[Haskell-cafe] GPL answers from the SFLC (WAS: Re: ANN: hakyll-0.1)

[Robert Greayer]

Pending an explicit response from the SFLC, I decided to ask the FSF
themselves what they thought of the Hackage/cabal situation.
Specifically, I asked this:

> There is a website, 'Hackage' (http://hackage.haskell.org) that hosts
> source code packages for Haskell libraries and programs.  The site
> hosts *only* source code, along with (text) descriptions of the
> packages.  Each package hosted by the site is either source code for a
> library, for a program, or for both.

> In the package description, a package author specifies what license
> applies to the source code, the common choices being LGPL, GPL, or
> BSD3.  The package author also specifies what other packages in the
> repository the package may require to compile successfully.

> The controversy in the community of users who use Hackage is whether
> or not it is a violation of the GPL for a package to be uploaded to
> Hackage specifying (for example) a BSD3 license for the code in the
> package, but also specifying that another package is a requirement for
> compilation, where that other package has been uploaded specifying (a
> version of) the GPL as its license.

> The opinion of many in the community is that since Hackage hosts only
> source code, and does not in any way combine packages (any combination
> of packages is created when a user chooses to download and compile and
> link the individual packages) there is no problem: there are no
> 'derived works' combining GPL and non-GPL being distributed on the
> site.

> Others believe that having a non-GPL package have as a dependency a
> GPL package is a problem for both the package author and for Hackage;
> that this in some way violates the GPL.

> I don't believe this sort of situation is clearly addressed in your
> FAQ (at least not to the satisfaction of the Hackage user community).
> There's a certain amount of fear, uncertainty and doubt being spread
> about usage of the GPL on Hackage, which it would be great to dispel
> (or, confirm, as necessary).


Someone from the FSF responded as follows:

> A work which extends or requires a GPL work will generally also need to
> be released under the GPL, unless the GPL work provides a specific
> exception for that case. You are already familiar with the FAQ; however,
> please note http://www.fsf.org/licensing/licenses/gpl-faq.html#OOPLang
> and http://www.fsf.org/licensing/licenses/gpl-faq.html#MereAggregation .
> There is no magic to the act of linking, compiling, or a function
> invocation; these are not defining moments. It is the level of
> integration and dependency which will define whether one work is a
> derivative of another.

> Ultimately, the decision that one work is a derivative of another is a
> legal one which a court may have to decide for a particular case; a
> lawyer can give you a legal opinion. However, a good rule of thumb would
> be: if P is a GPL work, and Q is a work that would not function without
> P, then Q is probably a derivative of P and should only be conveyed to a
> third party or the public under a GPL license, in compliance with the
> license for P.

> I hope that helps.

> Thank you for your interest in free software!
> I am not a lawyer and the above is not legal advice.
> The opinions expressed above do not constitute an official position of
> the Free
> Software Foundation.

> Luigi Bai
> FSF Associate Member
> Volunteer, licensing at gnu.org

Of course, given the disclaimer at the bottom, this opinion is officially no
better than any of our opinions on the matter.  Nevertheless, I would at
least believe based on the above that this is what the FSF *wants* the GPL
to mean, and, by extension, would assume, barring other evidence that
this is what someone who chooses the GPL *wants* it to mean, and in
licensing any software that I write that depends on someone else's GPL'd
software, I'd respect those desires (without at all suggesting that this has
any bearing on how the GPL would actually be interpreted in court).

There's still a lot of gray area here -- the mere existence of a dependency
doesn't imply that a software package is useless without the dependency,
so there are many situations in which P could depend on Q and not be
a derivative of Q, because the dependency can be disabled in some way
and the software would still function.  As an example -- pandoc can be
built with or without highlighting-kate, and is useful either way.  They're both
GPL and by the same author, so there's no issue, but were that not the
case it would seem obvious that pandoc isn't derivative of -kate, and
thus could (by this reasoning) be released independently under different
terms.  The same may not be true of the hakyll / pandoc situation which
sparked this controversy.

Cheers,
Rob