Anthony Towns: GPLv3 and Debian
So with the GPLv3 and LGPLv3 finally out (hurray!) it’s time to
actually pay attention to the practical consequences of an upgrade to
the world’s premier copyleft licenses.
One of the things I hadn’t noticed, though I should have, is that the
LGPLv3 is not compatible with the GPLv2 – that is, GPLv2 programs that
used LGPLv2 libraries cannot make use of new versions of those libraries
released under the LGPLv3 without also updating their license to GPLv3
(or “GPLv2 or above”, or LGPLv2 or LGPLv3 or something similar).
Fortunately one of the major LGPLv2 libraries out there – glibc –
is reportedly going to remain available under the LGPL v2.1 but for
other libraries, it could become a problem, and it’s something GPLv2
authors will need to pay attention to.
Also fortunately the opposite problem – GPLv3 apps using LGPLv2 libraries
isn’t a problem, because the LGPLv2 explicitly allows redistribution
and modification under the terms of GPLv2 or later, so you can take
an LGPLv2 library and incorporate it in a GPLv3 application and just
release the whole thing under the GPLv3.
Unfortunately, the LGPLv3 doesn’t have a similar clause, so when the
GPLv4 comes out, if it ever does, we could easily find the GPLv4 apps
can’t use LGPLv3 libraries, and GPLv3 apps can’t use LGPLv4 libraries.
Really these are side-effects of a fundamental change: up until now,
almost everything we’ve distributed – and certainly all the low level
stuff: the kernel, the C library, the compiler, the shell and basic tools
– have all been under a GPLv2 compatible license. Some of them have
been more flexible than that, due to being under a BSD or MIT license,
or being under the LGPL or having a “GPLv2 or later” clause, but we’ve
been essentially able to ignore all that and just treat everything
as GPLv2. There are a few exceptions that we have to deal with – the
occassional app that’s not GPL compatible doesn’t cause much of a problem,
because things that depend on it don’t usually create copyleft issues,
which just leaves checking that it doesn’t use any GPL-only libs, such
as gnutls or libreadline. Openssl is a nuisance, in that it’s a popular,
GPL-incompatible library, but it’s also reasonably easy to deal with on
a case by case basis.
But with the GPLv3, that changes: as GPLv3 apps and LGPLv3 libraries
get uploaded, the assumption that more or less everything is GPLv2
compatible goes out the window, and while some things are GPLv2 only
(such as the kernel!) we also can’t assume everything is GPLv3 compatible.
Fortunately, both the GPLv2 and GPLv3 have what is known as the
“system library” exception, which allows you to not bother distributing
the source to your C compiler or C library or kernel with your app,
because everyone’s assumed to have one of those already. Unfortunately,
the GPLv2 version of that exception includes the phrase “unless that
component itself accompanies the executable”, so Debian has always
cautiously assumed the exception doesn’t apply to us, because everything
we distribute in main “accompanies” everything else in main – kernel,
C library, C compiler, etc. Equally unfortunately, while the GPLv3
avoids that problem, but ends up with a clause that’s not terribly
comprehensible, despite a couple of rewrites during the drafting process.
What’s all that mean?
The big thing is that it means Debian’s going to have to put a bit
more attention into the system library exception, both for GPLv2 and
GPLv3 apps, because our current policy of trying to avoid needing it is
probably not going to be sustainable. I’m not sure how in depth we’ll
need to go for that; we’ve already contacted the FSF licensing folks
for an explanation of the GPLv2 clause in relation to the CDDL, but it’s
possible the FSF might prefer to be ambiguous in responding so as to keep
their options open for defending or enforcing the GPL later, in which
case we might need to get legal advice of our own as to what we should do.
The second thing is that in reviewing our understanding of the
system library exception, we might be in a position to have a Debian
GNU/OpenSolaris port, making use of the exception for the CDDL-licensed
OpenSolaris kernel and libc, as Nexenta do. That seems to me to be
almost certainly possible for GPLv3 (or “GPLv2 or above”) applications,
and probably possible for GPLv2 apps as well.
If so, that’ll let us expand Debian to supporting four kernels in the
near future: Linux, Hurd, FreeBSD and OpenSolaris, which will be pretty
fun, in my book.
The downside, is that if we find an interpretation of the system
library exception that lets us mix and match licenses comfortably,
that same interpretation might be able to be used to let propietary
software vendors mix and match GPLed software with non-free software,
rather than just free software with different copyleft licenses –
and thus defeat the entire point of copyleft. What’s worse, is that by
following Debian’s lead, they’d have some moral authority in doing that,
beyond just having a legal argument as to why it’s okay.
And that’s the rub.
(My thoughts on the license texts as posted to -legal are
here, here, here and here.)
This graph shows the percentage of the total download that used HTTP
from a mirror. The optimal line shows the minimum possible (i.e. all
peers are connected), which corresponds to only one copy (the first)
of every package being downloaded using HTTP.
This verifies my previous thinking, which is that fracturing the
download population into multiple small swarms results in lots of
inefficiencies, and lots of HTTP downloading. All efforts will need
to be taken to keep the downloading populations together. (This is
especially difficult for unstable, when a new swarm could be created
twice a day due to archive updates.) Swarms of 1,000 peers or more
seem to be sufficient to minimize the HTTP downloading.
This graph shows the amount of unnecessary HTTP downloading that
occurred, which is just the difference of each line from the optimal
one in the previous plot. This shows the danger of selective
downloading, as all of this unnecessary HTTP downloading occurs
because the swarm is too big to find peers that have the desired
package (they do exist). Fortunately, this unnecessary downloading
seems to approach a maximum as the swarm size increases.
For the large swarm sizes needed to make the downloading efficient,
and assuming a reasonable number of connections of 100 (bittorrent
defaults to maintaining at least 40, and large swarms usually means
a large number of connections), we can expect to be using HTTP for
about 4% of the download. This number is surprisingly low due to the
popularity distribution of packages (only rare ones are hard to
find, but they aren't downloaded very often). I think 4% is
manageable in our situation, given that there is a backup method to
find the rare packages, though it does show the need to have that
backup method available. This is probably more of a problem for
regular bittorrent clients, in which there is no backup method.
The store served a general, non-technical audience. DRM-FREE, it turns
out, is a good way to sell music. Not just to geeks but to any consumer
who has been stymied unfairly by DRM or knows someone who has. That, it
turns out, is a whole lot people. Consumers know what DRM is and they
know don't like it.
As consumers learn more about DRM, they want to avoid it. Seeing this,
the companies that produce DRM are looking for ways to escape. 