Re: What GPL requirements are implied by publishing an ISO. Re: Grub-devel Digest, Vol 163, Issue 9

[Tom Davies]

Hi :) 

This might not be the best place to ask about legal issues for edge-case scenarios.  People here can try to help from their own experiences but we are not "the horse's mouth" in regards to the licence and legal issues.  

Perhaps this;  

https://www.gnu.org/licenses/gpl-faq.html#SourceAndBinaryOnDifferentSites

In short, they seem to say yes but I'm not clear if that really was what you were asking.  

Maybe Section 6, the 1st paragraph and then perhaps it's sub-'section' b2 might be of interest?  

https://www.gnu.org/licenses/gpl-3.0.en.html

6.  You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:

  b)  (2) access to copy the Corresponding Source from a network server at no charge.

Note that the licence is not intended to make things difficult!  If it seems tricky then there is probably a misunderstanding about what it requires.  This guide is meant to help; 

https://www.gnu.org/licenses/gpl-howto.html

But then people have tried to make that easier to understand and some things may have become a bit garbled in the process.  

Also if you have trouble fully complying with every tiny part of it then the chances are that someone else has had a similar problem.  The "Free Software Foundation" and gnu.org attempt to cover most of the commonest problems in their FAQ; 

https://www.gnu.org/licenses/gpl-faq.html

There are satellites in space, components and the command&control systems on the International Space Station and marker buoys in rough seas that run on GPL'd software/firmware - such things don't have a lot of space for duplicates that they can't use easily!  

You may need to ask the FSF at Gnu.org about your specific case though, or just to get clarification.  

Regards from 

a Tom :)  

On 11 Sep 2017 17:00, <address@hidden> wrote:

Send Grub-devel mailing list submissions to
        address@hidden

To subscribe or unsubscribe via the World Wide Web, visit
        https://lists.gnu.org/mailman/listinfo/grub-devel
or, via email, send a message with subject or body 'help' to
        address@hidden

You can reach the person managing the list at
        address@hidden

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Grub-devel digest..."

Today's Topics:

   1. What GPL requirements are implied by publishing an ISO with
      GRUB      binaries ? (Thomas Schmitt)
   2. Re: What GPL requirements are implied by publishing an ISO
      with GRUB binaries ? (SevenBits Tech)
   3. Re: What GPL requirements are implied by publishing an ISO
      with GRUB binaries ? (Thomas Schmitt)


---------- Forwarded message ----------
From: Thomas Schmitt <address@hidden>
To: address@hidden
Cc: 
Bcc: 
Date: Sun, 10 Sep 2017 21:01:05 +0200
Subject: What GPL requirements are implied by publishing an ISO with GRUB binaries ?
Hi,

i read on
  http://wiki.osdev.org/Bare_Bones#Building_a_bootable_cdrom_image
a cumbersome interpretation of GRUB's GPL for the case of publishing an ISO
with GRUB boot equipment. (See quote below.)

Is it really necessary to keep and publish the source package of the
binary distro package if the ISO contains such distro binaries ?
Is it really necessary to make and publish a GRUB release if binaries
stem from source versions from git repo ?

Is there no easier way to comply to GPL by giving a sufficient id string
of the used GRUB version ?
(Can GRUB binaries inside the ISO tell their exact git version ?
 Would the GRUB project consider GPLv3 fulfilled for an unmodified version
 from git by just pointing to the newest (thus better) git version ?)

If a publisher of grub-mkrescue made ISOs needs to actively fulfill GPL
demands, then this should be mentioned well visibly in
  https://www.gnu.org/software/grub/manual/grub/html_node/Making-a-GRUB-bootable-CD_002dROM.html#Making-a-GRUB-bootable-CD_002dROM


Quote from wiki.osdev.org
------------------------------------------------------------------
Warning:
[...]
The GPL requires you publish the source code corresponding to the bootloader.

You need to get the exact source package corresponding to the GRUB package
you have installed from your distribution, at the time grub-mkrescue is
invoked (as distro packages are occasionally updated). You then need to
publish that source code along with your ISO to satisfy the GPL.

Alternative, you can build GRUB from source code yourself. Clone the latest
GRUB git from savannah (do not use their last release from 2012, it's
severely out of date). Run autogen.sh, ./configure and make dist. [...]
ensure its grub-mkrescue program is used to produce your iso. Then publish
the GRUB tarball of your own making [...].
------------------------------------------------------------------
End of quote.

In general i'd be interested in correction proposals. Some statements
are obviously outdated or wrong, like the one about the youngest release.
Something more future-proof should be stated instead.


Have a nice day :)

Thomas





---------- Forwarded message ----------
From: SevenBits Tech <address@hidden>
To: The development of GNU GRUB <address@hidden>
Cc: 
Bcc: 
Date: Sun, 10 Sep 2017 20:02:49 -0400
Subject: Re: What GPL requirements are implied by publishing an ISO with GRUB binaries ?
While I don't have specific quotes from the GPL to share in regards to this situation, it is my understanding that, yes, you are required to provide the source code used to build the compiled binary. This is because every person who receives the software has the right to the source used to build it.

