3 ms·

There are excellent FOSS gallery apps already, like the Fossify suite. Why not use them I wonder?

by andrepd 20d ago

HybridStatAnim8 19d ago
Their license is invalid due to being GPLv3. GPLv3 cannot be included in GrapheneOS as that would necessitate GrapheneOS give up their permissive licensing. Refra Gallery is licensed as Apache 2.0, which is a permissive license GrapheneOS can bundle in the OS.
- graemep 19d ago
  Its not part of the OS so why would it affect the Graphene OS license? Its an app, not a library.
  - Cider9986 19d ago
    The preinstalled apps are part of the OS.
    - gray_-_wolf 19d ago
      That cannot be true, when I install e.g., Ubuntu system, there are plenty of applications installed for me, with incompatible licenses.
      - novafunc 19d ago
        Can you please elaborate on what you mean? Ubuntu does not aim to be a permissively-licensed system. It can include copyleft (e.g. GPL) and permissive (e.g. MIT) without issue. Permissively-licensed systems like FreeBSD and GrapheneOS cannot include GPL code if they want to remain permissive.
        xorcist 19d ago
        > GrapheneOS cannot include GPL code if they want to remain permissive It's hard to take this seriously when the entire kernel is GPL.
        deleted 19d ago
        [deleted]
        grapheneos 19d ago
        GrapheneOS does include GPLv2 code both via AOSP and our own but not GPLv3. We want GrapheneOS to have no additional restrictions beyond AOSP. AOSP uses GPLv2 but not GPLv3. We do need to be careful with GPLv2 due to license incompatibilities. For example, GPLv2-only licensing such as the Linux kernel is incompatible with Apache 2 and GPLv3. GPLv3 is compatible with Apache 2 so GPLv2-or-later can be compatible but only by using it as GPLv3 with the extra restrictions too.
        exceptione 19d ago
        It seems like you have more freedom than you think you do. See this comment <https://news.ycombinator.com/item?id=49594824 https://news.ycombinator.com/item?id=49594824> Packaging software shouldn't change the license of GOS as such. If you haven't had already, maybe the free software foundation could provide you with assurance? I guess it will make your life much easier if you wouldn't have to restrict yourself that much.
        grapheneos 19d ago
        No, we're not talking about packaging software in our app repository (App Store) but rather software being included in GrapheneOS. If any GPLv3 software is included in GrapheneOS then that places more restrictions on how it can be used as a whole.
      - HybridStatAnim8 19d ago
        It is true, and if Ubuntu is shipping apps as a part of the OS with incompatible licenses, that is a crime.
        Cider9986 19d ago
        Not a crime a civil matter.
        microtonal 19d ago
        I think you are confused. You can have a Linux distribution with software with incompatible licenses (e.g. GPLv2 and Apache License version 2), because the license for a particular program or library only applies to that specific work, not other works that it is distributed with. The GPL is very clear on this: In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. There are some cases where a separate work can be considered derivative and thus the GPL can apply. E.g. I think it is generally accepted that a program linked statically against a GPL library is considered a derivative work (and must thus must have a license compatible with the GPL). More controversial is whether dynamic linking creates a derivative work. To cover the latter case, a lot of copyleft libraries are licensed under the LGPL or the GPL with a dynamic linking exception. At any rate, shipping a Linux distribution with GPLv2 code (e.g. the Linux kernel) and a GUI application that is under the Apache v2 license is not a problem at all (as long as the GUI application is not a derivative of a GPLv2 work). (IANAL of course, so this is not legal advice.)
        HybridStatAnim8 19d ago
        GPLv2 and Apache 2.0 are not incompatible licenses when bundled together. GPLv3 is the problematic license as it requires all code it is bundled with be GPLv3 as well. When it comes to AOSP/GOS, bundled apps are not aggregated together, they are built and signed under a singular OS binary.
      - grapheneos 19d ago
        OS components don't need to have compatible licenses if they're separate from each other. The Linux kernel is GPLv2-only which forbids GPLv3 licensing. That doesn't mean GPLv3 code can't be used in a Linux-based OS. We use GPLv2 and permissive licensing for GrapheneOS to avoid more restrictive licensing than the AOSP. We'll happily use GPLv3 and AGPLv3 for components outside of GrapheneOS if we think it's the best fit for specific projects. We aren't currently licensing anything as GPLv3/AGPLv3 but we aren't strictly opposed to it outside of the OS. We'll use what we think are the best open source licenses for what we want to achieve. What we want to achieve is usually broad adoption of our code with painless usage of it. That means we usually choose permissive licenses. We use GPLv2 in certain cases such as Vanadium where we decided we wanted extensions to our code to be under a compatible open source license instead of a source available license or GPLv3.
        Cider9986 19d ago
        There's 5 licenses :o
    - yjftsjthsd-h 19d ago
      IANAL, but I would expect that to fall under "mere aggregation"
  - HybridStatAnim8 19d ago
    The Refra gallery fork would replace the current ancient gallery app. That would be bundled with the OS. Doing the same with the fossify suite or similar would be illegal. These licenses do not treat apps or libraries differently. GPLv3 code forces the code that it is bundled with to also be GPLv3.
    - kasabali 19d ago
      That's textbook FUD.
- gkoz 19d ago
  Can the Linux kernel be included in the OS?
  - palata 19d ago
    Linux is GPLv2, though. Not sure if that makes a difference here.
    - grapheneos 19d ago
      It does make a difference. GrapheneOS includes a lot of GPLv2 code from AOSP and we choose it as a license for several of own projects within GrapheneOS.
  - HybridStatAnim8 19d ago
    Yes, the GPLv2 license does not have the same restrictions GPLv3 does, it does not necessitate making the code it is bundled with GPLv2.
    - microtonal 19d ago
      Neither does the GPLv3: A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. If you'd include a GPLv3 gallery app in, say, a mobile OS, it does not mean that the rest of the OS has to be under the GPLv3. It merely means that you cannot limit the user's right when it comes to the GPLv3-part (the gallery app). They would still be allowed to redistribute/modify it and you have to provide the source code on request. You only have to make other code GPLv3 if you somehow create a derivative work (e.g. linking against a GPLv3 library). (IANAL blah blah)
      - 19d ago
DANmode 19d ago
Media handlers are a security nightmare, might lead you to the right answer if it isn’t it.
grapheneos 19d ago
We're going to be forking one of them (ReFra). We want to make extensive changes and have a different vision for it than the upstream project. For example, we don't want it to have integration into services. There's plenty of room for both an increasingly different fork of it in GrapheneOS and the original project which our users will continue to use who want features we don't consider inside the scope of what we want from a local gallery app.

