GPL license complications

[redge]

Hi,

I believe there is a problem with the SingleClick being GPL-based. I'm wondering if the license can be changed to BSD or Public Domain, for SingleClick only (the rest is fine as GPL).

The reason why I say this, is because technically everyone who releases their singleclick.exe inside their app package, proprietary or open source, is in violation of the GPL.

In order to comply, you would have to also send the 7.8MB zip file of the source, or constantly keep a copy and URL that *you* host with this next to every single download link for the singleclick.exe thing. I am quite sure this wasn't UltraVNC's intent.

Even if I wanted to provide the source to the .exe file, it cannot be done, because the .exe is generated by the UltraVNC site. More or less, it is impossible to comply with the GPL restrictions using SingleClick.

I realize most people are probably thinking "who cares?" but if FSF decides to start suing for misuse of the GPL, then it will be very annoying for some people.

Thank you for reading in advance.

Updates:
1) I was just reading previous posts on this issue, and there are a lot of other people here on the forums who are unsure if they're allowed to include the singleclick.exe in their installer, or fetching it remotely, etc etc, and then people are arguing about what the GPL clauses actually mean etc etc... I think for SingleClick, all these headaches can be avoided by making SingleClick BSD licensed. I'm going to guess that the UltraVNC developers did not intend singleclick.exe's distribution to be this complicated with the GPL.

2) I am not sure if it's even possible to use BSD and GPL as I suggested, which might complicate things heavily. Regardless though, I think a solution should still be reached as to what to do about SingleClick being GPL-based. We're all criminals in the eyes of the FSF because of it, and having to include the source with a tiny singleclick.exe is completely against the UltraVNC SingleClick idea in the first place.

Moderated by redge at 2011-02-06 23:02:

added sticky, interest for any developer must care GPL license

[Rudi De Vos]

I believe there is a problem with the SingleClick being GPL-based. I'm wondering if the license can be changed to BSD or Public Domain, for SingleClick only (the rest is fine as GPL).

We can't change the license.
There are 100 of people who contributed small parts, to change the license to BSD all need to agree, practical this is impossible.

The reason why I say this, is because technically everyone who releases their singleclick.exe inside their app package, proprietary or open source, is in violation of the GPL.

*If you bundle SC with your own non GPL package you are indeed vialating GPL.
The solution is to let your installer download SC, then your package doesn't contain GPL code ( That's also the reason why our own installer
doesn't have the drivers bundled, but offer them as seperate download)

In order to comply, you would have to also send the 7.8MB zip file of the source, or constantly keep a copy and URL that *you* host with this next to every single download link for the singleclick.exe thing. I am quite sure this wasn't UltraVNC's intent.

Even if I wanted to provide the source to the .exe file, it cannot be done, because the .exe is generated by the UltraVNC site. More or less, it is impossible to comply with the GPL restrictions using SingleClick.

The online creator is a 7zip archiver.
In order to comply you just need to reffer to the uvnc.com site ( SC source can be downloaded) or put a copy on your own site.
(The about box reffer to uvnc)

The creator doesn't change the source, it just add icons, bmp, config file
to the self extracting archive.
The vnc files are NOT compiled on the fly, but are the precompiled versions of the provided source code.

[smu johnson]

*If you bundle SC with your own non GPL package you are indeed vialating GPL.
The solution is to let your installer download SC, then your package doesn't contain GPL code ( That's also the reason why our own installer
doesn't have the drivers bundled, but offer them as seperate download)

That doesn't solve anything. If my installer fetches the SC.exe from an URL I host somewhere, then _that_ URL must then provide the source, because that URL being hosted is considered a distribution.

Sure, it solves the problem that the first installer doesn't need to have the source, but in the end, it solves nothing. GPL states that the source must be with the distribution of the GPL protected stuff. The SC.exe is protected, and no matter how many tricks and work-arounds with URL requests and external downloads you can do to hide this fact, eventually the source code must be provided by whatever is hosting the actual SC.exe, which is still us. In the end, is still us having to host the source code for something that is designed to be small and stand-alone.

[Rudi De Vos]

Sorry, i don't agree.

1) We used the GPL license Version 2, June 1991

3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:

a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,

b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,

c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)

The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.

If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.

GPL version 3 can be more restrictive, but vnc was original distributed as
GPL v2.

That doesn't solve anything. If my installer fetches the SC.exe from an URL I host somewhere, then _that_ URL must then provide the source, because that URL being hosted is considered a distribution.

No, the source can be on any server. You can also use a svn ( sourceforge) and distribute the object code on your own server.

GPL states that the source must be with the distribution of the GPL protected stuff

GPL say that the source must be availbale or be made available on request. It doesn not say that you must ditribute it togther with the object files.

[redge]

smu johnson

GPL say that the source must be availbale or be made available on request. It doesn not say that you must ditribute it togther with the object files.

if was source coded required with exe, this would annoying a lot of people than help for non developer.
developer need source code not exe ! So what to complaint ?

[smu johnson]

GPL say that the source must be availbale or be made available on request. It doesn not say that you must ditribute it togther with the object files.