I believe there is an exception for commonly used libraries and tools needed to build the code (e.g., if GCC is needed to build the code, you do not need to include the source to GCC as it is a common package). However, this most assuredly does not apply in this circumstance.

Where are you distributing your ISO? Perhaps you could just put the code on a public FTP site, and include its link in the Readme. Or, I believe you could charge a small fee to mail the software to the user on a disc, but no more than is absolutely necessary to comply with the source distribution requirement.

Hope this helps.

> On Sep 10, 2017, at 3:01 PM, Thomas Schmitt <address@hidden> wrote:
>
> Hi,
>
> i read on
>  http://wiki.osdev.org/Bare_Bones#Building_a_bootable_cdrom_image
> a cumbersome interpretation of GRUB's GPL for the case of publishing an ISO
> with GRUB boot equipment. (See quote below.)
>
> Is it really necessary to keep and publish the source package of the
> binary distro package if the ISO contains such distro binaries ?
> Is it really necessary to make and publish a GRUB release if binaries
> stem from source versions from git repo ?
>
> Is there no easier way to comply to GPL by giving a sufficient id string
> of the used GRUB version ?
> (Can GRUB binaries inside the ISO tell their exact git version ?
> Would the GRUB project consider GPLv3 fulfilled for an unmodified version
> from git by just pointing to the newest (thus better) git version ?)
>
> If a publisher of grub-mkrescue made ISOs needs to actively fulfill GPL
> demands, then this should be mentioned well visibly in
>  https://www.gnu.org/software/grub/manual/grub/html_node/Making-a-GRUB-bootable-CD_002dROM.html#Making-a-GRUB-bootable-CD_002dROM
>
>
> Quote from wiki.osdev.org
> ------------------------------------------------------------------
> Warning:
> [...]
> The GPL requires you publish the source code corresponding to the bootloader.
>
> You need to get the exact source package corresponding to the GRUB package
> you have installed from your distribution, at the time grub-mkrescue is
> invoked (as distro packages are occasionally updated). You then need to
> publish that source code along with your ISO to satisfy the GPL.
>
> Alternative, you can build GRUB from source code yourself. Clone the latest
> GRUB git from savannah (do not use their last release from 2012, it's
> severely out of date). Run autogen.sh, ./configure and make dist. [...]
> ensure its grub-mkrescue program is used to produce your iso. Then publish
> the GRUB tarball of your own making [...].
> ------------------------------------------------------------------
> End of quote.
>
> In general i'd be interested in correction proposals. Some statements
> are obviously outdated or wrong, like the one about the youngest release.
> Something more future-proof should be stated instead.
>
>
> Have a nice day :)
>
> Thomas
>
>
> _______________________________________________
> Grub-devel mailing list
> address@hidden
> https://lists.gnu.org/mailman/listinfo/grub-devel





---------- Forwarded message ----------
From: Thomas Schmitt <address@hidden>
To: address@hidden
Cc: 
Bcc: 
Date: Mon, 11 Sep 2017 09:43:31 +0200
Subject: Re: What GPL requirements are implied by publishing an ISO with GRUB binaries ?
Hi,

SevenBits Tech wrote:
> it is my understanding that, yes, you are required to provide the
> source code used to build the compiled binary.

Agreed. But normally it suffices to point to the place from where one
got the published sources of the free software which one forwards.
E.g. with xorriso releases, you can point to https://ftp.gnu.org/gnu/xorriso/
and propose to use the tarball with the matching version number.

The point of OSDev.org wiki is that GRUB is/was around in many versions
which are not based on a GRUB release with tarball at a reliable public URL.

In the case that GRUB stems from a binary distro package, i'd say it
suffices to tell the exact name of the package and the URL where the
GRUB packages of that distro can be found. Nevertheless, this raises
the question what to do if the distro vanishes or makes outdated versions
of their packages unavailable.
(Interesting extra question: If you cease offering the binary, how long
 are you obliged to still offer the old source ? Endlessly ?)

In the case of a git based version, one can point to
  https://savannah.gnu.org/git/?group=grub
and give instructions how to obtain the corresponding source from a
particular commit revision.

Since GRUB on ISO is likely to change hands, we have the situation that
each of the GRUB users of this case has to be aware of the obligations by
GPL, which do not apply to the use case of making the own computer bootable.

I think OSDev.org ideas are too rigid. Best would be if GRUB would help
its ISO producing users to fulfill GPL in a mostly automatic way. At least
with released GRUB versions, if it is not possible with versions pulled
from git.

A clarification on GRUB's grub-mkrescue documentation page seems necessary.


> Where are you distributing your ISO?

It is not about my use cases but about my standard advice as author of
xorriso to use grub-mkrescue when one starts with developing bootable ISOs.
In general, the GPL makes no difference between giving a copy to a friend
or making a business out of it.


Have a nice day :)

Thomas




_______________________________________________
Grub-devel mailing list
address@hidden
https://lists.gnu.org/mailman/listinfo/grub-devel