Hi folks,
Some time ago we already had a discussion about possible license changes. See http://lists.roundcube.net/mail-archive/dev/2010-01/0000022.html to refresh your memory.
Now, almost two years later we came to the conclusion that it's time to act. But let me describe our thoughts a bit more:
Current Situation
Roundcube has inherited and built upon code from a variety of projects, allowing it to grow quickly to the solution we all love today. In doing so, it has effectively also inherited its licensing policy from projects which were not handling these issues as carefully as one might have wished.
These projects have often done a "licensed under the GNU General Public License (GPL)" without an explicit version. Sometimes this statement was accompanied with a link to a web page, most importantly http://www.gnu.org/licenses/gpl. This link was pointing at version 2 of the GPL, but it is the link that always leads to the latest version, so right now is pointing to GPL version 3. And so did Roundcube itself.
This, and the provisions in GPLv2 which say that you may at your option choose a later version if there is no explicit version mentioned means that right now Roundcube is "GPL v2 or v3, either may be binding for you depending on how you got it" and would *not* allow proprietary extensions and modules and may or may not allow proprietary skins, depending on your interpretation.
This is clearly not a perfect situation and it doesn't reflect the consensus within the Roundcube community (especially after the last licensing discussion) that proprietary modules (plugins) should be allowed, as should be proprietary skins. We meanwhile have specified Version 2 in our source but some links still point to the above mentioned URL which now shows Version 3 of the GPL.
So it would make a lot of sense to clarify this explicitly.
At the same time, the possibility of Roundcube being under GPLv2 blocks some innovation we would like to do for future versions, such as for example inline ODF support through WebODF, which is licensed under the GNU Affero General Public License (AGPL) Version 3.
Background information for the interested
GNU General Public License (GPL) Version 2: https://www.gnu.org/licenses/gpl-2.0.html
GNU General Public License (GPL) Version 3: https://www.gnu.org/licenses/gpl-3.0.html
A Quick Guide to GPLv3: https://www.gnu.org/licenses/quick-guide-gplv3.html
GNU Affero General Public License (AGPL) Version 3: https://www.gnu.org/licenses/agpl-3.0.html
Frequently Asked Questions about the GNU Licenses: https://www.gnu.org/licenses/gpl-faq.html
Proposed license clarification
Because of the incorporated numerous other components, the only options for licenses are in the GNU GPL family, namely GNU GPLv2, GNU GPLv3, GNU AGPLv3.
In order to become license compatible with some of the technologies we would like to be able to use in order to improve Roundcube, we should at the very least choose GNU GPL version 3.
We could also choose GNU AGPLv3, which would provide more rights to the users of Roundcube. It would mean that all users have the right to obtain the code of the instance that is providing their service (minus the additional modules, of course).
It would also ensure that modifications on the basic Roundcube codebase will have to be made available as soon as the are being used to provide services over the internet, not just when they are distributed in other ways.
This is the first choice we have.
Personally I'm okay with either, but as the recent discussion showed us, there are some arguments against the AGPL option. I would, however, in any case suggest we explicitly leave the "or any later version" default in, so future license updates won't require us to look at this again.
Secondly, if we want to allow proprietary modules and skins, which has turned out to be a major concern of our "users", we should add the explicit permission to create modules under any license, including a proprietary one, which can be done through the following exception to GPLv3 or AGPLv3:
This file forms part of the Roundcube Platform for which the
following exception is added: Plug-ins and Skins which merely
make function calls to the Roundcube Platform, and for that
purpose include it by reference shall not be considered
modifications of the Platform.
If you wish to use this file in another project or create a
modified version that will not be part of the Roundcube Platform,
you may remove the exception above and use this source code under
the original version of the license.
The first paragraph provides the permission.
The second paragraph allows re-use of Roundcube's code in other projects without the additional permission. Otherwise it would be too easy to circumvent the license and re-use may be limited by the licenses of the projects that wish to re-use code.
The Way forward
Because the Copyright in Roundcube is not consolidated, making these updates requires the agreement of all contributors to Roundcube.
So if you have in the past contributed to Roundcube, we would very much like to ask you for your explicit agreement with this path forward and your preference with regards AGPLv3 / GPLv3, and whether you would exclude one or the other, and for which reasons.
We believe this primarily represents a clarification and an adjustment to what we practiced over the past years, and we hope that you will also see it that way.
But of course we cannot force anyone to agree, so for those who prefer to have their code removed from Roundcube rather than agree to the update, please let us know.
Timing
This will not affect the 0.7 release, which will still take place under the somewhat fuzzy licensing situation, but we'll want to apply this to HEAD so we can make sure all code is properly updated and conflicting code replaced before the 0.8 release.
Please let us know, what you think about this proposal.
Best regards, Thomas _______________________________________________ List info: http://lists.roundcube.net/dev/ BT/aba52c80
hei core devs for me it does not matter, as long as it sounds like open source! thanks for all your work! Andreas
Am Montag, 28. November 2011, 20.27:02 schrieb Thomas Bruederli:
Hi folks,
Some time ago we already had a discussion about possible license changes. See http://lists.roundcube.net/mail-archive/dev/2010-01/0000022.html to refresh your memory.
Now, almost two years later we came to the conclusion that it's time to act. But let me describe our thoughts a bit more:
Current Situation
Roundcube has inherited and built upon code from a variety of projects, allowing it to grow quickly to the solution we all love today. In doing so, it has effectively also inherited its licensing policy from projects which were not handling these issues as carefully as one might have wished.
These projects have often done a "licensed under the GNU General Public License (GPL)" without an explicit version. Sometimes this statement was accompanied with a link to a web page, most importantly http://www.gnu.org/licenses/gpl. This link was pointing at version 2 of the GPL, but it is the link that always leads to the latest version, so right now is pointing to GPL version 3. And so did Roundcube itself.
This, and the provisions in GPLv2 which say that you may at your option choose a later version if there is no explicit version mentioned means that right now Roundcube is "GPL v2 or v3, either may be binding for you depending on how you got it" and would *not* allow proprietary extensions and modules and may or may not allow proprietary skins, depending on your interpretation.