Yes it does, that's exactly what Section "3, a" says:

3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:

a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,

If you want to get around that, you can follow "3, b" but that means you have to provide a written offer good for at least 3 years, WITH the object code.

Option "3, c" doesn't apply, because this is a commercial application that we're doing.

It seems like you're saying that if the source code is available, that's good enough, and you don't need to include it, or include an offer that you will provide it. Just that if someone asks, then you'll give it. Well I wish it were that simple too, but it seems clear that in section "3, b" that you must also provide an offer for it.

The official FAQ about version 2 of the GNU GPL has more to say about source provision, via this question:

Q: I downloaded just the binary from the net. If I distribute copies, do I have to get the source and distribute that too?

A: Yes. The general rule is, if you distribute binaries, you must distribute the complete corresponding source code too. The exception for the case where you received a written offer for source code is quite limited.

As far as the "offer" I keep mentioning:

Q: What does this “written offer valid for any third party” mean? Does that mean everyone in the world can get the source to any GPL'ed program no matter what?

A: If you choose to provide source through a written offer, then anybody who requests the source from you is entitled to receive it.

If you commercially distribute binaries not accompanied with source code, the GPL says you must provide a written offer to distribute the source code later. When users non-commercially redistribute the binaries they received from you, they must pass along a copy of this written offer. This means that people who did not get the binaries directly from you can still receive copies of the source code, along with the written offer.

The reason we require the offer to be valid for any third party is so that people who receive the binaries indirectly in that way can order the source code from you.

As far as hosting the source goes, we have to make real arrangements with you or SourceForge to guarantee that the source will stay put for 3 years. Just linking to the page isn't good enough. This is answered below:

Q: Can I put the binaries on my Internet server and put the source on a different Internet site?

A: The GPL says you must offer access to copy the source code “from the same place”; that is, next to the binaries. However, if you make arrangements with another site to keep the necessary source code available, and put a link or cross-reference to the source code next to the binaries, we think that qualifies as “from the same place”.

Note, however, that it is not enough to find some site that happens to have the appropriate source code today, and tell people to look there. Tomorrow that site may have deleted that source code, or simply replaced it with a newer version of the same program. Then you would no longer be complying with the GPL requirements. To make a reasonable effort to comply, you need to make a positive arrangement with the other site, and thus ensure that the source will be available there for as long as you keep the binaries available.

GPLv2 FAQ URL: http://www.gnu.org/licenses/old-license ... 0-faq.html

[Rudi De Vos]

Q: I downloaded just the binary from the net. If I distribute copies, do I have to get the source and distribute that too?

A: Yes. The general rule is, if you distribute binaries, you must distribute the complete corresponding source code too. The exception for the case where you received a written offer for source code is quite limited.

This only say that when you make the object files available for download
you also need to make sure the source is available. ( via a link, or host it yourself)
This doesn't say that you need to create a single package that contain source+object files.

When you distribute an object package, you can reffer to our site for the source package.
To avoid the risk that the source get replaced by a newer version you best keep a local copy.

[B]

smu, I've had my own concerns about GPL compliance here in the past, but I'm missing something -- what's your objection to a 3(b) style offer of code? You could include it in a text file within your compiled SC.EXE or perhaps on a web site or e-mail footer.

I was never very happy with the SC generator being reliant on a remote server, which is why projects like SCPrompt and ChunkVNC were so appealing to me. (I later found out that one reason for the remote server was so that the resulting executable could be digitally signed, making it more trustworthy to virus scanners et al.)

There is also a way to generate your own traditional SC.EXE with the right set of tools; it's documented somewhere around here...

I guess there's an interesting question as to whether all of these SC-style generators (UltraVNC SC, ChunkVNC, SCPrompt, and others) should include such an offer file and/or license/copying file by default...

[Rudi De Vos]

SC source is on the site.
Why including a written offer when we provide the source on the same web server ?

The online creator just create a self extracting installer that contain
the precompiled exe made with the provided source.
It's just a webbased tool for easy sfx creation...

If you have 7zip installed, you can extract this (sc.exe) archive like a zip file.

[B]

I'm just saying that, since technically we, as SC user/generators, <b>are</b> distributing the binaries wtihin that ZIP, that maybe(?) we (the SC generators) should include something about GPL compliance, probably via the offer letter, in the bundles we distribute to end users.

The end users will probably never visit the SC generating or UltraVNC web site.

I'm not sure about the code status or license of the self-extractor either, but I guess (?) you're saying it's irrelevant since it just contains the bundle as any self-extracting zip would....

Edit: Whoops; I was looking at the source packages instead of the compiled executable bundles; I see that the last ChunkVNC "InstantSupport.exe" I compiled (long ago) does <b>not</b> include license disclosure in the interface or the temp files it unpacks.

[smu johnson]

SC source is on the site.
Why including a written offer when we provide the source on the same web server ?

Because that's what happens when a stupid license like GPLv2 is picked. Just because sourceforge.net is a popular site and the source is available there, that isn't good enough.

GNU's official GPLv2 FAQ has this text for the question:

"Note, however, that it is not enough to find some site that happens to have the appropriate source code today, and tell people to look there. Tomorrow that site may have deleted that source code, or simply replaced it with a newer version of the same program. Then you would no longer be complying with the GPL requirements."

