I welcome this discussion. Thanks for your additional thoughts. Yes, I meant that I think we are complying not only with our license, but also with licenses of our third party libraries. About opening a support request for reviewing our license policies, I think that is a good idea. I have reviewed at the third party source code and license situation at Open Sound World, Pure Data, SuperCollider, CLAM, and CSL, which are some of the major open source audio software projects comparable in some sense with Csound in scope: Open Sound World includes at least some third party sources in its source tarball. Pure Data imports tarballs for third party libraries, tagged, into its own subversion repository. I wonder if it is possible to automate this. If so, that might make it easier to implement your suggestion. I wonder also if it is possible to use CVS or Subversion to import another CVS or subversion repository directly. SuperCollider provides libsndfile sources. I do not know if SuperCollider has additional third party dependencies. CLAM provides only instructions for obtaining and building third party libraries. CSL provides a gigantic tarball with sources and binaries of third party libraries. So, I have to grant that many other large open source audio projects often provide sources and sometimes binaries for third party libraries, but not all. That is why I now think it is a good idea to ask for a review of our license situation. If we do begin supplying sources, then I think that we should try to include the third party libraries into our build system, and that we should not support using third party libraries outside of our own versioned sources. This would at least put a cap on the additional complexity. But I would still prefer to avoid this, so let's wait until we find out what SourceForge has to say. Regards, Mike On Mon, Jan 5, 2009 at 2:08 PM, Anthony Kozar wrote: > Thanks, Michael, for sharing your thoughts. I think it is important that we > all try to come to a consensus about what is required of us by the licenses > of the software that we are distributing. As is probably obvious, I > currently have concerns that we are not meeting our obligations and these > concerns are delaying my completion of the release packages for 5.10. > > I would like to open a Sourceforge Support Request to have them review our > situation and make recommendations concerning what is necessary to comply > with the third-party licenses. Would that be alright? > > More comments below if you enjoy the nitty-gritty details ... > > Anthony > > > Michael Gogins wrote on 1/4/09 10:35 AM: > >> I think these recommendations for license compliance go far beyond >> what is legally and morally required, > > I disagree. I have spent many hours (days really) over the past few years > reading these licenses and various commentaries about them on the net (such > as the FSF's GPL/LGPL FAQ page) and I think we are probably not yet in full > compliance with some of them. > >> go far beyond what other recognized open source projects provide, > > I think this varies a lot. There are many Linux distros that are a very > conscientious about providing matching source code packages for every binary > package that they distribute. But I have seen projects too, even on > Sourceforge, where source code is not made available when I think that it > should be. (e.g. The JackOSX project on SF appears not to make any source > code releases). Surely, since the practices of others are inconsistent, we > cannot rely on those examples to know what our obligations are. > >> would impose an unnecessary burden on Csound developers, > > I am concerned about this too because of the large number of dependencies of > a "full" Csound distribution. For this reason I am willing to take on the > burdens of uploading third-party source packages if that becomes necessary > and documenting which packages correspond to which versions of Csound. This > will of course require the cooperation of the rest of the team: keeping me > informed of which versions of third-party libraries that each of you are > using so that I can download and re-upload them and providing me with any > modifications that you make to sources or build scripts (which will > hopefully be minimal or zilch). > >> and definitely should not be adopted. >> >> The clear intention of the license is to enable a user of our binaries >> to obtain sources from the same location and recompile or modify those >> binaries. That is currently quite possible, and people have done >> exactly that in the past. > > When you say "the license", I am not sure whether you are thinking of only > Csound's license or of the dependencies' licenses as well. I don't think > that Csound's license requires us to make source code for dependencies > available if they are dynamically linked. However, I hope that it is clear > that the issue here is not compliance with Csound's license but with the > licenses of those third-party libraries that we are distributing with the > Mac OS X and (I assume) Windows Csound packages. Also, it is unclear to me > whether or not Sourceforge's "Source Code Availability" policy applies to > third-party binaries that we include for the convenience of our users. > >> I am sure that most open source or free software people recognize >> SourceForge as "one location". I think reading "the same place" as >> "the same server" is excessively legalistic. > > Regarding all of SF as "the same place" is fine with me and I will gladly > accept confirmation from SF that we need do nothing or that we need merely > link to other projects on SF in order to satisfy their license requirements. > But what about the libraries that are not on Sourceforge (particularly the > LGPL ones such as libsndfile, fluidsynth, gettext, etc.)? > > Regarding the interpretation of the phrase "offering equivalent access to > copy the source code from the same place" in the LGPL, the Free Software > Foundation previously had this FAQ answer on their website (it refers to the > last paragraph of section 3 of the GPL v2 which contains the same wording as > section 4 of version 2.1 of the LGPL): > > aq.html#SourceAndBinaryOnDifferentSites> > > The FSF appears to have reconsidered this for (L)GPL v3 but several of > Csound's dependencies are currently under LGPL v2 or v2.1. See this URL for > the v3 interpretation: > > > >> My evidence for this is that nobody complains about it >> with other projects. I've done enough looking through various forums >> and news groups to resolve other issues, that I would have run into >> such complaints if they were at all common. > > I generally refrain from complaining about the laxness of other people's > projects because it is time-consuming and "not my place." But as a > contributor to Csound -- particularly as someone who helps builds packages > for distribution -- I feel a need to be more conscientious. > >> It is true that there could be slight differences in sources, and some >> debugging or adjustment might be required to get a working build. But >> I am certain this does not violate the terms of the license. > > LGPL v2.x says that the "corresponding source code" must be made available. > See this FAQ item: > > > >> I am completely committed to the open source nature of Csound, and to >> obeying all legal and moral requirements of the license. I was one of >> those who lobbied for the LGPL license for Csound, and I agreed with >> and implemented the decision to remove VST sources and binaries from >> SourceForge. But I think these suggestions about archiving sources for >> third party libraries are unreasonable and unneccesary. > > I know that you are committed to Csound and keeping it open source and I > respect and appreciate your contributions and your willingness to remove the > VST materials. I am committed to the open source philosophy in my > development work too and I am trying to ensure that we are meeting all of > our obligations to the third-party developers who have indirectly made the > modern Csound system possible. They deserve recognition and credit for > their work and I think that we may be neglecting to even mention that we are > using some of their libraries in the documentation of our Csound > distributions. By fully complying with each of the licenses, I think we > will achieve all of these goals. > >> Csound has become a rather complex project. Keeping it usable and >> making it possible to continue developing it require eliminating >> unnecessary complications -- so that desirable complications will >> remain possible. > > I agree -- Csound is complex and we must keep it usable! I do not want OS X > users to have to find and install libraries from other sites merely to be > able to run Csound. I hope that we can keep the burden on us as developers > to a minimum. > > Best regards, > > Anthony Kozar > mailing-lists-1001 AT anthonykozar DOT net > http://anthonykozar.net/ > > > ------------------------------------------------------------------------------ > _______________________________________________ > Csound-devel mailing list > Csound-devel@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/csound-devel > -- Michael Gogins Irreducible Productions Michael dot Gogins at gmail dot com ------------------------------------------------------------------------------ _______________________________________________ Csound-devel mailing list Csound-devel@lists.sourceforge.net