This is clearly not a perfect situation and it doesn't reflect the consensus within the Roundcube community (especially after the last licensing discussion) that proprietary modules (plugins) should be allowed, as should be proprietary skins. We meanwhile have specified Version 2 in our source but some links still point to the above mentioned URL which now shows Version 3 of the GPL.
So it would make a lot of sense to clarify this explicitly.
At the same time, the possibility of Roundcube being under GPLv2 blocks some innovation we would like to do for future versions, such as for example inline ODF support through WebODF, which is licensed under the GNU Affero General Public License (AGPL) Version 3.
Background information for the interested
GNU General Public License (GPL) Version 2: https://www.gnu.org/licenses/gpl-2.0.html
GNU General Public License (GPL) Version 3: https://www.gnu.org/licenses/gpl-3.0.html
A Quick Guide to GPLv3: https://www.gnu.org/licenses/quick-guide-gplv3.html
GNU Affero General Public License (AGPL) Version 3: https://www.gnu.org/licenses/agpl-3.0.html
Frequently Asked Questions about the GNU Licenses: https://www.gnu.org/licenses/gpl-faq.html
Proposed license clarification
Because of the incorporated numerous other components, the only options for licenses are in the GNU GPL family, namely GNU GPLv2, GNU GPLv3, GNU AGPLv3.
In order to become license compatible with some of the technologies we would like to be able to use in order to improve Roundcube, we should at the very least choose GNU GPL version 3.
We could also choose GNU AGPLv3, which would provide more rights to the users of Roundcube. It would mean that all users have the right to obtain the code of the instance that is providing their service (minus the additional modules, of course).
It would also ensure that modifications on the basic Roundcube codebase will have to be made available as soon as the are being used to provide services over the internet, not just when they are distributed in other ways.
This is the first choice we have.
Personally I'm okay with either, but as the recent discussion showed us, there are some arguments against the AGPL option. I would, however, in any case suggest we explicitly leave the "or any later version" default in, so future license updates won't require us to look at this again.
Secondly, if we want to allow proprietary modules and skins, which has turned out to be a major concern of our "users", we should add the explicit permission to create modules under any license, including a proprietary one, which can be done through the following exception to GPLv3 or AGPLv3:
This file forms part of the Roundcube Platform for which the following exception is added: Plug-ins and Skins which merely make function calls to the Roundcube Platform, and for that purpose include it by reference shall not be considered modifications of the Platform. If you wish to use this file in another project or create a modified version that will not be part of the Roundcube Platform, you may remove the exception above and use this source code under the original version of the license.The first paragraph provides the permission.
The second paragraph allows re-use of Roundcube's code in other projects without the additional permission. Otherwise it would be too easy to circumvent the license and re-use may be limited by the licenses of the projects that wish to re-use code.
The Way forward
Because the Copyright in Roundcube is not consolidated, making these updates requires the agreement of all contributors to Roundcube.
So if you have in the past contributed to Roundcube, we would very much like to ask you for your explicit agreement with this path forward and your preference with regards AGPLv3 / GPLv3, and whether you would exclude one or the other, and for which reasons.
We believe this primarily represents a clarification and an adjustment to what we practiced over the past years, and we hope that you will also see it that way.
But of course we cannot force anyone to agree, so for those who prefer to have their code removed from Roundcube rather than agree to the update, please let us know.
Timing
This will not affect the 0.7 release, which will still take place under the somewhat fuzzy licensing situation, but we'll want to apply this to HEAD so we can make sure all code is properly updated and conflicting code replaced before the 0.8 release.
Please let us know, what you think about this proposal.
Best regards, Thomas _______________________________________________ List info: http://lists.roundcube.net/dev/ BT/f0a00374
List info: http://lists.roundcube.net/dev/ BT/aba52c80
Thomas,
So if you have in the past contributed to Roundcube, we would very much like to ask you for your explicit agreement with this path forward and your preference with regards AGPLv3 / GPLv3, and whether you would exclude one or the other, and for which reasons.
I'm not sure how much of my code still exists[1], but I'm fine with either.
Robin
[1] My last serious commit was almost 2 years ago... _______________________________________________ List info: http://lists.roundcube.net/dev/ BT/aba52c80
Dear Thomas,
Thank you for moving this forward!
You already know my take on this, but for the public record:
On Monday 28 November 2011 20.27:02 Thomas Bruederli wrote:
Proposed license clarification
Our preference would be for the AGPLv3+, but we're also happy with GPLv3+.
While we're not overly excited about proprietary modules and are don't have a particular sympathy for them, we're happy to accept the additional permissions to make sure the entire Roundcube community can move forward together.
Best regards, Georg
On 28.11.2011 20:27, Thomas Bruederli wrote:
GPLv3 or AGPLv3:
Both are good for me with preference on GPLv3.
This file forms part of the Roundcube Platform for which the following exception is added: Plug-ins and Skins which merely make function calls to the Roundcube Platform, and for that purpose include it by reference shall not be considered modifications of the Platform. If you wish to use this file in another project or create a modified version that will not be part of the Roundcube Platform, you may remove the exception above and use this source code under the original version of the license.
Accepted too.
You have my permission to change the license on any of my code.
I have a preference for GPLv3.
Cor _______________________________________________ List info: http://lists.roundcube.net/dev/ BT/aba52c80
GPLv3+ or AGPLv3+ are both good with me, with a strong preference for the non-Affero version i.e. GPLv3+).
On 28.11.2011 19:27, Thomas Bruederli wrote:
Hi folks,
Some time ago we already had a discussion about possible license changes. See http://lists.roundcube.net/mail-archive/dev/2010-01/0000022.html to refresh your memory.
Now, almost two years later we came to the conclusion that it's time to act. But let me describe our thoughts a bit more:
Current Situation
Roundcube has inherited and built upon code from a variety of projects, allowing it to grow quickly to the solution we all love today. In doing so, it has effectively also inherited its licensing policy from projects which were not handling these issues as carefully as one might have wished.
These projects have often done a "licensed under the GNU General Public License (GPL)" without an explicit version. Sometimes this statement was accompanied with a link to a web page, most importantly http://www.gnu.org/licenses/gpl. This link was pointing at version 2 of the GPL, but it is the link that always leads to the latest version, so right now is pointing to GPL version 3. And so did Roundcube itself.
