[Haskell-cafe] Licenses and dependencies

[Mike Meyer]

On Sat, Jan 11, 2014 at 2:17 PM, Mateusz Kowalczyk <fuuzetsu at fuuzetsu.co.uk>
wrote:
> Hey,
> Perhaps you should have CC'd the list as well for this reply.

Oops. I've moved it back, since you  suggested it.

> On 11/01/14 20:04, Mike Meyer wrote:
> >> On 11/01/14 18:44, Ben Foppa wrote:
> >> Once you distribute the binary, you have probably pulled in and used
the
> >> licensed libraries (unless replaced) so you're subject to the strongest
> >> license used.
> >
> > Not "strongest", but all.  Well, the GPL licenses sort of "stack",
> > since they explicitly allow you to use newer (and usually stronger)
> > versions of themselves, but other license don't.
> >
> > The GNU project provides a description of many of the available
> > licenses at: http://www.gnu.org/licenses/license-list.html, including
> > compatibility notes.
> Right, all, but what this usually entices is that the strongest one
> prevails. For example, code with BSD3 and GPLv3 sources will have to
> be released under GPLv3 as a whole (although each part is still what
> it was licensed under individually). I worked under the assumption
> that all dependencies are have compatible licenses (and their
> dependencies too &c).

No, it's not a contest. You *have* to abide by them all. If you're
dealing with the GPL, it may look like the "strongest" prevails, but
that's a property of the GPL. It specifically requires any derived
work be distributed under the GPL, with no added restrictions. So a
compatible license will have no extra restrictions, and appear
"weaker". A "stronger" license with extra restrictions (like the
4-clause BSD license) will be incompatible with the GPL, so you can't
distributed a derived work at all.

If you take the GPL out of the mix, and wanted to distributed a work
derived from something covered by (for instance) BSD4 and the CPL -
well, that would be fine, because I don't think either prevents the
restrictions in the other. But the derived work would be covered by
both, not just the stronger of the two (whichever that is).

Your usual case may well be GPL'ed code. I happen to work with
BSD-licensed code bases more often than not.

> >> I think you'll be fine just choosing the PublicDomain license option.
[...]
> >> Things you can't do with such an option:
> >>
> >> * bundle other people's code which isn't under public domain
> >
> > This is vague. If your bundle is a single work (like a static binary),
> > then it has to obey all the applicable licenses, and probably can't be
> > in the public domain. If it's a collection of works, then it can
> > include anything you want, so long as each element in the collection
> > obeys it's license.
>
> I meant bundle as in the repository/source tarball/however you publish
> your source, _not_ the binary (I explicitly mention binary somewhere
else).

In that case, you're perfectly free to include sources with other
licenses in the tarball. You just need to make sure you follow their
license for their entry in the collection. It's well-established that
a simple collection of works (a tarball, etc.) is not a derived work.

> >> * somehow enforce that only certain libraries will run with your
> >> program: the user should be able to replace the BSD3 licensed
> >> dependencies with their own if they want to
> > Is there any license that enforces that? That seems more like a
> > technical issue than a legal one. Though if you're dynamically linking
> > the libraries, things get incredibly confusing.
> LGPL, does it not? It even outlines what constitutes as a prevention
> of other libraries.

I believe the LGPL does just the opposite - it *permits* linking with
non-free code without creating a derived work. I think I may not be
understanding what you're saying, though.

I think you're implying that it's possible to force users to use
specific libraries. That is indeed the case - you could write a
modified version of the GPL that says "You may only redistribute works
derived from my project if they use my libraries". You are correct in
that you can't do that if you place the work in the public domain. On
the other hand, I don't know of any commonly used open source library
that does that.

     <mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.haskell.org/pipermail/haskell-cafe/attachments/20140111/165a5add/attachment.html>