10 ms·

"As a result, Canonical cannot release LXD under the AGPLv3 license and likely never will be able to. LXD is now under a weird mix of Apache2 and AGPLv3 with no

"As a result, Canonical cannot release LXD under the AGPLv3 license and likely never will be able to. LXD is now under a weird mix of Apache2 and AGPLv3 with no clear metadata indicating what file or what part of each file is under one license or the other." IANAL but that's not true? You can take Apache2 and relicense it under AGPL? You can take "less copyleft" license and make it "more copyleft". https://www.gnu.org/licenses/license-list.en.html#apache2 https://www.gnu.org/licenses/license-list.en.html#apache2 It's entirely kosher in my opinion, and the entire thing agpl, with no "weird mix" or whatever

ropyeett 3y ago
They can freely include Apache2 licensed code in an AGPLv3 project without having to re-license the entire project under Apache2 as it's not a copyleft license. However this doesn't make the code they included AGPLv3, that code remains Apache2 and must be declared as such.
jraph 3y ago
> You can take "less copyleft" license and make it "more copyleft". Only if licenses are compatible. But Apache 2 is AGPL-compatible so > It's entirely kosher in my opinion Yes, I think so too. However, they need to make it clear which parts are under Apache 2.
- type0 3y ago
  It is if you own copyright for that code, then you can re-license. It seems Canonical didn't ask the permission of contributors that haven't signed their CLA, so Canonical have no right to change the license for that code > However, they need to make it clear which parts are under Apache 2. The only thing they needed to do is to add the statement that parts of the code that were written before LXD 5.20 remain Apache 2.0
shp0ngle 3y ago
what IS weird though is the go exosystem thing. in go ecosystem, copyleft is very much not the norm. People might not realise that by just adding copyleft dependency to go.mod, the entire project becomes effectively agpl as it has the code built-in.
- jorams 3y ago
  If you add a dependency without understanding the license that dependency is released under, you should stop doing that. That counts for every license, and particularly if there is no license.
  - shp0ngle 3y ago
    It goes transitively though. Some popular go packages grab tens (sometimes over hundres, but not as much as in node world) dependencies. NOBODY checks the license all the transitive dependencies in go world. What should or should not happen is one thing, this is the reality edit: oh but that lead me to google this neat https://github.com/google/go-licenses https://github.com/google/go-licenses
    - Tomte 3y ago
      Yes, that's why (apart from the Cyber Resilience Act) license scanners and SBOMs are a thing.
tsimionescu 3y ago
Licenses don't typically allow licensees to re-license code. You can use Apache v2 code in a proprietary or AGPL product and redistribute binaries or other source code derived from it under any other license, but you can't change the license of the original code: anyone can still use it under the Apache license. Conversely, a copyright holder may re-license code. Depending on the exact terms of the old license, this may mean that you are no longer allowed to use it under the old license (at least, not unless you got it from someone who legally obtained it back when it had the old license). So, if the code is not relicensed, you can theoretically download a bundle that claims it's AGPLv3, select the portions that are licensed under Apache, and incorporate those into your proprietary product without providing any access to your sources, and be legally in the clear.
- alwayslikethis 3y ago
  Does it not? > 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. Is sublicensing something different from relicensing?
  - type0 3y ago
    As far I understand it means you should use the same license for the reused parts of that code
- pessimizer 3y ago
  > Licenses don't typically allow licensees to re-license code. This still doesn't make any sense. Permissive licenses are designed to allow code to be relicensed freely, hence the term "permissive." There may be a few catches, like having to include attribution or a copy of the old license, but if those were significant, the code wouldn't be open source. How could that interpretation be compatible with the fact that if the author and copyright holder relicenses the code, you can ignore them if "you got it from someone who legally obtained it back when it had the old license." LGPL projects are "someone." > So, if the code is not relicensed, you can theoretically download a bundle that claims it's AGPLv3, select the portions that are licensed under Apache, and incorporate those into your proprietary product without providing any access to your sources, and be legally in the clear. Very theoretically. It's very unlikely that the Apache code will sit in the AGPL project forever unmixed with new, AGPL'd, code. Since the new code is not under a permissive license, it can't be relicensed to Apache.
DannyBee 3y ago
Lawyer here "IANAL but that's not true? You can take Apache2 and relicense it under AGPL? You can take "less copyleft" license and make it "more copyleft"." No you can't. That's also not really what is happening here in the link you list. This gets complicated very quick (and 90% of HN comments in this thread are already sort of wrong), but the short version is: When you aggregate existing works into a larger work, you can license the larger work in any way that is compatible with the existing works. Apache2 is compatible in that sense - i can include an apache work in a larger aggregate work licensed a different way. However, that does not relicense the original works that you are aggegating. For the Apache2 portion of that work - even when part of a larger work, I can still exercise whatever rights Apache2 gives me for the Apache2 version of that work. The aggregate work itself would also have very little copyright protection, even if you AGPLv3 it. The only copyright you newly get in the aggregate work is selection, arrangement, etc. Which means the degree to which you are licensing anything at all is ... quite small. The easy way to think about it is: even if you release a larger AGPLv3 work containining Apache2 pieces, you could not sue people for taking the Apache2 piece of it, and using it under Apache2. Even if they explicitly use your copy of it, etc. More than that, people could take all of your aggregate work pieces and use them under their licenses, and you could not stop them. This already happens - RHEL et al.
- pessimizer 3y ago
  > However, that does not relicense the original works that you are aggegating. What does this claim even mean? I don't think that anybody thinks including Apache code in their GPL project would retroactively relicense the code of the Apache-licensed project that they probably had nothing to do with, written by someone they may have ever met. Is this what you're confirming? > The aggregate work itself would also have very little copyright protection, even if you AGPLv3 it. > The only copyright you newly get in the aggregate work is selection, arrangement, etc. That's not really how code works. The old code is mixed with the new code, and the combination (I've always thought) is going to have all of the restrictions of both (all) licenses involved. If I take a public domain book containing un-trademarked characters, write 20 additional chapters for it, and do a 20% rewrite on the original chapters, are you saying that my book wouldn't be copyrightable? Sounds like the GPL.