This, and the provisions in GPLv2 which say that you may at your option choose a later version if there is no explicit version mentioned means that right now Roundcube is "GPL v2 or v3, either may be binding for you depending on how you got it" and would *not* allow proprietary extensions and modules and may or may not allow proprietary skins, depending on your interpretation.
This is clearly not a perfect situation and it doesn't reflect the consensus within the Roundcube community (especially after the last licensing discussion) that proprietary modules (plugins) should be allowed, as should be proprietary skins. We meanwhile have specified Version 2 in our source but some links still point to the above mentioned URL which now shows Version 3 of the GPL.
So it would make a lot of sense to clarify this explicitly.
At the same time, the possibility of Roundcube being under GPLv2 blocks some innovation we would like to do for future versions, such as for example inline ODF support through WebODF, which is licensed under the GNU Affero General Public License (AGPL) Version 3.
Background information for the interested
GNU General Public License (GPL) Version 2: https://www.gnu.org/licenses/gpl-2.0.html
GNU General Public License (GPL) Version 3: https://www.gnu.org/licenses/gpl-3.0.html
A Quick Guide to GPLv3: https://www.gnu.org/licenses/quick-guide-gplv3.html
GNU Affero General Public License (AGPL) Version 3: https://www.gnu.org/licenses/agpl-3.0.html
Frequently Asked Questions about the GNU Licenses: https://www.gnu.org/licenses/gpl-faq.html
Proposed license clarification
Because of the incorporated numerous other components, the only options for licenses are in the GNU GPL family, namely GNU GPLv2, GNU GPLv3, GNU AGPLv3.
In order to become license compatible with some of the technologies we would like to be able to use in order to improve Roundcube, we should at the very least choose GNU GPL version 3.
We could also choose GNU AGPLv3, which would provide more rights to the users of Roundcube. It would mean that all users have the right to obtain the code of the instance that is providing their service (minus the additional modules, of course).
It would also ensure that modifications on the basic Roundcube codebase will have to be made available as soon as the are being used to provide services over the internet, not just when they are distributed in other ways.
This is the first choice we have.
Personally I'm okay with either, but as the recent discussion showed us, there are some arguments against the AGPL option. I would, however, in any case suggest we explicitly leave the "or any later version" default in, so future license updates won't require us to look at this again.
Secondly, if we want to allow proprietary modules and skins, which has turned out to be a major concern of our "users", we should add the explicit permission to create modules under any license, including a proprietary one, which can be done through the following exception to GPLv3 or AGPLv3:
This file forms part of the Roundcube Platform for which the following exception is added: Plug-ins and Skins which merely make function calls to the Roundcube Platform, and for that purpose include it by reference shall not be considered modifications of the Platform. If you wish to use this file in another project or create a modified version that will not be part of the RoundcubePlatform, you may remove the exception above and use this source code under the original version of the license.
The first paragraph provides the permission.
The second paragraph allows re-use of Roundcube's code in other projects without the additional permission. Otherwise it would be too easy to circumvent the license and re-use may be limited by the licenses of the projects that wish to re-use code.
The Way forward
Because the Copyright in Roundcube is not consolidated, making these updates requires the agreement of all contributors to Roundcube.
So if you have in the past contributed to Roundcube, we would very much like to ask you for your explicit agreement with this path forward and your preference with regards AGPLv3 / GPLv3, and whether you would exclude one or the other, and for which reasons.
We believe this primarily represents a clarification and an adjustment to what we practiced over the past years, and we hope that you will also see it that way.
But of course we cannot force anyone to agree, so for those who prefer to have their code removed from Roundcube rather than agree to the update, please let us know.
Timing
This will not affect the 0.7 release, which will still take place under the somewhat fuzzy licensing situation, but we'll want to apply this to HEAD so we can make sure all code is properly updated and conflicting code replaced before the 0.8 release.
Please let us know, what you think about this proposal.
Best regards, Thomas _______________________________________________ List info: http://lists.roundcube.net/dev/ BT/5c4c2388
List info: http://lists.roundcube.net/dev/ BT/aba52c80
On Mon, Nov 28, 2011 at 8:27 PM, Thomas Bruederli thomas@roundcube.netwrote:
Hi folks,
Some time ago we already had a discussion about possible license changes. See http://lists.roundcube.net/mail-archive/dev/2010-01/0000022.html to refresh your memory.
Now, almost two years later we came to the conclusion that it's time to act. But let me describe our thoughts a bit more:
Current Situation
Roundcube has inherited and built upon code from a variety of projects, allowing it to grow quickly to the solution we all love today. In doing so, it has effectively also inherited its licensing policy from projects which were not handling these issues as carefully as one might have wished.
These projects have often done a "licensed under the GNU General Public License (GPL)" without an explicit version. Sometimes this statement was accompanied with a link to a web page, most importantly http://www.gnu.org/licenses/gpl. This link was pointing at version 2 of the GPL, but it is the link that always leads to the latest version, so right now is pointing to GPL version 3. And so did Roundcube itself.
This, and the provisions in GPLv2 which say that you may at your option choose a later version if there is no explicit version mentioned means that right now Roundcube is "GPL v2 or v3, either may be binding for you depending on how you got it" and would *not* allow proprietary extensions and modules and may or may not allow proprietary skins, depending on your interpretation.
This is clearly not a perfect situation and it doesn't reflect the consensus within the Roundcube community (especially after the last licensing discussion) that proprietary modules (plugins) should be allowed, as should be proprietary skins. We meanwhile have specified Version 2 in our source but some links still point to the above mentioned URL which now shows Version 3 of the GPL.
So it would make a lot of sense to clarify this explicitly.
At the same time, the possibility of Roundcube being under GPLv2 blocks some innovation we would like to do for future versions, such as for example inline ODF support through WebODF, which is licensed under the GNU Affero General Public License (AGPL) Version 3.
