Unredistributable Code

As you may know, I have an interest in free software licensing, and handle licensing enquiries for mozilla.org.

LWN‘s lead article (buy access; it’s great :-) this week is about an ongoing dispute between Jorg Schilling, maintainer of “cdrecord”, and various Linux vendors. Mr Schilling and those companies have rather different ideas about the way cdrecord should work, and so the vendors tend to ship a heavily patched version. Mr Schilling feels that this places him under an unreasonable support burden, as he gets a lot of email from people people using “broken” versions.

Four days ago, because of this, Mr Schilling released a new alpha of cdrecord, 2.01a36, with the following comment in cdrecord/cdrecord.c:

/*
* You are not allowed to modify or remove the following code.
* I am sorry that I am forced to do things like this, but defective
* versions of cdrecord cause a lot of work load to me and it seems
* to be impossible to otherwise convince SuSE to cooperate.
* As people contact me and bother me with the related problems,
* it is obvious that SuSE is violating subsection 6 in the preamble of
* the GPL.
*
* Note that although the SuSE test is effective only for SuSE, the
* intention to have non bastardized versions out is not limited
* to SuSE. It is bad to see that in special in the “Linux” business,
* companies prefer a model with many proprietary differing programs
* instead of cooperating with the program authors.
*/

(Thanks to garloff on LWN for bringing this to my notice.) The code referred to is a call to a function “linuxcheck()”, which checks for Linux 2.6 and prints a warning message, and then checks for SuSE and prints another one complaining about the “bastardized and defective versions” he alleges SuSE ship.

That clause, if you read it as an extension to cdrecord’s licence, makes the code it refers to non-free – it is an “further restriction” which violates section 6 of the GPL. This has several ramifications:

1) When Mr Schilling distributes the current version of cdrecord, he is violating the GPL with regard to those parts he does not own the copyright on – because the copyright holders of those parts have not given permission for their code to be in a binary with non-free code.

This would allow anyone with code in cdrecord to sue him for copyright infringement.

2) Anyone who receives the code receives it under two conflicting license provisions. That means, according to section 7 of the GPL, that they may not re-redistribute the code at all, because they cannot simultaneously satisfy the GPL and the other conditions (i.e. allow unlimited freedom to modify, and stop modification of that section).

So any Linux distributor or other party distributing 2.0a36 or above is violating the GPL, and could be sued by copyright infringement by any contributor, including Mr Schilling.

In other words, no-one is currently allowed to redistribute cdrecord at all! This is a rather unfortunate state of affairs for all parties. I hope that it will be possible to resolve it quickly; cdrecord is an excellent piece of software.

23 thoughts on “Unredistributable Code

  1. Why does he think SuSE is violating section 6 of the GPL?

    Why doesn’t he just refuse to support SuSE versions, the way Mozilla people often refuse to support Debian versions?

    Does SuSE or Schilling maintain a human-readable list of differences between the versions?

  2. Ofcourse you should see this as a statement of Mr. Schilling and not as an attempt to kill cdrecord or any other way. Doing so seems kind of childish to me. Bringing it under the attention of more people using your blog is a good thing (in my humble opinion)

  3. This reminds me of the old (pre-GPLed Qt) KDE problem. Much of KDE was licensed under the GPL, which made it quite clear that distributing the code linked against Qt was not allowed.

    The problem came when the KDE developers started complaining that distributions like RedHat and Debian were complying with the KDE license. I hope Mr Schilling is clear about the implications of his actions. Of course, the KDE issues are resolved these days, but its depressing that people fall into this trap still.

    The only users I refuse to support are Gentoo users who still act surprised when my code fails to run correctly when compiled with unsupported, known-bug-inducing gcc options.

    *sigh*

    Ian

  4. This is the problem, when hackers and licenses mix the result is always bad. Every second a hacker considers legal issues is one which means coding can’t be done (even though I realise its necessary) – and typically the result is a complete mess (consider AES encryption in the Linux kernel just last week – look at http://www.kerneltrap.org for details). Most hackers are not equiped to deal with legal issues, so often they get it wrong.

    Part of the reason that the legal situation is harder with free software is that people confuse politics with copyright law. The GPL has a preamble, that is entirely political ramblings by RMS. I just wish I could release a piece of software with a kind of general guidelines of what I consider acceptable use, and have people respect them, rather than revert to law. (I tried it once, my software was ripped off wholesale within 2 months)

  5. The SuSE thing is new, but cdrecord has had a “you may not modify or remove this section of code” comment for quite a few releases, while still claiming to be licensed under the GPL.

  6. Ian,
    Unfortunately Gentoo developers have a similar problem regarding bugs introduced by what I’ll politely call “insane” CFLAGS.

    Whenever a bug is reported that we have any suspicion of being CFLAGS-related, we require users to reproduce their flags with much tamer ones. Perhaps you could do the same.

