[vUDS Blueprint 13.10] MongoDB into Ubuntu main

[John Moser]

James Page <james.page <at> ubuntu.com> writes:

> 
> Hi Clint
> 
> On 30/04/13 18:38, Clint Byrum wrote:
> > So, one could argue that the current Ubuntu packages, which do link
> > mongodb to OpenSSL, are violating the AGPL license. There is of course
> > the special exception for system libraries, but that requires that one
> > prove OpenSSL is "a major essential component of the specific operating
> > system on which the executable work runs". Not a huge stretch, but one
> > that Debian has been reluctant to make.
> 
> I raised this directly with 10gen last cycle; they granted Ubuntu a 
> license exception so that we could enable SSL support with OpenSSL.
> 
> I want to see if we can get this generically expanded to support 
*everyone*.
> 

Done in one:

Linking clauses in GPL, AGPL, etc. suppose that a copyright holder has 
standing to sue for a violation by linking a piece of external computer code 
with the work.  Specifically to our case, the claim is made that a copyright 
holder has standing to seek legal recourse for dynamic linking, insomuch 
that the piece of code dynamically linked to becomes an effective part of 
their work.

In the case of static linking, the code is incorporated into the final 
distributed work:  a modification is made to the final licensed work, 
producing a single unit of output (an executable, a library, etc.), 
containing everything.

In the case of dynamic linking, the final distributed work contains a 
definition of an interface with which to link to an external, separately-
supplied library.  Dynamic linking clauses assert that this library is 
incorporated into the work.

It can be shown that a dynamic linking clause can be satisfied by writing a 
useless stub library that does nothing, and then dynamic linking that to the 
work.  The work can then be shipped, and the library released under any 
licensing terms which satisfy the legal standing granted by the dynamic 
linking clause.

It can also be shown that a copyright holder does not have legal standing to 
everything he links to:  if that were the case, a copyright holder could 
link to, for example, Winelib, and then claim legal standing against 
Microsoft for violation of licensing rights.  In this case, Winelib performs 
the same function as the above mentioned "stub library", but expanded with 
actual functionality.

It is patently ridiculous to argue that a distributor may not or must not 
supply other works linkable, but such legal language has survived scrutiny 
from time to time.  It is, however, outside of the spirit and scope of most 
licenses of our concern:  such a license would effectively demand that you 
as an entity only supply packages for license-compatible work that may 
perform a specific function, and never supply other options.  It would also 
be easy for the end user to do an end-run around.

In practice, what this shows is that the overall cost of violating the 
dynamic linking clause is the cost of implementing a non-functional library 
with the same interface as a functional library that would violate the  
clause.  Moreover, that cost applies only to the packager at worst, an 
external entity at best; and performing the work is a simple exercise, not a 
profit generating act for the copyright holder.  Thus nobody has any claim 
to valid damages, as the terms of contract can be satisfied by "going 
through the motions".

In effect, there is no legal standing for the dynamic linking clause in the 
GPL, AGPL, or similar.  If there was, then distributions could be held 
responsible for supplying i.e. MongoDB  with libagssl (a theoretical, 
functional AGPL LibSSL re-implementation) and then allowing their users to 
install libopenssl instead--now violating the terms of the AGPL.  If we try 
to argue that a stub library is not a valid thing to link with and thus 
legally invalid for this discussion, then we're down to an argument that 
"you're violating the license because a proprietary version exists that is 
better" (essentially arguing that linking to Winelib would be legal if and 
only if Winelib were functionally superior to real Windows).

IANAL but I play one on TV.