Suitability of Apache license (v2)

[jpetso]

So the concerns I raised in issue #164 turned out not to be a problem. However, more recently in the AutobahnCpp issue queue, @oberstet brought up another concern: the Apache 2.0 license isn't compatible with GPLv2. This is documented by the Apache Foundation itself: http://www.apache.org/licenses/GPL-compatibility.html

In short, GPL projects that use Apache-licensed libraries (i.e. msgpack-c) are in a legal gray zone and might not be safe to distribute. This is because GPL's copyleft clauses extend to header-only libraries (*), but GPL's clauses are not compatible with those of the Apache license so the resulting license would be invalid.

(*) according to one of several reasonable interpretations, including that of the FSF that wrote the GPL

In other words, GPL projects probably shouldn't use msgpack-c, at least not its header-only C++ part. This limits the possible adoption of msgpack. Other licenses, such as the Boost license or the MIT license, do not have this problem.

Please consider if this is something you want to fix. If you decide to take action, you need to get approvals of all copyright holders to change the license.

[redboltz]

I understood the overview of the issue. I personally agree changing the License.

GPL and Apache License version 2.0 compatibility

In short, GPL projects that use Apache-licensed libraries (i.e. msgpack-c) are in a legal gray zone and might not be safe to distribute. This is because GPL's copyleft clauses extend to header-only libraries (*), but GPL's clauses are not compatible with those of the Apache license so the resulting license would be invalid.

(*) according to one of several reasonable interpretations, including that of the FSF that wrote the GPL

I'd like to clarify about above sentence.

Do you mean GPL projects cannot include Apache-licensed libraries even if Apache-licensed libraries is NOT a header-only library? I understand that the answer is yes, basically. But there are some ambiguous point. That's why, you said it is a legal gray zone.

If Apache-licensed libraries is a header-only library, it's no longer a legal gray zone. It is GPL violation. Is that correct? If it is, please let me know which part of GPL said that.

How to change the license

I'm not a license expert but I consulted an expert. He said that in order to change the license, we need all copyright holders' agreement.

What is the definition of 'copyright holder'? I've checked all source code except the part imported from the Boost.Libraries.

The following four people are mentioned as copyright owner.
KONDO Takatoshi
FURUHASHI Sadayuki
Vladimir Volodko
MIZUKI Hirata

However, msgpack-c merged many pull requests. If all of pull request sender are considered as copyright holders, I think that it is not practical to make their all agreement.
Any ideas?

[redboltz]

I understand as follows:

No	Containing	Contained	header only*1	License compatilbe
1	Apache*2	GPLv2	Yes	NG
2	Apache	GPLv2	No	NG
3	Apache	GPLv3	Yes	NG
4	Apache	GPLv3	No	NG
5	GPLv2	Apache	Yes	NG
6	GPLv2	Apache	No	NG(gray?)
7	GPLv3	Apache	Yes	OK
8	GPLv3	Apache	No	OK

*1 Header only is for Apache.
*2 Apache means Apache License version 2.0.

This issue is focus on No.5 and No.6. Is that correct?

[frsyuki]

I think ASF was saying differently about compatibility with GPLv2 before. But apparently, they couldn't convince FSF.

In my opinion, this license issue is not a big problem because most of GPL-licensed software allows users to choose GPLv2 or later. Before GPLv3, FSF has recommended following license header:

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.

http://www.gnu.org/licenses/old-licenses/gpl-2.0.html

Some OSS use GPLv2 explicitly (although some of them also has FOSS license exception such as mysql). But I think we can assume that they intentionally reject software released under Apache License, Version 2.0.
http://www.mysql.com/about/legal/licensing/foss-exception/

I don't have strong insistence on Apache License. I can agree to adopt Boost Software License. But I also don't have strong motivation to change it.

@redboltz Any thoughts?

[redboltz]

@frsyuki, thank you for the comment. I think that if there is actual case that GPLv2 software developer wants to use msgpack-c, and they can't update their license to GPLv3 in some reasons, it is the reasonable time to change msgpack-c's license.

@jpetso, I'd like to clarify the current situation. As you mentioned before, the following issue referred to msgpack-c's license: crossbario/autobahn-cpp#50 (comment)

AutobahnCpp depends on msgpack-c.
https://github.com/tavendo/AutobahnCpp

AutobahnCpp is going to change their license to solve the same license issue. Is that correct? And does AutobahnCpp user that is developing GPLv2 software have a trouble with the license issue?

@al11090, @vvolodko, do you mind if we change the msgpack-c's license from Apache License version 2.0 to Boost Software License - Version 1.0 ?

http://www.apache.org/licenses/LICENSE-2.0
http://www.boost.org/users/license.html

[oberstet]

@redboltz Yes, AutobahnCpp will also change it's license if you do so here. It only makes a difference to Autobahn users if we both change. But generally, for your GPL2 users as well. Boost license is fine, as this is compatible with the GPL2. MIT would also work. We have been through this change with AutobahnJS and AutobahnPython. For AutobahnPython we've been approached by Buildbot, a GPL2 project, and they considered AutobahnPython but couldn't because of Apache 2.0. So we went through the hassle and contacted all contributors to ask for permission to change the license (in this case to MIT).

[jpetso]

Sorry for the delay, just came back from a trip.

@redboltz, yes, this issue is specifically targeted towards No. 5 and 6 in your list.

@frsyuki, I don't think one can generally assume that the intention to use GPLv2 explicitly implies that they don't want to use Apache-licensed libraries. Different projects have different intentions so it's hard to make a generalizing statement. I think in many cases though, projects that use GPLv2, but not v3, choose it because of one of the following main reasons:

• They don't want to commit to the patent indemnification or anti-Tivoisation clauses in GPLv3, or they are philosophically opposed to them.
• They don't like to give the FSF power over their project's future licensing terms (GPLv4, v5, etc.).
• Somebody previously chose GPLv2 only and now the project can't change it without a considerable relicensing effort, so they just stick with it.
  Some might want to explicitly exclude Apache-style licenses, but I believe most just want a strong copyleft license that's popular and works for them.

[redboltz]

@vvolodko agreed the license change. See:
#40 (comment)
Thank you @vvolodko :)

[oberstet]

@jpetso

Somebody previously chose GPLv2 only and now the project can't change it without a considerable relicensing effort,

FWIW, that's exactly the situation we ran into with Autobahn: Buildbot sits on GPL2 only, and they have over 300 contributors. Which would be a big effort to get agreement from for a license change. So we did the switch (to MIT) so they can use our stuff.

[al11090]

I'm sorry for my delayed response.
I agree to change the license to Boost Software License ver.1, MIT or BSD-liked license.

[redboltz]

Thanks @al11090 !
We are ready to move on the next step.

[frsyuki]

I'll make this clear: I agree to change the license to Boost Software License, MIT license, or other BSD-like license.

[redboltz]

I created the new issue #377 for changing the license.