Bug#883731: audacious: Debian packaging has incorrect license

[John Lindgren]

Hi Nicholas et. al,

(tallica: This is re: Debian bug #883731, related to the GPL -> BSD
relicensing of Audacious a few years back.  Please take a look at
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883731 for background
if you're interested, otherwise disregard.)

On 12/12/2017 04:39 PM, Nicholas D Steeves wrote:
> For Debian Legal Team: With respect to the translations, I now suspect
> they can probably be transitioned to BSD without issue, because
> copyright is also assigned to the Audacious Translators.  eg, in the
> last GPL-2+ release 3.2.4:
>     Copyright (C) Audacious translators

We needed a single copyright line because of the way Transifex is set
up, but it's not meant to indicate copyright assignment.  "Audacious
translators" is not a legal entity and just refers to the individual
translators listed in each .po file, who are the copyright holders.

> John, I removed the offending patch in git for the user-visible
> license provided by the Audacious GUI.  Then I went ahead and did a
> historical relicensing review, in spite of the potential for other
> missing copyright holders due to the Transifex switch.  I am a bit
> concerned about what looks to be a politic of "silence is consent" wrt
> relicensing, and hope that I am wrong, or that I was sloppy in my
> review.  Was the discussing conducted informally off the record?

We took a bit more care with the source code relicensing than with the
translations.  I personally went through Git commit logs and replaced
copyrights of "XMMS team", "BMP team", or "Audacious team" (again, none
of which were legal entities) and replaced them with the names of the
actual contributors.

In many cases, files still credited to "the XMMS team" or "the BMP team"
had been totally rewritten and none of the original code that was under
the XMMS/BMP copyright remained.  Actually, as of today, no original
XMMS code remains in Audacious core (i.e. the "audacious" package) at
all.  The largest body of remaining XMMS code is in the "skins" plugin,
which is still GPL for that very reason.

For the core of Audacious, the remaining copyright holders all gave
consent to relicense their code as BSD, generally by email or via the
IRC channel we had back then.  I don't have any of the emails or IRC
logs saved (sorry) but the date of each of the separate Git commits you
listed reflects the point at which we received permission from the
copyright holders listed in those files.

> Would you please take a look at the following (Ian's reply) for an
> example of how to provide a record of all copyright holder's consent?
> tldr; documented confirmation (eg: via copies of emails or a download
> of a bug report/issue/forum thread) for all contributors who did not
> assign copyright to the Audacious Team in the headers of the files
> they contributed to.

Unfortunately, such documentation doesn't exist, to my knowledge.  I'll
point out any specific information I recall about the commits you mentioned.

> 42cbe57307962e65acc2db24dbe99249453c6aac
The equalizer code was a port from mplayer.  The author, Anders
Johansson, was contacted and gave consent for the relicense, and
incidentally also asked that we retain some of his coding style (see the
previous commit to equalizer.c).

> b308c892f47a55c63ef2675f9b6cf016be037f4c
The session management code was later removed from Audacious, which is
why Ivan and David aren't listed in AUTHORS any longer.

> 31ea4ad1adb84f37ce8fff5b4868df247bd6d913
Michal Lipski (tallica, CC'd) did the footwork in tracking down the
authors of those files, and "where possible" in the commit message
refers to developers who gave consent.  Most of the developers listed in
those files were still around on IRC at the time.

> df1165d2fdd8470b2fd45d2e87cac5373055b55e
"desowin ok'd it" -- desowin is the Tomasz Moń listed in those files.
The rest of us were present on IRC, I think.

> 9a979a5af95eb663435ef99d3b7b5c79b94855be
Jussi Judin was not a core developer at the time; I assume tallica
contacted him.

> 33b58d4d8ba18fcbcc36af5c650414e173e22396
>   * Do you have consent on file to move to BSD license for all
>     contributors to XMMS and BMP?

I don't recall the particular IRC discussion referenced in the commit
message, but presumably it was determined that no XMMS/BMP code remained
in those files.