There are excellent FOSS gallery apps already, like the Fossify suite. Why not use them I wonder?

by andrepd 20d ago

There are excellent FOSS gallery apps already, like the Fossify suite. Why not use them I wonder?

Their license is invalid due to being GPLv3. GPLv3 cannot be included in GrapheneOS as that would necessitate GrapheneOS give up their permissive licensing. Refra Gallery is licensed as Apache 2.0, which is a permissive license GrapheneOS can bundle in the OS.

graemep 19d ago
Its not part of the OS so why would it affect the Graphene OS license? Its an app, not a library.
- Cider9986 19d ago
  The preinstalled apps are part of the OS.
  - gray_-_wolf 19d ago
    That cannot be true, when I install e.g., Ubuntu system, there are plenty of applications installed for me, with incompatible licenses.
    - novafunc 19d ago
      Can you please elaborate on what you mean? Ubuntu does not aim to be a permissively-licensed system. It can include copyleft (e.g. GPL) and permissive (e.g. MIT) without issue. Permissively-licensed systems like FreeBSD and GrapheneOS cannot include GPL code if they want to remain permissive.
      - xorcist 19d ago
        > GrapheneOS cannot include GPL code if they want to remain permissive It's hard to take this seriously when the entire kernel is GPL.
      - deleted 19d ago
        [deleted]
      - grapheneos 19d ago
        GrapheneOS does include GPLv2 code both via AOSP and our own but not GPLv3. We want GrapheneOS to have no additional restrictions beyond AOSP. AOSP uses GPLv2 but not GPLv3. We do need to be careful with GPLv2 due to license incompatibilities. For example, GPLv2-only licensing such as the Linux kernel is incompatible with Apache 2 and GPLv3. GPLv3 is compatible with Apache 2 so GPLv2-or-later can be compatible but only by using it as GPLv3 with the extra restrictions too.
        exceptione 19d ago
        It seems like you have more freedom than you think you do. See this comment <https://news.ycombinator.com/item?id=49594824 https://news.ycombinator.com/item?id=49594824> Packaging software shouldn't change the license of GOS as such. If you haven't had already, maybe the free software foundation could provide you with assurance? I guess it will make your life much easier if you wouldn't have to restrict yourself that much.
        grapheneos 19d ago
        No, we're not talking about packaging software in our app repository (App Store) but rather software being included in GrapheneOS. If any GPLv3 software is included in GrapheneOS then that places more restrictions on how it can be used as a whole.
    - HybridStatAnim8 19d ago
      It is true, and if Ubuntu is shipping apps as a part of the OS with incompatible licenses, that is a crime.
      - Cider9986 19d ago
        Not a crime a civil matter.
      - microtonal 19d ago
        I think you are confused. You can have a Linux distribution with software with incompatible licenses (e.g. GPLv2 and Apache License version 2), because the license for a particular program or library only applies to that specific work, not other works that it is distributed with. The GPL is very clear on this: In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. There are some cases where a separate work can be considered derivative and thus the GPL can apply. E.g. I think it is generally accepted that a program linked statically against a GPL library is considered a derivative work (and must thus must have a license compatible with the GPL). More controversial is whether dynamic linking creates a derivative work. To cover the latter case, a lot of copyleft libraries are licensed under the LGPL or the GPL with a dynamic linking exception. At any rate, shipping a Linux distribution with GPLv2 code (e.g. the Linux kernel) and a GUI application that is under the Apache v2 license is not a problem at all (as long as the GUI application is not a derivative of a GPLv2 work). (IANAL of course, so this is not legal advice.)
