• gnome-screensaver copyright issues

    From Dennis Filder@21:1/5 to All on Sat Jan 23 10:30:01 2021
    Hi,


    I recently filed #980212 against gnome-screensaver because it appears
    that one if its original developers copied and relicensed MIT-licensed
    code (from xscreensaver) as GPL-2 even though he lacked the copyright
    to it. The packages cinnamon-screensaver and mint-screensaver would
    apparently be likewise affected as they are forks of
    gnome-screensaver.

    I'm posting here in hope of answers to these questions:

    1. Should this be escalated? And if yes: to what severity? I filed
    it as a normal bug just to be safe, but I think it's at least serious.
    (Note that #974011 for package xmille was due to similar issues, and
    it was serious)

    2. If it's RC: Is it waivable in principle, or would these packages
    effectively be rendered entirely undistributable by this?

    3. Who should be the one taking this on? I'm just the messenger here
    and the package maintainer team so far hasn't spoken up yet. If it is
    an RC bug, however, then the release team should ultimately take care
    of this once it shows up in the list of RC bugs, no?

    4. Should separate bug reports be filed against cinnamon-screensaver
    and mint-screensaver? I guess the person taking care of this could
    decide that themselves, so I won't file them myself unless I get told
    to.


    Thanks in advance.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Bastian Blank@21:1/5 to Dennis Filder on Sat Jan 23 11:40:01 2021
    Hi Dennis

    On Sat, Jan 23, 2021 at 10:26:33AM +0100, Dennis Filder wrote:
    I recently filed #980212 against gnome-screensaver

    Are you a copyright holder of any of the code?

    Also I looked at the alleged code segment. Yes, the comments are the
    same and the code shows some resemblance, but you have not checked the ancestry, where does it come from, and esp from whom.

    because it appears
    that one if its original developers copied and relicensed MIT-licensed
    code (from xscreensaver) as GPL-2 even though he lacked the copyright
    to it.

    The MIT and GPL licenses are compatible, in a way that you can always
    add GPL-2 code to MIT code and the combined result will be GPL-2. This
    is what the gnome-screensaver author did, copyied some MIT code, which
    he is allowed to, and added GPL-2 code with his own copyright. There is
    no relicensing of the existing code, which remains MIT to this date,
    just the statement that the combined code is GPL-2.

    He also does not need to hold any copyright to the original code, just
    to retain the copyright notices, which might be lacking in this case.

    If it needs to ship the original license statement is up to debate,
    because the GPL-2 includes a superset of the terms, it requires
    everything the MIT license requires, but in different words.

    1. Should this be escalated? And if yes: to what severity?

    No, esp if you can't show any own copyright on the work in question.

    Bastian

    --
    The man on tops walks a lonely street; the "chain" of command is often a noose.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Dennis Filder@21:1/5 to Bastian Blank on Sat Jan 23 13:50:01 2021
    On Sat, Jan 23, 2021 at 11:15:01AM +0100, Bastian Blank wrote:
    Are you a copyright holder of any of the code?

    No, that would be Jamie Zawinski, the author of XScreenSaver.

    Also I looked at the alleged code segment. Yes, the comments are the
    same and the code shows some resemblance, but you have not checked the ancestry, where does it come from, and esp from whom.

    It comes from XScreenSaver, thus Jamie Zawinski, probably one of the
    versions released in 2005, not 2006 as I errnoeously stated in the bug
    report. The initial checkin[1] makes it quite obvious that large
    swaths of XScreenSaver code were copied into gnome-screensaver.
    Almost every *.[ch] file whose name does not start start with "gs-"
    seems to have come from XScreenSaver.

    I wanted to pinpoint the exact revision of where this was copied from,
    but apparently there is no public git repo of XScreenSaver, so that
    complicates matters. Also, from his response on Twitter[2] Jon McCann
    does not appear to dispute that he copied this code. He also seems to
    have copied in code from more than one revision.

    For example, the current revision of
    gnome-screensaver/src/gs-fade.c[3] lacks the Zawinski notice, but was
    clearly derived from src/fade.c[4] which still had it when it was
    copied in in September 2005 before it was renamed/deleted. Comparing
    with latest xscreensaver-5.45/utils/fade.c (which shows a great many
    verbatim commonalities) tells us that a predecessor version of it was
    clearly what McCann copied.

    The MIT and GPL licenses are compatible, in a way that you can always
    add GPL-2 code to MIT code and the combined result will be GPL-2. This
    is what the gnome-screensaver author did, copyied some MIT code, which
    he is allowed to, and added GPL-2 code with his own copyright. There is
    no relicensing of the existing code, which remains MIT to this date,
    just the statement that the combined code is GPL-2.

    He also does not need to hold any copyright to the original code, just
    to retain the copyright notices, which might be lacking in this case.

    That would be very good news as long as they actually do get added
    back in. As I understand it redistributability pretty much hinges on
    /all/ these copyright notices being in the actual release in their
    original form, and they currently aren't in at least one case (and
    maybe more). This is the source of my concern, and why I feel that
    this might be in violation Policy 4.5.

    Also fixing that will be no easy feat since someone has to actually go
    through essentially the entire sources of all these 4 packages and
    match up copyright notices to patch them back in.

    If it needs to ship the original license statement is up to debate,
    because the GPL-2 includes a superset of the terms, it requires
    everything the MIT license requires, but in different words.

    Okay, then it's just about fixing the missing copyright notices.

    No, esp if you can't show any own copyright on the work in question.

    Thanks a lot, that was very helpful and illuminating. I will leave
    the bug open for now so that it can be closed when the question of the
    missing copyright notices has been answered/fixed.

    Regards,
    Dennis.

    1: https://gitlab.gnome.org/Archive/gnome-screensaver/-/commit/3270cf30f07ad685d7a38216fd13e735d575072d
    2: https://twitter.com/jonmccann/status/1345237884283088897
    3: https://gitlab.gnome.org/Archive/gnome-screensaver/-/blob/master/src/gs-fade.c
    4: https://gitlab.gnome.org/Archive/gnome-screensaver/-/blob/43cc5929a443e84f4d3bec1cd692e3f4e3cb1c58/src/fade.c

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)