Re: Apache license usage (was Re: [PULL 04/15] hw/usb: Add CanoKey Implementation)

[MkfsSion]

On Sun, Apr 30, 2023 at 09:26:50PM +0800, Hongren (Zenithal) Zheng wrote:
> On Thu, Apr 27, 2023 at 11:11:42AM +0100, Daniel P. Berrangé wrote:
> > On Tue, Jun 14, 2022 at 02:15:59PM +0200, Gerd Hoffmann wrote:
> > > From: "Hongren (Zenithal) Zheng" <i@zenithal.me>
> > > 
> > > This commit added a new emulated device called CanoKey to QEMU.
> > > 
> > > CanoKey implements platform independent features in canokey-core
> > > https://github.com/canokeys/canokey-core, and leaves the USB 
> > > implementation
> > > to the platform.
> > > 
> > > In this commit the USB part was implemented in QEMU using QEMU's USB APIs,
> > > therefore the emulated CanoKey can communicate with the guest OS using 
> > > USB.
> > > 
> > > Signed-off-by: Hongren (Zenithal) Zheng <i@zenithal.me>
> > > Message-Id: <YoY6Mgph6f6Hc/zI@Sun>
> > > Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> > > ---
> > >  hw/usb/canokey.h |  69 +++++++++++
> > >  hw/usb/canokey.c | 300 +++++++++++++++++++++++++++++++++++++++++++++++
> > >  2 files changed, 369 insertions(+)
> > >  create mode 100644 hw/usb/canokey.h
> > >  create mode 100644 hw/usb/canokey.c
> > > 
> > > diff --git a/hw/usb/canokey.h b/hw/usb/canokey.h
> > > new file mode 100644
> > > index 000000000000..24cf30420346
> > > --- /dev/null
> > > +++ b/hw/usb/canokey.h
> > > @@ -0,0 +1,69 @@
> > > +/*
> > > + * CanoKey QEMU device header.
> > > + *
> > > + * Copyright (c) 2021-2022 Canokeys.org <contact@canokeys.org>
> > > + * Written by Hongren (Zenithal) Zheng <i@zenithal.me>
> > > + *
> > > + * This code is licensed under the Apache-2.0.
> > > + */
> > 
> > > diff --git a/hw/usb/canokey.c b/hw/usb/canokey.c
> > > new file mode 100644
> > > index 000000000000..6cb8b7cdb089
> > > --- /dev/null
> > > +++ b/hw/usb/canokey.c
> > > @@ -0,0 +1,300 @@
> > > +/*
> > > + * CanoKey QEMU device implementation.
> > > + *
> > > + * Copyright (c) 2021-2022 Canokeys.org <contact@canokeys.org>
> > > + * Written by Hongren (Zenithal) Zheng <i@zenithal.me>
> > > + *
> > > + * This code is licensed under the Apache-2.0.
> > > + */
> > 
> > In the process of auditing licensing in QEMU I found this patch
> > adding code that is Apache-2.0 licensed, and as such I don't
> > think we should have ever merged the patch as is.
> > 
> > QEMU as a combined work is GPLv2-only.
> > 
> > There is disagreement between the Apache foundation and FSF on this
> > topic[1], but FSF considered Apache 2.0 to be incompatible with the
> > GPL-v2. Fedora licensing follows the same view of Apache being GPLv2
> > incompatible.
> > 
> > More generally I think it is a little dubious to write new devices
> > while claiming a license that's different from normal QEMU code
> > license. I expect there is inevitably a degree of cut+paste from
> > existing QEMU code to handle the device boilerplate code which
> > would be sufficient to expect a GPLv2-or-later license to apply.
> > 
> > The two added files in this commit are the only occurrence of
> > Apache licensing in QEMU that I see.
> > 
> > Hongren, IIUC from the attribution above, you wrote the code but
> > Canokeys.org claims copyright. Could you report whether Canokeys.org
> > will agree to change the licensing on these files to QEMU's normal
> > GPLv2-or-later licensing.
> 
> I have discussed it internally with canokeys.org and they agreed
> to re-license it under GPLv2+
> 
> I will send a patch modifying the license.
> 
> In the meantime, canokey.c was also modified by
> MkfsSion <mkfssion@mkfssion.com>
> 
> I've Cc'ed MkfsSion for their attitude on this.
Acked-by: YuanYang Meng <mkfssion@mkfssion.com>
> 
> > 
> > With regards,
> > Daniel
> > 
> > [1] https://www.apache.org/licenses/GPL-compatibility.html
> > -- 
> > |: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange 
> > :|
> > |: https://libvirt.org         -o-            https://fstop138.berrange.com 
> > :|
> > |: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange 
> > :|
> >