or indeed user-unfriendly, unless you consider the user to be the developer and not the person on the other end of the wire.
- post-it 3y ago
  Glad you agree.
arlcode 3y ago
You don't even need to do that immediatly afaik. You can wait for the first person to request the source and do it then manually (or link to the nginx github). Most likely that will never happen for most people who deploy it. After all it's a pretty good price for what you are getting in exchange.
yencabulator 3y ago
There are AGPL software vendors who think making HTTP requests to their AGPL software forces you to license the client as AGPL too.

eatonphil 3y ago

Why do you say that? (Or to anyone, why do people think this?) I don't know anything about AGPL.

chii 3y ago
It's not complicated, unless what you intend to do when deploying AGPL software is actually to try circumvent the license in some way; e.g., you would like some proprietary modifications to be added but still comply with the AGPL requirements.
- JamesDeansSon 3y ago
  [flagged]

josephcsible 3y ago

The AGPL's extra requirements only apply if you modify the program. If you don't, then deploying it is just as easy as deploying an MIT-licensed program.

afiori 3y ago
I believe that the AGPL has the same boundaries as the GPL that is if you for example run a nodejs server using a single AGPL package in your node_modules then users should be able to download the source code of your entire node app.
- josephcsible 3y ago
  But now you're talking about using an AGPL library in your own program, rather than deploying just an AGPL-licensed program.
  - afiori 3y ago
    libraries are software
    - josephcsible 3y ago
      Yes, but my point is there's a difference between "just deploy their software" and "combine their software with your software and deploy the result".
      - afiori 3y ago
        I agree, but for example it is not obvious whether you can deploy mixed licenses with docker-compose.
  - andrewl-hn 3y ago
    When you include an AGPL library your program becomes a derivative work, so the rest of your program becomes AGPL-licensed as well. The boundaries of what part of the system should or should not be included are vague, because *GPL licenses are written with C semantics in mind. So, while having a library directly in the same running process definitely makes you work a derivative, it's not clear if you the same is true if the library is a part of a different process and your program talks to it via an IPC, a filesystem, a database, an API, etc. Depending of the interpretation you may have toped-source just a tiny part of your program running on a server, or all server-side and client-side code and all supplemental scripts, tools, etc. needed for the system to run. So, it's legally ambiguous, and since no-one has legally tested the waters the interpretation of the license can be very different, but most people prefer to stay away from AGPL code altogether.