linux-kernel - Re: [GIT PULL] Documentation: Add a file explaining the requested Linux kernel license enforcement policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAN3U_kVTaRRW3kkSBb8Ko8NQwgkQGv3_BgfWXq1mw_1R1h4_Uw@mail.gmail.com>
Date:   Thu, 19 Oct 2017 18:28:12 +0300
From:   Pavel Nikulin <nikulinpi@...il.com>
To:     unlisted-recipients:; (no To-header on input)
Cc:     gregkh@...uxfoundation.org, linux-kernel@...r.kernel.org
Subject: Re: [GIT PULL] Documentation: Add a file explaining the requested
 Linux kernel license enforcement policy

Hold!

Greg, are you trying to put a new addendum to the terms of GPL v2?
I read the FAQ you posted, having you writing in that FAQ that this is
not a change to license terms is not enough. Modification of GPL V2
terms are explicitly disallowed. IF you want to put such writing into
kernel, a very explicit statement that aforementioned is nothing but a
personal promise of you and ONLY people whom put their names
there should be included. Like in a bold bold upper case text.

1. First

>Notwithstanding the termination provisions of the GPL-2.0 ... ... ...

Well, how we put it. That has no power over whether expedited
injunction will be issued if the license formally stays V2

The text of a license is the binding contract. 1. You can't put a
provision with a binding force to a contract retroactively. 2. This
has to be a change the formal enforcement provisions of the license,
no way other than that. They are not orthogonal to terms of GPL like
the developer certificate of origin.

2. Seconds

> then your license
+ from a PARTICULAR copyright holder is reinstated (a) provisionally,
+ unless and until the copyright holder explicitly and finally
+ terminates your license,

This effectively leaves things as they already are

>(b) permanently, if the copyright holder
+ fails to notify you of the violation by some reasonable means prior to
+ 60 days after the cessation.

That's reasonable to say, but the codes of different countries have
own opinions over temporal reach of contract power. Say, a router
ships with a GPL incompliant firmware, an incompliance is found and
fixed, yet somebody 100% can sue for an incompliance in the past,
unless this phrase will be a part of binding terms of the contract.

3.

Copyright owners of kernel code have full right to seek compliance in
courts, individually for the part of code they wrote in any way they
wish, period. That includes asking courts for injunctions that may
have ruinous consequences. Having an expedited injunction provisions
on the table compels companies to get into compliance like nothing
else. This makes a difference whether an enforcement action has any
actual force or not.

Permanent incompliance leads to permanent license revocation under GPL
v2, unlike GPL v3.

When Linus took a specific commitment to keep Linux under V2 for
practical impossibility of changing the license for such a large
project, that was discussed over and over. People who contribute to
Linux kernel do so knowing that their copyright can be enforced under
that specific term. That is true for contributions that were made long
before the discussion over enforcement terms was a thing.