[aur-general] Notification of GPL violation

[Manhong Dai]

> Date: Thu, 20 May 2021 15:05:21 -0500
> From: "David C. Rankin" <drankinatty at gmail.com>
> To: aur-general at lists.archlinux.org
> Subject: Re: [aur-general] Notification of GPL violation
> Message-ID: <c2e5a266-a494-7057-e4af-cbe57964c677 at gmail.com>
> Content-Type: text/plain; charset="utf-8"
> 
> On 5/18/21 2:06 AM, Brett Cornwall via aur-general wrote:
> > On 2021-05-17 21:16, Carsten Haitzler via aur-general wrote:
> > > On Mon, 17 May 2021 13:32:26 +0000 lawl via aur-general
> > > <aur-general at lists.archlinux.org> said:
> > > 
> > > > Hello
> > > > 
> > > > I'm the developer of NoiseTorch (  
> > > > https://github.com/lawl/NoiseTorch/).
> > > > I faithfully believe that the package "noisetorch" in the
> > > > ArchLinux User
> > > > Repository ("AUR") (  
> > > > https://aur.archlinux.org/packages/noisetorch/) violates
> > > > my license (GPLv3).
> > > > 
> > > > I have the asked previous maintainer of this package to not apply
> > > > patches or
> > > > make it clear that this is a fork that's being conveyed. Several
> > > > Arch Linux
> > > > trusted users were also informed of this:
> > > > https://github.com/lawl/NoiseTorch/issues/2#issuecomment-785262068
> > > 
> > > I am just looking at the AUR repository for this right now. It has
> > > no patches.
> > > It does not modify anything from the original. It builds the
> > > original with
> > > standard go tooling and options available in that toolchain (not
> > > modifications
> > > to your software) and then packages up the resulting build. The
> > > only addition
> > > is ADDING a .desktop file to that package archive to make it easier
> > > to run the
> > > application. This does not modify the software. So by your quotes
> > > below it
> > > meets
> > > the license requirements. I don't know what was in the AUR pkg repo
> > > before but
> > > it certainly seems to be fine now.
> > 
> > For anyone else wondering what the fuss is all about, this is a long-
> > running
> > bout of drama stirred up by the developer of Noisetorch [1]. They are
> > hostile
> > and will not be reasoned with, unfortunately.
> > 
> > We are under no obligation to listen to these demands as we do not
> > distribute
> > the software and only supply a build script for which a user may
> > build their
> > own package. Kowtowing to this petulance will hardly solve the
> > problem
> > long-term as it is clear that *any* packages not made by the
> > developer are
> > treated with hostility.
> > 
> > But I guess hashworks has already extended the olive branch; We'll
> > have to see
> > whether that's enough...
> > 
> > 
> > [1]   
> > https://github.com/lawl/NoiseTorch/issues/2#issuecomment-785262068
> 
> I have reviewed all commits from
> 811aec6641ff509bd44cd80aa872f71df502e36a
> forward and there was no GPLv3 violation to begin with. The patch of
> the
> version is irrelevant to the operation or use of the software.
> 
> (notwithstanding that Arch doesn't distribute anything to begin with)
> 
> Probably kinda hard for a Go programmer to understand...
> 

I know I will be the minority in this list. However, this statement
doesn't sound right to me if the patch file is applied to the original
source code.

Unlike the file PKGBUILD, a patch file constitutes a modified source
code because it does include some original code. No matter whether the
modification is for use, or operation, or just even a typo fix, GPLV3
section 5 "Conveying Modified Source Versions" [1] doesn't distinguish
them.

I had a similar experience in terms of the AUR package SGE. I put my
source code modification into a single patch file and put it to AUR
git. Without my modification, SGE won't work with latest Linux anymore.
However, due to an AUR website bug confirmed by a TU, the package was
taken over without any emails sent to me.

After a lot of back and force with the second maintainer, I finally
gave up re-owning the package or making the software better within AUR.
Instead I asked the second maintainer to add my name to the single
patch file so I get the credit I deserve. However, the second
maintainer denied that. He split the patch into many small patch files
without my name in any of them, and insists that it is enough to have
my name as the first AUR package maintainer. Then I asked him to remove
my code modification, also was denied.

Then I tried to ask TU to remove the package many times, all TUs denied
my request, except the last TU deleted all those small patch files
after he understood this is a serious copyright violation issue.

Here is my understanding about those copyright conflicts. If you
modified any source code, then GPL license will be applied, you have to
copy the original copyright without any modification and then add
yours, just as section 4 in GPL v3 says "You may convey verbatim copies
of the Program's source code as you receive it"

It is understandable that many AUR maintainers, or programmers like
myself, don't know the details and often violates some copyright law
more or less. We are lucky that most upstream programmers don't mind
it. But, should such issue arise, I would do my best to make the
upstream programmer happy or just find another alternative software.

I know I am the minority in this list because the AUR SGE got two up-
votes ironically after it didn't work anymore, and the second
maintainer is even promoting the binary version based on my
modification on some other repos. But, life is too short, I can live
with it. I am writing this email because I just hope my painful
experience can help this list know copyright better.


[1] https://www.gnu.org/licenses/gpl-3.0.en.html


Best,
Manhong