Background information for the interested
- GNU General Public License (GPL) Version 2:
https://www.gnu.org/licenses/gpl-2.0.html
- GNU General Public License (GPL) Version 3:
https://www.gnu.org/licenses/gpl-3.0.html
- A Quick Guide to GPLv3:
https://www.gnu.org/licenses/quick-guide-gplv3.html
- GNU Affero General Public License (AGPL) Version 3:
https://www.gnu.org/licenses/agpl-3.0.html
- Frequently Asked Questions about the GNU Licenses:
https://www.gnu.org/licenses/gpl-faq.html
Proposed license clarification
Because of the incorporated numerous other components, the only options for licenses are in the GNU GPL family, namely GNU GPLv2, GNU GPLv3, GNU AGPLv3.
In order to become license compatible with some of the technologies we would like to be able to use in order to improve Roundcube, we should at the very least choose GNU GPL version 3.
We could also choose GNU AGPLv3, which would provide more rights to the users of Roundcube. It would mean that all users have the right to obtain the code of the instance that is providing their service (minus the additional modules, of course).
It would also ensure that modifications on the basic Roundcube codebase will have to be made available as soon as the are being used to provide services over the internet, not just when they are distributed in other ways.
This is the first choice we have.
Personally I'm okay with either, but as the recent discussion showed us, there are some arguments against the AGPL option. I would, however, in any case suggest we explicitly leave the "or any later version" default in, so future license updates won't require us to look at this again.
Secondly, if we want to allow proprietary modules and skins, which has turned out to be a major concern of our "users", we should add the explicit permission to create modules under any license, including a proprietary one, which can be done through the following exception to GPLv3 or AGPLv3:
This file forms part of the Roundcube Platform for which the following exception is added: Plug-ins and Skins which merely make function calls to the Roundcube Platform, and for that purpose include it by reference shall not be considered modifications of the Platform. If you wish to use this file in another project or create a modified version that will not be part of the Roundcube Platform, you may remove the exception above and use this source code under the original version of the license.
I think this is incorrect and therefor I need some clarification: how is this possible with either license?
Right now, this is not even possible for Wordpress and themes, is it? If I buy a Wordpress plugin or theme, I am allowed to put the source code online. And Wordpress is "just" GPL (as is RoundCube currently). With the AGPL, I'd have to provide the source to a RoundCube plugin because people can use it through (!) a browser.
I don't know how you plan to have a legally binding license and then have home-grown exceptions.
You should reach out to the FSF, as did Wordpress: http://wordpress.org/news/2009/07/themes-are-gpl-too/
TL;DR: PHP files in themes must be GPL, CSS/Images/JavaScript must not be GPL (but can be of course). I'm guessing plugins are 100% GPL.
While the GPL allows someone who hosts RoundCube to make modifications and not share them, the AGPL does not allow this under any circumstances because people can 'connect' to RoundCube via a browser. The AGPL tries to close this so-called loophole. I'm not even sure if for example images and css from a RoundCube skin could be licensed anything else than AGPL.
Not that I am not a fan of open source, but I think there should be limits as in what RoundCube as a project imposes on the people who use it. I release all my open source with BSD and MIT usually which is a (in layman's terms) "do as you like"-license.
Sharing and contributing is the high road, but not everything can be shared and the reasons should not be our concern.
I think the AGPL makes it harder for commercial entities to use RoundCube. These entities include plugin developers, web hosters, theme designers, etc..
Till
The first paragraph provides the permission.
The second paragraph allows re-use of Roundcube's code in other projects without the additional permission. Otherwise it would be too easy to circumvent the license and re-use may be limited by the licenses of the projects that wish to re-use code.
The Way forward
Because the Copyright in Roundcube is not consolidated, making these updates requires the agreement of all contributors to Roundcube.
So if you have in the past contributed to Roundcube, we would very much like to ask you for your explicit agreement with this path forward and your preference with regards AGPLv3 / GPLv3, and whether you would exclude one or the other, and for which reasons.
We believe this primarily represents a clarification and an adjustment to what we practiced over the past years, and we hope that you will also see it that way.
But of course we cannot force anyone to agree, so for those who prefer to have their code removed from Roundcube rather than agree to the update, please let us know.
Timing
This will not affect the 0.7 release, which will still take place under the somewhat fuzzy licensing situation, but we'll want to apply this to HEAD so we can make sure all code is properly updated and conflicting code replaced before the 0.8 release.
Please let us know, what you think about this proposal.
Best regards, Thomas
List info: http://lists.roundcube.net/dev/ BT/aba52c80
Hi Till,
On Saturday 03 December 2011 21.06:00 till wrote:
I think this is incorrect and therefor I need some clarification: how is this possible with either license?
Because of the exception.
Check out
https://www.gnu.org/licenses/gpl-faq.html#GPLIncompatibleLibs https://www.gnu.org/licenses/gpl-faq.html#WMS https://www.gnu.org/licenses/gcc-exception.html
for some background and examples.
You should reach out to the FSF, [...]
That is what Thomas did.
He has raised this with FSFE's Freedom Task Force some time ago, and the proposed exception has been discussed with Dr. Till Jaeger of JBB Berlin, who was co-author of the first publication on the GPL in Germany, and the first to enforce it in court worldwide.
Dr. Jaeger has also been intimately involved in the drafting of GPLv3 and is still the legal representative of FSFE, gpl-violations.org and some others.
TL;DR: PHP files in themes must be GPL, CSS/Images/JavaScript must not be GPL (but can be of course). I'm guessing plugins are 100% GPL.
Yes, without the explicit exception that is probably the case.
But as Thomas described it to FSFE and myself, this was not the intention of the Roundcube community which wanted to enable proprietary modules & skins.
Hence the exception.
I think the AGPL makes it harder for commercial entities to use RoundCube. These entities include plugin developers, web hosters, theme designers, etc..
Please note that we *are* a commercial entity, and prefer the AGPL.
But as stated, the exception gives explicit permission for proprietary modules and skins, but does not allow to make the Roundcube core itself proprietary.
The only difference between GPLv3+ and AGPLv3+ in this case is whether or not providing users with the service counts as distribution.
AGPLv3 says yes, GPLv3 says no.
As stated, our preference is for AGPLv3, and for no proprietary exceptions.
But we understand the majority prefers GPLv3, and proprietary exceptions, so we're willing to accept that in order to allow the community to move forward together.