ropyeett 3y ago

They can freely include Apache2 licensed code in an AGPLv3 project without having to re-license the entire project under Apache2 as it's not a copyleft license. However this doesn't make the code they included AGPLv3, that code remains Apache2 and must be declared as such.

jraph 3y ago

> You can take "less copyleft" license and make it "more copyleft". Only if licenses are compatible. But Apache 2 is AGPL-compatible so > It's entirely kosher in my opinion Yes, I think so too. However, they need to make it clear which parts are under Apache 2.

type0 3y ago
It is if you own copyright for that code, then you can re-license. It seems Canonical didn't ask the permission of contributors that haven't signed their CLA, so Canonical have no right to change the license for that code > However, they need to make it clear which parts are under Apache 2. The only thing they needed to do is to add the statement that parts of the code that were written before LXD 5.20 remain Apache 2.0

shp0ngle 3y ago

what IS weird though is the go exosystem thing. in go ecosystem, copyleft is very much not the norm. People might not realise that by just adding copyleft dependency to go.mod, the entire project becomes effectively agpl as it has the code built-in.

jorams 3y ago
If you add a dependency without understanding the license that dependency is released under, you should stop doing that. That counts for every license, and particularly if there is no license.
- shp0ngle 3y ago
  It goes transitively though. Some popular go packages grab tens (sometimes over hundres, but not as much as in node world) dependencies. NOBODY checks the license all the transitive dependencies in go world. What should or should not happen is one thing, this is the reality edit: oh but that lead me to google this neat https://github.com/google/go-licenses https://github.com/google/go-licenses
  - Tomte 3y ago
    Yes, that's why (apart from the Cyber Resilience Act) license scanners and SBOMs are a thing.

tsimionescu 3y ago

Licenses don't typically allow licensees to re-license code. You can use Apache v2 code in a proprietary or AGPL product and redistribute binaries or other source code derived from it under any other license, but you can't change the license of the original code: anyone can still use it under the Apache license. Conversely, a copyright holder may re-license code. Depending on the exact terms of the old license, this may mean that you are no longer allowed to use it under the old license (at least, not unless you got it from someone who legally obtained it back when it had the old license). So, if the code is not relicensed, you can theoretically download a bundle that claims it's AGPLv3, select the portions that are licensed under Apache, and incorporate those into your proprietary product without providing any access to your sources, and be legally in the clear.

alwayslikethis 3y ago
Does it not? > 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. Is sublicensing something different from relicensing?
- type0 3y ago
  As far I understand it means you should use the same license for the reused parts of that code
pessimizer 3y ago
> Licenses don't typically allow licensees to re-license code. This still doesn't make any sense. Permissive licenses are designed to allow code to be relicensed freely, hence the term "permissive." There may be a few catches, like having to include attribution or a copy of the old license, but if those were significant, the code wouldn't be open source. How could that interpretation be compatible with the fact that if the author and copyright holder relicenses the code, you can ignore them if "you got it from someone who legally obtained it back when it had the old license." LGPL projects are "someone." > So, if the code is not relicensed, you can theoretically download a bundle that claims it's AGPLv3, select the portions that are licensed under Apache, and incorporate those into your proprietary product without providing any access to your sources, and be legally in the clear. Very theoretically. It's very unlikely that the Apache code will sit in the AGPL project forever unmixed with new, AGPL'd, code. Since the new code is not under a permissive license, it can't be relicensed to Apache.

DannyBee 3y ago

Lawyer here "IANAL but that's not true? You can take Apache2 and relicense it under AGPL? You can take "less copyleft" license and make it "more copyleft"." No you can't. That's also not really what is happening here in the link you list. This gets complicated very quick (and 90% of HN comments in this thread are already sort of wrong), but the short version is: When you aggregate existing works into a larger work, you can license the larger work in any way that is compatible with the existing works. Apache2 is compatible in that sense - i can include an apache work in a larger aggregate work licensed a different way. However, that does not relicense the original works that you are aggegating. For the Apache2 portion of that work - even when part of a larger work, I can still exercise whatever rights Apache2 gives me for the Apache2 version of that work. The aggregate work itself would also have very little copyright protection, even if you AGPLv3 it. The only copyright you newly get in the aggregate work is selection, arrangement, etc. Which means the degree to which you are licensing anything at all is ... quite small. The easy way to think about it is: even if you release a larger AGPLv3 work containining Apache2 pieces, you could not sue people for taking the Apache2 piece of it, and using it under Apache2. Even if they explicitly use your copy of it, etc. More than that, people could take all of your aggregate work pieces and use them under their licenses, and you could not stop them. This already happens - RHEL et al.

pessimizer 3y ago
> However, that does not relicense the original works that you are aggegating. What does this claim even mean? I don't think that anybody thinks including Apache code in their GPL project would retroactively relicense the code of the Apache-licensed project that they probably had nothing to do with, written by someone they may have ever met. Is this what you're confirming? > The aggregate work itself would also have very little copyright protection, even if you AGPLv3 it. > The only copyright you newly get in the aggregate work is selection, arrangement, etc. That's not really how code works. The old code is mixed with the new code, and the combination (I've always thought) is going to have all of the restrictions of both (all) licenses involved. If I take a public domain book containing un-trademarked characters, write 20 additional chapters for it, and do a 20% rewrite on the original chapters, are you saying that my book wouldn't be copyrightable? Sounds like the GPL.