    We also encourage users to post to our Bugzilla rather than directly upstream, so we can cut problems like yours off at the pass.

  7. Schilly started yelling after SUSE 9.0, that came out with a dvd patch for the cdrecord. Perhaps his comercial cdrecord-dvd was hurt.

  8. Firstly to answer Jesse Ruderman’s original question, it seems he’s referring not to the sixth paragraph in the actual licence, but to the sixth paragraph in the *preamble*. Although the paragraphs in the preamble are not actually explicitly numbered, the sixth one is the one which contains the sentence: “If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors’ reputations.” But as Neil Mitchell has pointed out, the preamble is distinct from the legal licence anyway.

    As regards the separate issue of whether he is breaking any rules himself by attempting to impose the restriction, that depends whether cdrecord incorporates any code copyrighted by others which he is only allowed to use on the basis of the GPL. It would appear, at least from the README file, that he is at least claiming that the code was entirely written by himself, which would mean that he has every right to impose additional restrictions (provided that he is not actually illegally distributing a modified copy of the actual GPL document) — although if he’s going to release cdrecord under anything other than pure GPL it could well be dodgy combining it with cdda2wav (which he didn’t write) it in the single package cdrtools, as this could well be beyond the “mere aggregation” referred to at the end of GPL section 2.

    But, whatever his rights, I am not convinced that that is the way to go about it. A better way forward is to separate out the rights to the *code* from the rights to a the *name*, so that the code is fully and unequivocally GPLed, but he trademarks the particular name “cdrecord” and uses the trademark to impose that only versions which meet his approval are allowed to bear that name.

  9. P.S. as regards Gerv’s second point — “Anyone who receives the code receives it under two conflicting license provisions. That means, according to section 7 of the GPL, that they may not re-redistribute the code at all” — I agree, but only on the basis that the code is actually distributed under the two provisions separately.

    His intention was no doubt not to do this, but to distribute it under a single provision, which is the GPL *as modified by* certain amendments, so that the licensee is not subject to conflicting clauses. Of course he is not allowed to distribute modified versions of the GPL text, but he could get around it by having a single clearly identified “COPYING” document which describes these conditions, and put an unmodified copy of the GPL in a separate file (which is referred to in COPYING, but is not itself labelled with a filename which would imply that it is the overall licence agreement).

    But he’s not done that, and in any event it’s a tad cheeky to piggy-back off the GPL text while overturning part of its key ethos.

  10. Alan said:

    It would appear, at least from the README file, that he is at least claiming that the code was entirely written by himself,

    If that’s true then he is not violating the GPL by distributing cdrecord himself. But is it really likely that he’d got this far without taking patches from anyone?

    You are right that trademarks are the correct legal approach to the problem Mr Schilling is experiencing.

    I would say that common practice (to which the law pays attention) says that archive formats such as .tar and .rpm are mere aggregation, as long as they can be unravelled into their separate files, so he may well be OK with cdda2wav.

    I don’t agree with your understanding of “conflicting provisions”; but, if we say for the sake of discussion that what you say is true, then cdrecord is no longer free software. So Mr Schilling may be able to redistribute it, but no-one else will want to anyway.

  11. Maybe I have missed something, but if the master files (COPYING etc.) in the root of the package clearly say that the license is GPL, isn’t such a comment just a comment without any legal binding at all?

    Also, it seems that 2.01a38-pre no longer contains the comment.

  12. I’m tempted to agree with Martin. Any hacker who has to interface with code that anybody else wrote surely has code full of things like: // the guys who wrote libfoo are complete morons, so you have to check for condition XYZ here — don’t remove this!

    In those cases, nobody thinks that “don’t remove this” is a legal threat. It’s more like “you’d better know what you’re doing, because I put it there for a reason”.

    Besides, since the entire program is GPL (as the COPYING file says), can’t distros just remove this comment? Debian could even replace it with somethting like /* cdrecord author ranting about SUSE here … Debian is very GPL-clean, so it doesn’t apply to us */ :-)

  13. I agree with him. SUSE is a company who must tell that we maid this using this guis source code. I personally do so. if i hack a program i firstly ask the creator for permission. Its not GPL problem its problem when a company maiking milions of dollars and not thelling we maid this and he did this, we have gived our part for him so everybody can use it, becose it open source. *** Human technology belongs to the world *** (AntiTrust – the movie) Thanks for reading. ;)

  14. Just saw this on osnews. Where do you draw the line? I can understand him being upset by SuSE and others modifying his work and making it look like his code is to blame when it breaks instead of their patches. Is this the right route? Well, it seems he has thought long and hard on the issue. It is his program, after all – he can decide what he wants to do with it. Unfortunatly, too many people out there are gpl-nazis and won’t like this at all. I can see a fork on the horizon if he sticks with this.
    I can also see the point of SuSE, wanting to patch it to provide something to their users that doesn’t come in the regular program. As was pointed out above, maybe this can all be settled if SuSE (and others) will just take the credit/blame for it breaking. I really don’t see that happening, though.