        HybridStatAnim8 19d ago
        GPLv2 and Apache 2.0 are not incompatible licenses when bundled together. GPLv3 is the problematic license as it requires all code it is bundled with be GPLv3 as well. When it comes to AOSP/GOS, bundled apps are not aggregated together, they are built and signed under a singular OS binary.
    - grapheneos 19d ago
      OS components don't need to have compatible licenses if they're separate from each other. The Linux kernel is GPLv2-only which forbids GPLv3 licensing. That doesn't mean GPLv3 code can't be used in a Linux-based OS. We use GPLv2 and permissive licensing for GrapheneOS to avoid more restrictive licensing than the AOSP. We'll happily use GPLv3 and AGPLv3 for components outside of GrapheneOS if we think it's the best fit for specific projects. We aren't currently licensing anything as GPLv3/AGPLv3 but we aren't strictly opposed to it outside of the OS. We'll use what we think are the best open source licenses for what we want to achieve. What we want to achieve is usually broad adoption of our code with painless usage of it. That means we usually choose permissive licenses. We use GPLv2 in certain cases such as Vanadium where we decided we wanted extensions to our code to be under a compatible open source license instead of a source available license or GPLv3.
      - Cider9986 19d ago
        There's 5 licenses :o
  - yjftsjthsd-h 19d ago
    IANAL, but I would expect that to fall under "mere aggregation"
- HybridStatAnim8 19d ago
  The Refra gallery fork would replace the current ancient gallery app. That would be bundled with the OS. Doing the same with the fossify suite or similar would be illegal. These licenses do not treat apps or libraries differently. GPLv3 code forces the code that it is bundled with to also be GPLv3.
  - kasabali 19d ago
    That's textbook FUD.
gkoz 19d ago
Can the Linux kernel be included in the OS?
- palata 19d ago
  Linux is GPLv2, though. Not sure if that makes a difference here.
  - grapheneos 19d ago
    It does make a difference. GrapheneOS includes a lot of GPLv2 code from AOSP and we choose it as a license for several of own projects within GrapheneOS.
- HybridStatAnim8 19d ago
  Yes, the GPLv2 license does not have the same restrictions GPLv3 does, it does not necessitate making the code it is bundled with GPLv2.
  - microtonal 19d ago
    Neither does the GPLv3: A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. If you'd include a GPLv3 gallery app in, say, a mobile OS, it does not mean that the rest of the OS has to be under the GPLv3. It merely means that you cannot limit the user's right when it comes to the GPLv3-part (the gallery app). They would still be allowed to redistribute/modify it and you have to provide the source code on request. You only have to make other code GPLv3 if you somehow create a derivative work (e.g. linking against a GPLv3 library). (IANAL blah blah)
    - 19d ago

DANmode 19d ago

Media handlers are a security nightmare, might lead you to the right answer if it isn’t it.

grapheneos 19d ago

We're going to be forking one of them (ReFra). We want to make extensive changes and have a different vision for it than the upstream project. For example, we don't want it to have integration into services. There's plenty of room for both an increasingly different fork of it in GrapheneOS and the original project which our users will continue to use who want features we don't consider inside the scope of what we want from a local gallery app.