PHP license...

[Pierre Habouzit]

Hi, I'm packaging a PHP C extension, that was licensed under the LGPL,
but is now under the PHP license.

it was unofficial, but is now listed on PECL[1] and the lead developper
has an @php.net address, and is member of the PHP Group. That makes the
product a product of the PHP Group.

I've read the thread about PHP license 3.01 in february, and had the
impression that the consensus was that that license is acceptable for
things that come from the PHP Group. is that still the case, can I
upload the new version ?


thanks in advance.

[1] http://pecl.php.net/package/json


Please Cc: me on debian-legal, I'm not subscribed.

[Francesco Poli]

Post by Pierre Habouzit
Hi, I'm packaging a PHP C extension, that was licensed under the LGPL,
but is now under the PHP license.
it was unofficial, but is now listed on PECL[1] and the lead
That makes the product a product of the PHP Group.

Probably.

Post by Pierre Habouzit
I've read the thread about PHP license 3.01 in february, and had the
impression that the consensus was that that license is acceptable for
things that come from the PHP Group. is that still the case, can I
upload the new version ?

As you may have read in the thread you're referring to (I don't know
which of them, as there are quite several), I don't agree.
I believe that PHP license version 3.01 does not comply
with the DFSG, even when applied to PHP itself or to PHP Group software.
The problematic clause is #4.

Moreover, when the license is applied to anything else (that is to say,
software not provided by the PHP Group), a bunch of additional issues
appear.

Unfortunately, it seems that really few people here are able to see what
I perceive as a clear non-freeness.
Moreover the result of the discussions seems to be that several bugs
were *closed*, while the license is still unfixed... :-(((

Please, see

http://lists.debian.org/debian-legal/2005/10/msg00124.html
http://lists.debian.org/debian-legal/2005/10/msg00127.html
http://lists.debian.org/debian-legal/2006/01/msg00056.html
http://lists.debian.org/debian-legal/2006/01/msg00066.html
http://lists.debian.org/debian-legal/2006/01/msg00339.html
http://lists.debian.org/debian-legal/2006/02/msg00013.html

and the rest of the corresponding threads, for more details.

In particular, my analysis of the PHP License version 3.01 can be found
here:

http://lists.debian.org/debian-legal/2005/11/msg00271.html
http://lists.debian.org/debian-legal/2005/11/msg00272.html

I would like to explicitly (re)stress that this analysis is my opinion
only and didn't gain wide consensus on debian-legal.
Nonetheless, I didn't get a satisfactory rebuttal.
Consequently, I believe this issue is still open and undecided.

I would really *love* seeing this issue solved once and for all, since I
think that PHP is a really important piece of software and should be
made DFSG-free for the benefit of the community.


[...]

Post by Pierre Habouzit
Please Cc: me on debian-legal, I'm not subscribed.

Done.

[Pierre Habouzit]

Post by Francesco Poli

Post by Pierre Habouzit
I've read the thread about PHP license 3.01 in february, and had
the impression that the consensus was that that license is
acceptable for things that come from the PHP Group. is that still
the case, can I upload the new version ?

As you may have read in the thread you're referring to (I don't know
which of them, as there are quite several), I don't agree.
I believe that PHP license version 3.01 does not comply
with the DFSG, even when applied to PHP itself or to PHP Group
software. The problematic clause is #4.
[
]
In particular, my analysis of the PHP License version 3.01 can be
http://lists.debian.org/debian-legal/2005/11/msg00271.html
http://lists.debian.org/debian-legal/2005/11/msg00272.html

Point is, I'm not conviced at all that #4 makes php non free. It's an
irritating clause, but it does not prevent me to exercice the 4 basic
free software freedoms.

It just says that you cannot use php in the *name* of the product, as
it's a reserved token for products from the PHP group. but it
explicitely allow you to say "libFoo" is a lib that does Foo for PHP,
or to call your project "libFoo for PHP". PHP does not only refers to
an language (like python, C, Ada does) but to the specific Zend
implementation of that language.

This clause may be called clumsy, but not non-free IMHO.

Post by Francesco Poli
I would like to explicitly (re)stress that this analysis is my
opinion only and didn't gain wide consensus on debian-legal.
Nonetheless, I didn't get a satisfactory rebuttal.
Consequently, I believe this issue is still open and undecided.

well, how could we have this decided once for all ? requiring a GR on
that issue seems a bit exagerated ...

[Francesco Poli]

[...]

Post by Pierre Habouzit

Post by Francesco Poli
As you may have read in the thread you're referring to (I don't know
which of them, as there are quite several), I don't agree.
I believe that PHP license version 3.01 does not comply
with the DFSG, even when applied to PHP itself or to PHP Group
software. The problematic clause is #4.
[___]
In particular, my analysis of the PHP License version 3.01 can be
http://lists.debian.org/debian-legal/2005/11/msg00271.html
http://lists.debian.org/debian-legal/2005/11/msg00272.html

Point is, I'm not conviced at all that #4 makes php non free. It's an
irritating clause, but it does not prevent me to exercice the 4 basic
free software freedoms.