Best regards, Georg
I agree with Till. Commercial entities help RC in may ways. I discover RC because one of my providers use it, and now I have installed it to use by more than 12.000 people (I work as sysadmin on a spanish university). Also, commercial entities could make helpful contributions to RC.
I think RC must use the less restrictive license.
Regads,
Pedro
El 03/12/11 21:06, till escribió:
On Mon, Nov 28, 2011 at 8:27 PM, Thomas Bruederli <thomas@roundcube.net mailto:thomas@roundcube.net> wrote:
Hi folks, Some time ago we already had a discussion about possible license changes. See http://lists.roundcube.net/mail-archive/dev/2010-01/0000022.html to refresh your memory. Now, almost two years later we came to the conclusion that it's time to act. But let me describe our thoughts a bit more: Current Situation ================= Roundcube has inherited and built upon code from a variety of projects, allowing it to grow quickly to the solution we all love today. In doing so, it has effectively also inherited its licensing policy from projects which were not handling these issues as carefully as one might have wished. These projects have often done a "licensed under the GNU General Public License (GPL)" without an explicit version. Sometimes this statement was accompanied with a link to a web page, most importantly http://www.gnu.org/licenses/gpl. This link was pointing at version 2 of the GPL, but it is the link that always leads to the latest version, so right now is pointing to GPL version 3. And so did Roundcube itself. This, and the provisions in GPLv2 which say that you may at your option choose a later version if there is no explicit version mentioned means that right now Roundcube is "GPL v2 or v3, either may be binding for you depending on how you got it" and would *not* allow proprietary extensions and modules and may or may not allow proprietary skins, depending on your interpretation. This is clearly not a perfect situation and it doesn't reflect the consensus within the Roundcube community (especially after the last licensing discussion) that proprietary modules (plugins) should be allowed, as should be proprietary skins. We meanwhile have specified Version 2 in our source but some links still point to the above mentioned URL which now shows Version 3 of the GPL. So it would make a lot of sense to clarify this explicitly. At the same time, the possibility of Roundcube being under GPLv2 blocks some innovation we would like to do for future versions, such as for example inline ODF support through WebODF, which is licensed under the GNU Affero General Public License (AGPL) Version 3. Background information for the interested ========================================= * GNU General Public License (GPL) Version 2: https://www.gnu.org/licenses/gpl-2.0.html * GNU General Public License (GPL) Version 3: https://www.gnu.org/licenses/gpl-3.0.html * A Quick Guide to GPLv3: https://www.gnu.org/licenses/quick-guide-gplv3.html * GNU Affero General Public License (AGPL) Version 3: https://www.gnu.org/licenses/agpl-3.0.html * Frequently Asked Questions about the GNU Licenses: https://www.gnu.org/licenses/gpl-faq.html Proposed license clarification ============================== Because of the incorporated numerous other components, the only options for licenses are in the GNU GPL family, namely GNU GPLv2, GNU GPLv3, GNU AGPLv3. In order to become license compatible with some of the technologies we would like to be able to use in order to improve Roundcube, we should at the very least choose GNU GPL version 3. We could also choose GNU AGPLv3, which would provide more rights to the users of Roundcube. It would mean that all users have the right to obtain the code of the instance that is providing their service (minus the additional modules, of course). It would also ensure that modifications on the basic Roundcube codebase will have to be made available as soon as the are being used to provide services over the internet, not just when they are distributed in other ways. This is the first choice we have. Personally I'm okay with either, but as the recent discussion showed us, there are some arguments against the AGPL option. I would, however, in any case suggest we explicitly leave the "or any later version" default in, so future license updates won't require us to look at this again. Secondly, if we want to allow proprietary modules and skins, which has turned out to be a major concern of our "users", we should add the explicit permission to create modules under any license, including a proprietary one, which can be done through the following exception to GPLv3 or AGPLv3: This file forms part of the Roundcube Platform for which the following exception is added: Plug-ins and Skins which merely make function calls to the Roundcube Platform, and for that purpose include it by reference shall not be considered modifications of the Platform. If you wish to use this file in another project or create a modified version that will not be part of the Roundcube Platform, you may remove the exception above and use this source code under the original version of the license.I think this is incorrect and therefor I need some clarification: how is this possible with either license?
Right now, this is not even possible for Wordpress and themes, is it? If I buy a Wordpress plugin or theme, I am allowed to put the source code online. And Wordpress is "just" GPL (as is RoundCube currently). With the AGPL, I'd have to provide the source to a RoundCube plugin because people can use it through (!) a browser.
I don't know how you plan to have a legally binding license and then have home-grown exceptions.
You should reach out to the FSF, as did Wordpress: http://wordpress.org/news/2009/07/themes-are-gpl-too/
TL;DR: PHP files in themes must be GPL, CSS/Images/JavaScript must not be GPL (but can be of course). I'm guessing plugins are 100% GPL.
While the GPL allows someone who hosts RoundCube to make modifications and not share them, the AGPL does not allow this under any circumstances because people can 'connect' to RoundCube via a browser. The AGPL tries to close this so-called loophole. I'm not even sure if for example images and css from a RoundCube skin could be licensed anything else than AGPL.
Not that I am not a fan of open source, but I think there should be limits as in what RoundCube as a project imposes on the people who use it. I release all my open source with BSD and MIT usually which is a (in layman's terms) "do as you like"-license.
Sharing and contributing is the high road, but not everything can be shared and the reasons should not be our concern.
I think the AGPL makes it harder for commercial entities to use RoundCube. These entities include plugin developers, web hosters, theme designers, etc..
Till
The first paragraph provides the permission. The second paragraph allows re-use of Roundcube's code in other projects without the additional permission. Otherwise it would be too easy to circumvent the license and re-use may be limited by the licenses of the projects that wish to re-use code. The Way forward =============== Because the Copyright in Roundcube is not consolidated, making these updates requires the agreement of all contributors to Roundcube. So if you have in the past contributed to Roundcube, we would very much like to ask you for your explicit agreement with this path forward and your preference with regards AGPLv3 / GPLv3, and whether you would exclude one or the other, and for which reasons. We believe this primarily represents a clarification and an adjustment to what we practiced over the past years, and we hope that you will also see it that way. But of course we cannot force anyone to agree, so for those who prefer to have their code removed from Roundcube rather than agree to the update, please let us know. Timing ====== This will not affect the 0.7 release, which will still take place under the somewhat fuzzy licensing situation, but we'll want to apply this to HEAD so we can make sure all code is properly updated and conflicting code replaced before the 0.8 release. Please let us know, what you think about this proposal. Best regards, Thomas
List info: http://lists.roundcube.net/dev/ BT/3ebf0196
Dear Pedro,
it is not clear to me how a license that explicitly says it is okay not to contribute back would increase the numbers of contributions back to Roundcube.
