Licensing Issue: Akismet Plugin external conflicts GPL version in it's readme.txt for WordPress package

[hakre]

Each time a WordPress package is build (ie ​nightly) files from the external Akismet Plugin repository are incorporated into the work.

Back in August 2010, the licensing of the Akismet Plugin was named as "License: GPLv2"). Prior to that change, no License information was given.

In contrast to this, the WordPress work is licensed under GPL, no specific version named (see r15534). The text of our license, is the one of GPL license version two.

Section 2 of WordPress' license explicitly does not force the GPL on to other works of their own, but when you

distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.

So even the GPL version in Akismet's readme.txt might not be wrong on it's own, having that exact licensing information given for code in the plugin subdirectory within the wordpress work as a whole as it is distributed is wrong.

In the past this was not a problem at all because readme.txt in the Akismet Plugin did not state a license and therefore could not conflict in such a way.

But since it changed back in August 2010, there is such a version conflict.

The first non-developer release in conflict was WordPress 3.0.2.

IANAL and suggest the following to resolve the conflict:

The Akismet plugin's copyright holder should be contacted and informed about the problem to find a solution.

If it demands to release the code under GPL v2 only, it must be removed from the package.

If they are okay to not introduce licensing constraints, it can stay in the package.

As long as this conflict is not resolved, no new non-developer packages should be released.

[hakre]

Decision A - 1/1

[hakre]

Decision B - 1/2

[hakre]

Decision B - 2/2

[hakre]

Patches attached. For any of the resolvements I could see so far.

As it's proposed to unbundle shortly (#16033), an accepted alternative to resolve the conflict could be to unbundle directly. Which would be same as remove. And it would not introduce any problems at all.

In any way easy fix. As the external developers have not asked prior to change their licensing notice while they knew that the code gets incorporated, I even no problem to directly blank it and ask them later. I'll mail the author who introduced the change, so the copyright holder of the plugin is informed about the issue.

As seen first here: ​Akismet Introduces GPL Version to WordPress

Tag: FIXIPO

[josephscott]

Would listing the Akismet plugin as "GPLv2 or later" be sufficient?

[hakre]

Replying to josephscott:

Would listing the Akismet plugin as "GPLv2 or later" be sufficient?

From best I know, no, it wouldn't. Writing that implies that this is only one of many, albeit this one can be easily reverted to the previous release to be conform again - or removed because it will be removed anyway. And it is not that old.

[hakre]

Related: #16039; #6663

[jane]

All tickets related to license will be addressed in 3.2.

[hakre]

Replying to jane:

All tickets related to license will be addressed in 3.2.

GPL v2 only or GPL v2+ code has to be removed from the package otherwise wordpress will be technically violating the terms of the GNU GPL. This is not only for any release in the past that contained such code, but also for any future release, including 3.1.

As you're the release manager or at least in a close position to such a role for 3.1, I'm pretty sure you are in full power to make the needed decisions.

If you decide (as outlined in your last comment) to not solve these known license issues prior to the next release but to punt them to 3.2, the violation is done with deliberate intention.

I'm pretty sure that this will weaken the projects position to negotiate with copyright holders.

Therefore to the best of my knowledge, I can only strongly advice to care about known issues prior to the next point release. Otherwise the project will loose a lot.

Additionally please name an email address where a person from the wordpress can be reached regarding licensing questions.

[markjaquith]

Would listing the Akismet plugin as "GPLv2 or later" be sufficient?

Yes. Encouraged, in fact.

[josephscott]

Updated Akismet plugin license to mention 'GPLv2 or later'

​http://plugins.trac.wordpress.org/changeset/334316

[hakre]

Is Automattic okay to leave this unchanged in the old releases and re-instate the rights under the GPL to copy, modify and distribute the code of the plugin?

(I re-open it, not that I don't think they don't provide those rights but just for confirmation that this is complete for the rights as well.)

UPDATE: The Property svn:externals set to
akismet ​http://plugins.svn.wordpress.org/akismet/tags/2.5.2/

which specifies "License: GPLv2". So this is not fixed ​in trunk yet even.

[nacin]

Yes, Akismet is released under the GPLv2 (or later), same as WordPress. No, Akismet will not be re-tagged for this. Yes, 2.5.3 or 2.6 (whichever is the next release of Akismet) will contain the proper reference.

[hakre]

Replying to nacin:

Yes, Akismet is released under the GPLv2 (or later), same as WordPress.

Yes I've understood that Akismet right now is licensend under GPLv2+ and that it is said of WordPress for the next release being GPLv2+ and for trunk since 14th of January or so.

But that was not what I was concerned about with my comment.

As the akismet code has been relicensed as GPL (no version given) by wordpress.org in 3.0.2 (that is what this ticket is about) and the authors of Akismet had not given the rights to relicense their software under GPL, the distribution of the code was technically violating the terms of their license.

The GPL v2 (their license) under these situation automatically terminates all rights of use for the WordPress project. That means, that from on 3.0.2 technically the WordPress project was no longer allowed to even copy the code into their package.

To get in compliance again, the original copyright holder (here: automattic) should be contacted and the reinstatement of rights should be asked for. Additionally, if they make the use of the code under the terms of the GPL (no version given) okay for the 3.0.2 and above packages for the past, this would make everything okay for the project.

My comment was about to get the reinstatement of rights and the general OK to the actions done in the past by wordpress.org on the akismet code so that there is no need for stuff like removing/fixing old releases.

So to refrain:

Is Automattic okay to leave this unchanged in the old releases and re-instate the rights under the GPL [now v2+]) to copy, modify and distribute the code of the plugin?

[josephscott]

Is Automattic okay to leave this unchanged in the old releases and re-instate the rights under the GPL [now v2+]) to copy, modify and distribute the code of the plugin?

Yes.

[hakre]

Wordpress 3.0.5 Package (​http://wordpress.org/latest.zip) technically violates the GPL again with the shipped Akismet code (have not checked RC4).

So can someone from Automattic/Akismet pro-forma reinstate rights again because of the release?

(I thought this would have gone fixed prior next WP release, please ensure for 3.1 or perhaps next RC).

[nacin]

​http://core.trac.wordpress.org/ticket/16100#comment:15

[hakre]

Replying to nacin:

​http://core.trac.wordpress.org/ticket/16100#comment:15

Thanks for solving the issue.

[hakre]

Oh wait, I think you're not an Automattic employee. My fault!

Please provide a new statement, the old one was given prior the new violation.

[nacin]

It's GPLv2 or later. Enough already. The "new violation" was the same release of Akismet. Additionally, Akismet 2.5.3 was just released with a proper license fix.

[hakre]

Replying to nacin:

It's GPLv2 or later.

The file in the package states it's GPL v2, so technically a user does not the information you (and I) have.

The "new violation" was the same release of Akismet.

This is not about the Akismet release, but about the Wordpress release. The new Package again contains the conflicting file.

Additionally, Akismet 2.5.3 was just released with a proper license fix.

That's great and hopefully we see an update of the svn external property because that would fix this.

[hakre]

[17426], [17425] - Thanks Nacin!

[hakre]

Related: #16838