It's a nasty restriction that goes beyond what is allowed (as a
compromise!) by DFSG#4.
But I won't restate what I already explained in the mentioned threads:
please take the time to read them (if you haven't already) and then my
reasoning should be clearer to you (I hope!).

Post by Pierre Habouzit
It just says that you cannot use php in the *name* of the product, as
it's a reserved token for products from the PHP group. but it
explicitely allow you to say "libFoo" is a lib that does Foo for PHP,
or to call your project "libFoo for PHP". PHP does not only refers to
an language (like python, C, Ada does) but to the specific Zend
implementation of that language.

PHP are three letters in a row, they are not reserved in any way (as
long as they are not a trademark).
You cannot prevent (through copyright, I mean) anyone from writing an
original program and name it "PHP" or a string containing those three
letters. Only authors of derivative works are denied such a right.
So the clause doesn't seem to achieve what it was maybe meant to (that
is to say, reserve the string "PHP" for PHP Group software).

On the other hand, the clause is overly broad and prevents people from
calling a derivative work "TELEGRAPHPOLE" or "RALPHPANTHER"...

Post by Pierre Habouzit
This clause may be called clumsy, but not non-free IMHO.

Post by Francesco Poli
I would like to explicitly (re)stress that this analysis is my
opinion only and didn't gain wide consensus on debian-legal.
Nonetheless, I didn't get a satisfactory rebuttal.
Consequently, I believe this issue is still open and undecided.

well, how could we have this decided once for all ? requiring a GR on
that issue seems a bit exagerated ...

Of course a GR is not the right instrument for such an issue (please
let's not start talking about GR-2006-001 and its horrible results:
doing so would drive the discussion very far away from the current
topic...).

What I meant was: the issue didn't gain a clear consensus on
debian-legal and so it's IMHO still open.
Instead, I would have liked seeing it fixed in PHP License by the PHP
Group...

[Charles Fry]

Post by Francesco Poli
As you may have read in the thread you're referring to (I don't know
which of them, as there are quite several), I don't agree.
I believe that PHP license version 3.01 does not comply
with the DFSG, even when applied to PHP itself or to PHP Group software.
The problematic clause is #4.
Moreover, when the license is applied to anything else (that is to say,
software not provided by the PHP Group), a bunch of additional issues
appear.
Unfortunately, it seems that really few people here are able to see what
I perceive as a clear non-freeness.

As previously mentioned on the list, there are and have been other
packages in Debian with similar clauses.

Post by Francesco Poli
Moreover the result of the discussions seems to be that several bugs
were *closed*, while the license is still unfixed... :-(((

If you want to have a severe bug on this licensing issue, I invite you to
open it with PHP itself. As long as PHP is allowed to remain ininhibited
in Debian, there is no arguement for removing other PHP Group software
that uses the same license.

Charles

[Francesco Poli]

Post by Charles Fry

Post by Francesco Poli
As you may have read in the thread you're referring to (I don't know
which of them, as there are quite several), I don't agree.
I believe that PHP license version 3.01 does not comply
with the DFSG, even when applied to PHP itself or to PHP Group
software. The problematic clause is #4.
Moreover, when the license is applied to anything else (that is to
say, software not provided by the PHP Group), a bunch of additional
issues appear.
Unfortunately, it seems that really few people here are able to see
what I perceive as a clear non-freeness.

As previously mentioned on the list, there are and have been other
packages in Debian with similar clauses.

This is not an argument.

Previous errors should not be taken as a justification for their
reiteration.
Just try and imagine the following BTS interaction between a user and
the maintainer of package foo:
James R. User> there's a buffer overflow vulnerability in foo
John F. Maintainer> there are and have been other packages in Debian
with similar vulnerabilities, so that must be OK, tag wontfix

Post by Charles Fry

Post by Francesco Poli
Moreover the result of the discussions seems to be that several bugs
were *closed*, while the license is still unfixed... :-(((

If you want to have a severe bug on this licensing issue, I invite you
to open it with PHP itself.

Filing a serious bug against package php[345] is unlikely to produce
significant results, unless I can convince other debian-legal regulars
that there actually is a problem.
If I filed a bug report now, the php package maintainer would probably
come to debian-legal to check whether my claims are backed by some
consensus on the list and/or review previous discussions about the
topic: he would probably close the bug.
Consequently, I think that I must first gain consensus on the list and
*only then* file a serious bug against php[345] and hope the issue can
be fixed by upstream.

Remember that PHP License has an auto-upgrade clause, so if the PHP
Group fixes the license (with a new version, say 3.02 or 4.0) every
package that is affected by this issue would instantly become DFSG-free.
Fix once, Free everywhere!

Post by Charles Fry
As long as PHP is allowed to remain
ininhibited in Debian, there is no arguement for removing other PHP
Group software that uses the same license.

As I repeatedly stated, the issue I'm pointing out holds for both PHP
itself and other PHP Group software.
I'm not trying to claim that PHP is OK, while other PHP Group software
is not.