So, you say "you don't need to". GNU FAQ says you do. Since GNU wrote the license, I think they know what they're talking about. Hence the title of this thread.

EDIT: Perhaps you are assuming that we are doing the thing where our installer downloads the .exe remotely as you suggested. As others have guessed from this thread, I am distributing that generated .exe myself, and not doing any tricks to remotely download it. It's far more convenient for us just to give a hosted URL ourselves of the .exe and bundle it in our own SFX .exe's, etc etc. This is why the GPLv2 things become an issue for us.

As "B" was also thinking, we decided to just give out a written offer that we wrote out ourselves, and host the source code ourselves as well. We don't see anyway around it. Perhaps this is why his nickname is "B"

So, if you think we can still just link to your site for the source while we host our own sc.exe, then I'm quite sure we cannot.

[B]

Well, we differ on at least one point, smu -- I don't think the license is stupid at all. The whole point is to try to guarantee access to the source code for those who receive a copy of the program. I'm actually a bit surprised it's only a 3 year requirement!

Forget that Sourceforge happens to be reputable or "popular"; picking ANY site that you (the "distributor") doesn't control means there's no way to ensure the availability of the code. Anyway, it's good to hear you've settled your requirements. I do still think the SC distributions should include something. If I were rolling my own I'd probably just include the source code in the binary; file size is rarely a big deal these days.

[smu johnson]

Well, we differ on at least one point, smu -- I don't think the license is stupid at all. The whole point is to try to guarantee access to the source code for those who receive a copy of the program. I'm actually a bit surprised it's only a 3 year requirement!

That is not quite why I called it stupid. I called it a stupid choice because sending SingleClick as a small 166kb executable to just do whatever quick HelpDesk jobs you needed... well, goes against the GPL.

For the rest of UltraVNC it's a good choice, but for SingleClick, it adds restrictions that the original designers never foresaw.

[B]

On a related note, my current Repeater 1.0.8 has the following notification when it starts:

Copyright (C) 2005 Ultr@VNC Team Members. All Rights Reserved.


The Repeater is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
USA.

Repeater for Rel1.0.8 of PcHelpware

But to make things weirder, the web site says that the UVNC Repeater is BSD licensed! Karl's Perl version also includes GPL references...

[Rudi De Vos]

Installer: GPL exclude the installer from GPL.

I would like to bundle GPLed software with some sort of installation software. Does that installer need to have a GPL-compatible license?
No. The installer and the files it installs are separate works. As a result, the terms of the GPL do not apply to the installation software.

GNU's official GPLv2 FAQ has this text for the question:

GPLv2 FAQ wrote:

"Note, however, that it is not enough to find some site that happens to have the appropriate source code today, and tell people to look there. Tomorrow that site may have deleted that source code, or simply replaced it with a newer version of the same program. Then you would no longer be complying with the GPL requirements."

So, you say "you don't need to". GNU FAQ says you do.

Read again.
GNU faq tel you that as long that the source exist on uvnc.com, GPL is OK.
But to protect yourself, in case the source get missing you better make a local copy.
You follow GPL TODAY, but perhaps not TOMORROW, but no GPL violation TODAY.

I my opinion you still can link, but putting a own copy online can't hurt.

Repeater:
Has a dual license BSD or GPL.
GPL if you need to bundle it with other GPL
BSD if you want to bundle it with commercial stuff.

[B]

Ah thanks for the explanations, Rudi!

I was going to actually argue with your interpretation on the second point -- it sounded to me as if they were saying 3rd party hosting was NEVER good enough -- but then I found the original FAQ and read the key <b>preceding</b> sentence -- in bold below.

Can I put the binaries on my Internet server and put the source on a different Internet site?

The GPL says you must offer access to copy the source code “from the same place”; that is, next to the binaries. <b>However, if you make arrangements with another site to keep the necessary source code available, and put a link or cross-reference to the source code next to the binaries, we think that qualifies as “from the same place”.</b>

Note, however, that it is not enough to find some site that happens to have the appropriate source code today, and tell people to look there. Tomorrow that site may have deleted that source code, or simply replaced it with a newer version of the same program. Then you would no longer be complying with the GPL requirements. To make a reasonable effort to comply, you need to make a positive arrangement with the other site, and thus ensure that the source will be available there for as long as you keep the binaries available.

http://www.gnu.org/licenses/old-license ... erentSites

So of course you were right!

So it now seems that "arrangements with the other site", meaning your site and Sourceforge's, <b>should</b> be enough to be able to point people to those sites for source code, after all. Thanks!

Edit: Of course I can't quite determine what a "positive arrangement" actually is -- at least one person got in trouble with Red Hat doing something like this... http://www.wampserver.com/phorum/read.php?2,28981

[B]

Just happened across this -- it isn't exactly the same issue -- it more applies to wrappers like SCPrompt -- but here's how CrossLoop defends itself (in some detail) against accusations that it's violating the GPL by wrapping UltraVNC with a proprietary program.

http://www.crossloop.com/help/vnc