> bc295976816358f9512f99a78e933e6594cce121
The commit message itself lists the copyright holders who gave consent.
Most of those folks were around on IRC and so I would assume that was
how they were contacted.

> 853f96f54bbca608f0c95b5e8bf3fd2146607bdd
Similar, except that (from what I remember) Paula developed that code
under Tony Vroon (Chainsaw)'s mentorship, and he would have vouched for
her consent.

> 3d2ca792a02973fb5e2f33d6273aac825d4f3a55
Here I was reattributing some files to their actual authors based on Git
logs, as I said earlier.  You can see that in this commit, I left the
GPL notice intact on any files whose authors hadn't given consent yet at
that point (but did later on).

> a0655119b4e2b54c7879bd3dccdbc244ba07c318
>   * Do you have consent on file to move to BSD license for all
>     contributors to XMMS and BMP?

I assume you refer to audstrings.[c,h]?  None of the remaining code in
those two files is from XMMS/BMP.  95% of it I wrote myself; some small
bits are probably still William Pitcock (nenolod)'s.

> One can infer William Pitcock's consent to switch to BSD licensing
> here, especially because he authored and commited other patches to
> switch his code to BSD license, so I've omitted commits from others
> that affected files where he alone was/is the copyright holder:
> 419176b6a4876daaca55a95b60ce51b786534961

Hold on ... that's a different beast altogether.  That commit is from
2007, which was before I was involved in the project.  nenolod was the
project lead at that time.  Anyway, the commit isn't directly related to
the 2012 relicensing but appears to be reverting a prior effort that
failed due to a lack of consent from some (unnamed) developers at that
time.  Note that a number of the files listed were later moved to
audacious-plugins, and remain GPL to this day.

> 320ffbb1a063c69f769683b0afc2726a3c87c89f
> 788fb88b010f1267c8de9b3f5e4216605064eac8
> b58af7e570f893be4585cc924435a947146b3b04
> 63a743a785c79013c7a47fcd94a79ca14cac7688
> aff7adac8e8f5e2143cd2654edeadfb37f033a43
> 1d699bdbde6151db05ccd83c8c857bd33e6660bb
> 0284a462e096a6d98233681e6c94cd3256bb7445

These are all from 2007 as well, and are presumably the commits reverted
by 419176b6a487.  (The project remained GPL for another 5 years after.)

> List of GPL-2+ copyright holders from last stable GPL release (3.2.4):
> https://github.com/audacious-media-player/audacious/blob/audacious-3.2.4/AUTHORS

I assume you also noticed the disclaimer right at the top, "This file is
quite out of date"?  The vast majority of the code written by the people
listed in that file has been removed, replaced, or moved to
audacious-plugins.  That was true back in 2012, but even more so in 2017.

> It's a PITA, and a lot of work, but I believe that it's necessary for
> Debian to confirm the successful relicensing of Audacious from GPL-2+
> to BSD 2-clause.  I brought in debial-legal as early as possible so
> that they could step in and shout "wait a second, that's pedantic busy
> work!" if ever that was the case.

Personally, I can't invest very much time supporting the effort (sorry).
 Hopefully you can consider at least the C code in Audacious core all
set, given the history I gave you above.  The translations are likely to
be more of a problem.  Depending on how pedantic you decide to be, I
suppose the documentation effort could involve going through all the
translations and contacting any pre-2012 authors to confirm their
permission (or alternatively removing and retranslating any pre-2012
strings, if they were a small enough fraction).

Especially considering that audacious-plugins is still a mixed BSD/GPL
package anyway, an alternative would be to add a clause to the COPYING
file to the effect of, "some bits are/may be GPL still".  I don't think
I will do this upstream; my approach would more likely be to remove or
replace any offending bits as needed if/when someone complains.
However, I can understand if Debian were to consider my approach too
"casual" and wanted to take the more conservative approach of "we're
still distributing Audacious as GPL until proven otherwise".  As someone
already pointed out, that's compatible with the upstream BSD license
*provided that* the upstream license is still included in full.

Best regards,
John