From our perspective as a commercial entity, we have contributed quite a bit
of code for the 0.7 release, and might not have done that under a weaker license, as we prefer an even footing for all contributors.
So we would likely not agree to a less protective or balanced license.
That said, I don't think that is even a theoretical option. Roundcube incorporates some major third-party contributions under the GPL which are not easily relicensed, and obtaining permission from each and everyone one of the upstream contributors is likely an impossible undertaking.
You are of course welcome to re-write all those parts under a BSD license, but as a commercial entity we would probably hesitate to contribute to that effort.
Best regards, Georg
On 05.12.2011 11:30, Georg C. F. Greve wrote:
it is not clear to me how a license that explicitly says it is okay not to contribute back would increase the numbers of contributions back to Roundcube.
It's possible: less protective lic. -> more users -> more contributions. But of course it doesn't always work this way.
From our perspective as a commercial entity, we have contributed quite a bit
of code for the 0.7 release, and might not have done that under a weaker license, as we prefer an even footing for all contributors.
So we would likely not agree to a less protective or balanced license.
I think we're discussing GPL vs. AGPL now. It's impossible (or almost impossible) to use other less protective license with current code base (and developer base).
Hello,
I was talking about GPL vs AGPL, not BSD ;-)
As I could understand (I'm not english and some terms are not easy to me) ther are two major problems: one is the use of RC on commercial systems, and other is the developing of plugins and some other parts of RC.
Let me give an example: I need to write a plugin for authentication, because we use own authentication routines, and this code is not useful for nobody else. Also the code may be protected because some parts are developed by a software company. Under some licenses I never could use RC because if I use this plugin I have to relase all source and I can't because some parts have a commercial license (here are called commercial secrets and/or intellectual property). Is that I care about.
Some contributors like to release his code under very less protective licenses, like BSD, and others not, but "that's life" :-)
Best regards, Pedro
El 05/12/11 11:30, Georg C. F. Greve escribió:
Dear Pedro,
it is not clear to me how a license that explicitly says it is okay not to contribute back would increase the numbers of contributions back to Roundcube.
From our perspective as a commercial entity, we have contributed quite a bit of code for the 0.7 release, and might not have done that under a weaker license, as we prefer an even footing for all contributors.
So we would likely not agree to a less protective or balanced license.
That said, I don't think that is even a theoretical option. Roundcube incorporates some major third-party contributions under the GPL which are not easily relicensed, and obtaining permission from each and everyone one of the upstream contributors is likely an impossible undertaking.
You are of course welcome to re-write all those parts under a BSD license, but as a commercial entity we would probably hesitate to contribute to that effort.
Best regards, Georg
Dear Pedro,
On Monday 05 December 2011 13.06:29 Pedro R. Benito da Rocha wrote:
I was talking about GPL vs AGPL, not BSD ;-)
Ah, a misunderstanding, it seems. So you actually meant to say that you are happy with the proposal to see Roundcube move from a "pure GPL" to a "GPL with explicit exceptions for some proprietary use cases", then?
Let me give an example: I need to write a plugin for authentication, because we use own authentication routines, and this code is not useful for nobody else.
Are you really using a proprietary means of authentication?
I'd be curious about that use case, to be honest. :)
Also the code may be protected because some parts are developed by a software company. Under some licenses I never could use RC because if I use this plugin I have to relase all source
Please note that the GPL does not mandate you release all source code all the time, neither does the AGPL, for that matter.
and I can't because some parts have a commercial license (here are called commercial secrets and/or intellectual property). Is that I care about.
FWIW, I think it is always important to differentiate between proprietary and commercial. What we do is no less commercial than what some large companies are doing. But it is a lot less proprietary.
See
http://carlodaffara.conecta.it/?p=216
http://blogs.fsfe.org/greve/?p=347
for some additional information.
Best regards, Georg
P.S. <totally off topic>
Universidad de Burgos (España)
Ahhh... from the place of the awesome Morcilla.
I'll use this conversation as an excuse to drop by next time I'm around. ;)
</totally off topic>
Hi,
Let me give an example: I need to write a plugin for authentication, because we use own authentication routines, and this code is not useful for nobody else.
Are you really using a proprietary means of authentication?
I'd be curious about that use case, to be honest. :)
We release some plugins that we make as open source, but we do have some plugins that connect our RC installation with other internal systems (like a semi-homegrown OTP system, and a homegrown anti spam system), and we prefer not to release that source because it gives away information about our internal systems. We see that as a security and/or privacy risk. Spammers could abuse it to game our systems for instance.
Now, I know all about security by obscurity, and probably it won't hurt to be forced to release those sources, but we'd rather not if we don't have to. These plugins are pretty much of no use to anyone but people trying to gain knowledge of our internal systems.
RC was created with plugins in mind. They are an integral way for people to expand and integrate RC into other systems. At some point you have to let go and allow people to use it, without trying to dictate how they can use it.
Please note that the GPL does not mandate you release all source code all the time, neither does the AGPL, for that matter.
Sorry? I think AGPL does mandate you to release all source code the moment you change 1 byte in the original code. Basically the moment RC would become AGPL, everyone that changed 1 line of code in their source would have to provide a full source link or not be compliant. Right?
Regards,
Cor
List info: http://lists.roundcube.net/dev/ BT/aba52c80
On Sun, Dec 4, 2011 at 3:10 PM, Georg C. F. Greve greve@kolabsys.comwrote:
Hi Till,
On Saturday 03 December 2011 21.06:00 till wrote:
I think this is incorrect and therefor I need some clarification: how is this possible with either license?
Because of the exception.
The exception is possible because of the exception?