  15. While Mr. Schilling certainly may have a right to complain about being inundated for support regarding code that is not his, there are several points to consider here:

    1. SUSE is not the only distribution that has provided users with a patched cdrecord–Mandrake has for some time. Why start complaining now?

    2. A big part of the complaint surrounds the addition of DVDRW support, and although Schilling washes his hands when he complains about having to provide support, one must suspect he is secretly unhappy about the fact that this will cut down on purchases of licenses for his own non-GPL’d dvd-burning extension to cdrecord.

    3. Mr. Schilling has definitely not been easy to work with in the past–just see the Linux Kernel Mailing List for evidence of the SCSI vs. ATAPI interface issues, and his personal interests in SCSI + Solaris versus ATAPI on Linux.

    Therefore, one must agree with the issue Mr. Schilling presents, and push SUSE/Mandrake/etc. to keep such distro-centric bugs to their own bug-tracking interfaces, while also admonishing him for the possibility of turning a small problem into a large one, all for the sake of his cdrecord.prodvd profits.

  16. SuSE says quite clearly in the about/help of the programm that bugreports should go to them because they ship a patched version. they and the other distros can’t be blamed for users googling for help and finding the author…
    it seems to be a clear case of “boohoo, no one’s buying my dvd burning extension any more”…

  17. 1. Does his DVD burning extension include any code that was written by others and contributed to cdrecord? That would be a very, very serious GPL violation.

    2. Restrictions on modification are just plain repugnant. That’s what free software is *for.* When you publish free software, you expect/encourage modifications and improvements to be published. Good improvements get used. Supporting DVDs properly is a good improvement.

    3. As far as Antitrust – human knowledge belongs to the world, to use, as well as to extend. That’s what the GPL does. If all knowledge is held by the author exclusively, it no longer belongs to the world. I think cookiem should watch Antitrust again.

  18. Malx: no-one, and certainly not me, has suggested his DVD-burning extension is not legal.

    You may not like people adding restrictions on modification, and you may not use code which has them, but is there any need for such strong language about the actions of someone who has made a very generous donation of work and code to the commmunity?

  19. i think SuSE and other distros should maintain a new program with a new name like “disk-burner” or so and share their code. I agree that burning cds and dvds is too important as that a distribution would not provide programs to do just that.

    Thilo

  20. Gerv: my comments were qualified – if it is distributing code contributed to cdrecord, that is, GPL code, under a non-GPL licence, it is a very serious violation.

    I am not saying this has happened. I am saying *if* it has happened.

    Yes, I consider the comment justified: if this occurred, it would be taking free code and making it non-free; this is taking other people’s code, and profiting from it. It is a serious offense to the people who wrote that code, and taking others (GPL) code and closing it is not ‘contributing’, it’s copyright infringement.

    As far as the added restriction – people are free to publish their own code under whatever terms they chose. They may not, of course, bundle GPL code with GPL-incompatible code if the components form part of the same copyright “work.” If a new cdrecord were written from scratch, with no GPL contributions and these restrictions in place, there would be no issue; it would be non-free, and no distribution would ship it.

    If software is free, on the other hand, people have a *right* to modify it (and distribute those modifications). That’s the FSF freedom 1 and 3. A DVD burning enhancement is an enhancement, made in accordance with the GPL. This licence change should be seen for what it is: a move where the author no longer supports the GPL as his distribution licence. He may be allowed to do this so long as it is only done on code that is exclusively his.

    When I use the term ‘repugnant’ I do so in my own opinion: I do not use non-free software on machines I control. This licence is non-free, and masquerading it as free is offensive. I have contributed lots to the Free Software community myself, and I would be completely outraged if any of my contributions were being shipped in a non-free product. Contributions are contributions to public software, not private profits.

  21. Gerv: my comments were qualified – if it is distributing code contributed to cdrecord, that is, GPL code, under a non-GPL licence, it is a very serious violation.

    I am not saying this has happened. I am saying *if* it has happened.

    Yes, I consider the comment justified: if this occurred, it would be taking free code and making it non-free; this is taking other people’s code, and profiting from it. It is a serious offense to the people who wrote that code, and taking others (GPL) code and closing it is not ‘contributing’, it’s copyright infringement.

  22. When I use the term ‘repugnant’ I do so in my own opinion: I do not use non-free
    software on machines I control. This licence is non-free, and masquerading it as free
    is offensive. I have contributed lots to the Free Software community myself, and I
    would be completely outraged if any of my contributions were being shipped in a
    non-free product. Contributions are contributions to public software, not private
    profits.