Check out
https://www.gnu.org/licenses/gpl-faq.html#GPLIncompatibleLibs https://www.gnu.org/licenses/gpl-faq.html#WMS https://www.gnu.org/licenses/gcc-exception.html
for some background and examples.
I wish this was less complicated. The exception clause still doesn't make sense to me.
The first link is discussing using libraries with another license – let's forget non-free (though I "object" to that term) for a second: does that mean that other libraries need to be dual-licensed in order to be included? Or not be included at all (which is currently why we have two different releases)?
The second link – I don't get at all. I looked for a German translation and there is none currently. It suggests that templates are licensed using the same license the 'system' is licensed in. But what happens if these templates are 'commercial' works? If you go from templates to plugins, how does that work?
The third link makes no sense to me because we don't compile anything here. How is this applicable for RoundCube?
I'm sure this is easy to grasp for some people, but I'd like to see this explicitely stated in writing before we decide on this and then all of a sudden some of our users end up on gpl-violations.org.
You should reach out to the FSF, [...]
That is what Thomas did.
He has raised this with FSFE's Freedom Task Force some time ago, and the proposed exception has been discussed with Dr. Till Jaeger of JBB Berlin, who was co-author of the first publication on the GPL in Germany, and the first to enforce it in court worldwide.
Dr. Jaeger has also been intimately involved in the drafting of GPLv3 and is still the legal representative of FSFE, gpl-violations.org and some others.
Must have missed those emails – is there a way to see this conversation somewhere?
It should be 'in' this thread, IMHO.
TL;DR: PHP files in themes must be GPL, CSS/Images/JavaScript must not be GPL (but can be of course). I'm guessing plugins are 100% GPL.
Yes, without the explicit exception that is probably the case.
It's a 100% propability.
But as Thomas described it to FSFE and myself, this was not the intention of the Roundcube community which wanted to enable proprietary modules & skins.
Hence the exception.
I think the AGPL makes it harder for commercial entities to use
RoundCube.
These entities include plugin developers, web hosters, theme designers, etc..
Please note that we *are* a commercial entity, and prefer the AGPL.
I'm a commercial entity as well and I still contribute to open source. Most of my clients allow me to open source a lot of things as well. We open source it using very liberal licenses (not GPL). No one wants to be forced to contribute. I personally contribute when the circumstances permit it. Which is why I don't base my work on *any* GPL-licensed software. LGPL is as close as I get.
Till
But as stated, the exception gives explicit permission for proprietary modules and skins, but does not allow to make the Roundcube core itself proprietary.
The only difference between GPLv3+ and AGPLv3+ in this case is whether or not providing users with the service counts as distribution.
AGPLv3 says yes, GPLv3 says no.
As stated, our preference is for AGPLv3, and for no proprietary exceptions.
But we understand the majority prefers GPLv3, and proprietary exceptions, so we're willing to accept that in order to allow the community to move forward together.
Best regards, Georg
-- Georg C. F. Greve Chief Executive Officer
Kolab Systems AG Zürich, Switzerland
e: greve@kolabsys.com t: +41 78 904 43 33 w: http://kolabsys.com
pgp: 86574ACA Georg C. F. Greve
List info: http://lists.roundcube.net/dev/ BT/aba52c80
On Monday 05 December 2011 15.33:24 Cor Bosman wrote:
RC was created with plugins in mind. They are an integral way for people to expand and integrate RC into other systems. At some point you have to let go and allow people to use it, without trying to dictate how they can use it.
Well, that is what the exception is explicitly aiming to do.
And yes, I already saw you agreed to it.
Sorry? I think AGPL does mandate you to release all source code the moment you change 1 byte in the original code. Basically the moment RC would become AGPL, everyone that changed 1 line of code in their source would have to provide a full source link or not be compliant. Right?
Almost.
Independently of whether or not you modified anything, with the proposed AGPL option, one would have to provide a download link for the core Roundcube packages (those that are provided on roundcube.net) but *not* the modules that may be under different licenses, and *only* for users to which the service was provided -- so not just anybody.
Best regards, Georg
On Dec 5, 2011, at 3:52 PM, Georg C. F. Greve wrote:
On Monday 05 December 2011 15.33:24 Cor Bosman wrote:
RC was created with plugins in mind. They are an integral way for people to expand and integrate RC into other systems. At some point you have to let go and allow people to use it, without trying to dictate how they can use it.
Well, that is what the exception is explicitly aiming to do.
And yes, I already saw you agreed to it.
I agreed after asking Thomas about the exception and how certain that exception is. If that exception is in any way open for discussion Id be against AGPL. If the exception is legal, then i don't mind AGPL but still prefer GPL just to avoid any uncertainty.
Cor _______________________________________________ List info: http://lists.roundcube.net/dev/ BT/aba52c80
Hi Till,
On Monday 05 December 2011 15.41:38 till wrote:
The exception is possible because of the exception?
A license is just a piece of text, in the end.
Anyone can come up with any license, and it becomes effective through copyright. So there is no way anyone could restrict the copyright holder from additional conditions and exceptions to any license, including the GPL, as long as you do it in ways that do not violate the Copyright of the license itself.
Exceptions to the GPL have been around since the 80s, really, so are not a new thing. The problem was always incompatibility that might result from this, and how to enable the re-use of code in other projects.
That is why GPLv3 has been drafted to address this on a more systematic level, so its compatibility with versions of itself with additional permissions / exceptions as well as other licenses has been greatly improved.
In any case. An exception can be granted by the copyright holders.
In this case, making a fairly limited exception that is similar in spirit to the operating system library exception is within the bounds of what one can reasonably expect to still correlate with the wishes of the original authors.
Otherwise, explicit agreement establishes the new license + exception.
If someone then explicitly disagrees, removing their code will always be an option to restore the overall license cleanliness, which is why this is something that should be offered.
With explicit agreement from everyone who was around and spoke up, and a standing offer to remove code of those who do not agree, Roundcube would indeed be on the safe side of things.
The third link makes no sense to me because we don't compile anything here. How is this applicable for RoundCube?
Compilation, or whether something is a library, makes comparatively little difference for licensing matters. So virtually everything you can read there applies.
I'm sure this is easy to grasp for some people, but I'd like to see this explicitely stated in writing before we decide on this and then all of a sudden some of our users end up on gpl-violations.org.
Which code has Harald Welte contributed to Roundcube?
Has he disagreed in public with this proposal?
Only a holder of a significant piece of Copyrights that has objected to the change would be in a position to actually challenge the license in court. So the people who could go to court on a Roundcube violation are the same ones who are on this list.
Must have missed those emails – is there a way to see this conversation somewhere?
If you want written legal advice from counsel, you'll need to pay for that.
The situation thus far was largely put together on the technical side by Thomas and Alec, and I gave the legal options some thought after having spoken with Thomas about what he considered the implicit policy of the Roundcube community on plugins and skins.
So I was doing what I could to help and while I am not a lawyer, I have a
little bit of experience in the area from my previous incarnation:
https://fsfe.org/about/greve/
Having drafted the Fiduciary Licence Agreement, created the concept of the Freedom Task Force and overseen its creation, worked with gpl-violations.org for some time, coordinated parts of the GPLv3 process and participated in it, having run the legal projects of two EU projects, and after having discussed the situation with Dr. Till Jaeger for sanity who gave me his feedback as a personal favour among friends, I feel sufficiently confident that this is indeed a path we can take.
But yes, I am not a lawyer.
If you want a legal opinion on which you can later claim damages if you are sued regardless, you'll need to pay a lawyer for that.
Yes, without the explicit exception that is probably the case.
It's a 100% propability.
In my experience, 100% probabilities do not exist in legal matters.
But I will agree with you that it is more than 90% likely that right now proprietary modules and skins violate the license.
If assuming that distribution has taken place under GPLv2 this would automatically and irrevocably terminate the license for the affected party until the licensor -- which is every Copyright holder, including those we no longer know where to find -- have granted a new license.
I suspect this reading would actually put a lot of users at risk of being sued for Copyright infringement right now, even though they did things that that would be considered acceptable by majority opinion.
Naturally these people could then claim that they used Roundcube under GPL Version 3, which is a reasonable assumption, as Thomas explained, and thus would have their rights automatically re-instated after they stop violating the license through proprietary plugins or skins.
But then they'd have to turn those plugins off, or license them under a GPL compatible Free Software license, which might be a non-Copyleft license, so would then not place any requirements on them for distribution of source code.
Because that situation is a bit more complex than one would wish for, I suggested to Thomas that he might simply make the line of what is acceptable explicit, and showed him how that would be possible.
If you feel that you would rather not touch the license, then we would be happy to continue distributing Roundcube under GPLv3 with no exceptions, as we do not require them for what we do because we don't do proprietary.
I'm a commercial entity as well and I still contribute to open source. Most of my clients allow me to open source a lot of things as well. We open source it using very liberal licenses (not GPL).
The term "liberal" always begs the question "liberty to do what?"
In the case of many "liberal" licenses that would be "liberty to sue Roundcube authors for patent infringement while commercially distributing the code they contributed to the project" as well as "liberty to monopolize the code contributed by others."
I find neither accepting, nor increasing the overall liberty of the project.
That's why for me, patent clauses are typically an absolute necessity, as are reciprocity provisions. You also don't have to go far to find examples of either of the above happening, and license is arguably one reason why GNU/Linux has taken on a lot more steam than the *BSD systems.
But yes, I agree there are specific cases where you want a license to provide additional permissions, because of some strategic purpose or higher goal.
But my default is clearly and strongly on Copyleft.
I do however understand that some people have a different perspective, and that is fine as long as it does not dictate what I have to do.
No one wants to be forced to contribute. I personally contribute when the circumstances permit it. Which is why I don't base my work on *any* GPL -licensed software. LGPL is as close as I get.
Does that mean your contributions to Roundcube were not under GPL, but actually BSD licensed?
Best regards, Georg
On Monday 05 December 2011 15.58:48 Cor Bosman wrote:
I agreed after asking Thomas about the exception and how certain that exception is. If that exception is in any way open for discussion Id be against AGPL. If the exception is legal, then i don't mind AGPL but still prefer GPL just to avoid any uncertainty.
As stated before, that is fine with me.
I do have a preference for AGPL, and against proprietary modules, but am not insisting on it in order to allow us all to move forward.
The clear majority seems to prefer the "GPLv3+ with exception" course. So I am happy enough to concur and go along for the sake of achieving consensus.
Best regards, Georg
On Mon, Dec 5, 2011 at 16:33, Georg C. F. Greve greve@kolabsys.com wrote:
On Monday 05 December 2011 15.58:48 Cor Bosman wrote:
I agreed after asking Thomas about the exception and how certain that exception is. If that exception is in any way open for discussion Id be against AGPL. If the exception is legal, then i don't mind AGPL but still prefer GPL just to avoid any uncertainty.
As stated before, that is fine with me.
I'd like to summarize this once again.
The goal of this license upgrade is to clarify the current situation which is somewhat vague and up to interpretation. In order to find the right balance between forcing people to contribute back to the project and allowing non-public/commercial entities to use and extend Roundcube the proposed solution is to use GPLv3 with the initially posted exception. This will have the following effects:
- For the Roundcube core codebase, the rules of GPLv3 apply and
copy-left is enforced
- Unlike AGPL this strong copy-left enforcement only affects projects
which re-distribute Roundcube but doesn't affect modified Roundcube installations which are only provided as a service
- Choosing GPL "version 3 or any later" over GPLv2 opens the doors to
combine Roundcube with components licensed under AGPL or future GPL versions
- With the exception in place, we exclude plugins and skins from being
ruled by the restrictions of the GPL. This should provide enough freedom for commercial entities and developers to create closed-source extensions or to publish their code under any license of their choice.
Finally, as Georg already said, the license is just a piece of text. But I'm convinced that with GPLv3 as a base and the exception written by some trusted law person we're on the safe side and well prepared for the future development of our great project.
Regards, Thomas _______________________________________________ List info: http://lists.roundcube.net/dev/ BT/aba52c80
-
A.L.E.C -
Andreas Dick -
Chris January -
Cor Bosman -
Georg C. F. Greve -
Pedro R. Benito da Rocha -
Robin Elfrink -
Thomas Bruederli -
till