Subject: nx-libs-lite: parts are derived from non-free code

From: "Francesco Poli \(wintermute\)" <[email-masked]>
Date: Wed, 06 May 2015 19:35:32 +0200

Package: nx-libs-lite
Version: 3.5.0.27-1
Severity: serious
Justification: Policy 2.2.1

Hello and thanks for maintaining this package in Debian!

I noticed that the debian/copyright states:

[...]
| Parts of this software are derived from DXPC project. These copyright
| notices apply to original DXPC code:
| 
|    Redistribution and use in source and binary forms are permitted provided
|    that the above copyright notice and this paragraph are duplicated in all
|    such forms.
| 
|    THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
|    WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
|    MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
| 
|    Copyright (c) 1995,1996 Brian Pane
|    Copyright (c) 1996,1997 Zachary Vonler and Brian Pane
|    Copyright (c) 1999 Kevin Vigor and Brian Pane
|    Copyright (c) 2000,2001 Gian Filippo Pinzari and Brian Pane
[...]

This license lacks the permission to modify the DXPC code.
Hence, the original DXPC code does not appear to comply with the
DFSG. And the nx-libs-lite is in part derived from DXPC code.

This basically means that nx-libs-lite includes parts which are
non-free (as they are derived from non-modifiable code) and
are also possibly legally undistributable (as they are non-modifiable,
but actually modified). The combination with the rest of nx-libs-lite
(which is GPL-licensed) may also be legally undistributable (since
the license with no permission to modify is GPL-incompatible).

If there's anything I misunderstood, please clarify.

Otherwise, please address this issue as soon as possible.
The copyright owners for the original DXPC code should be
contacted and persuaded to re-license under GPL-compatible
terms.

Thanks for your time.
Bye.

---

From: Mike Gabriel <[email-masked]>
Date: Mon, 11 May 2015 09:07:48 +0000

Hi Francesco,
Cc:ing a couple of people/groups being affected by the below.

> contacted and persuaded to re-license under GPL-compatible

I/we will investigate this asap. Thanks for bringing this up.

Greets,
Mike
-- 

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: [email-masked], http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

---

From: Stefan Baur <[email-masked]>
Date: Mon, 11 May 2015 11:20:46 +0200

hi everyone,

looking at the current homepage of DXPC, the following can be found in
their changelog http://www.vigor.nu/dxpc/CHANGES:

3.8.1 Release:

[...]

Changed license to BSD license.

- -Stefan

Am 11.05.2015 um 11:07 schrieb Mike Gabriel:
> Hi Francesco, Cc:ing a couple of people/groups being affected by
> the below.
> 
>> Package: nx-libs-lite Version: 3.5.0.27-1 Severity: serious 
>> [...] | Parts of this software are derived from DXPC project.
>> These copyright | notices apply to original DXPC code: | |
>> Redistribution and use in source and binary forms are permitted 
>> provided |    that the above copyright notice and this paragraph
>> are duplicated in all |    such forms. | |    THIS SOFTWARE IS
>> PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED |
>> WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES
>> OF |    MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. | |
>> Copyright (c) 1995,1996 Brian Pane |    Copyright (c) 1996,1997
>> Zachary Vonler and Brian Pane |    Copyright (c) 1999 Kevin Vigor
>> and Brian Pane |    Copyright (c) 2000,2001 Gian Filippo Pinzari
>> and Brian Pane [...]
>> 
>> This license lacks the permission to modify the DXPC code. Hence,
>> the original DXPC code does not appear to comply with the DFSG.
>> And the nx-libs-lite is in part derived from DXPC code.
>> 
>> non-free (as they are derived from non-modifiable code) and are
>> also possibly legally undistributable (as they are
>> non-modifiable, but actually modified). The combination with the
>> rest of nx-libs-lite (which is GPL-licensed) may also be legally
>> undistributable (since the license with no permission to modify
>> is GPL-incompatible).
>> 
>> 
>> Otherwise, please address this issue as soon as possible. The
>> copyright owners for the original DXPC code should be contacted
>> and persuaded to re-license under GPL-compatible terms.
>> 
>> Thanks for your time. Bye.
> 
> Greets, Mike
> _______________________________________________ x2go-dev mailing
> list [email-masked] 
> http://lists.x2go.org/listinfo/x2go-dev
> 

- -- 
BAUR-ITCS UG (haftungsbeschränkt)
Geschäftsführer: Stefan Baur
Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364
Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243

---

From: Mike Gabriel <[email-masked]>
Date: Mon, 11 May 2015 09:26:36 +0000

Hi Francesco,

> contacted and persuaded to re-license under GPL-compatible

Please follow-up with reading [1].

As it seems, dxpc has been long ago relicensed to BSD-2-clause (for  
v3.8.1 in/around 2002).

I have no exact clue, if NoMachine forked prior to that (if they quote  
the old licensing terms, then probably they did).

However, how do you see the situation considering that upstream  
changed to BSD-2-clause a long time ago. What approach do you propose  
for nx-libs-lite to get the issue fully fixed?

Mike

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=142028

-- 

DAS-NETZWERKTEAM

GnuPG Key ID 0x25771B31

freeBusy:

---

From: Francesco Poli <[email-masked]>
Date: Mon, 11 May 2015 21:36:59 +0200

On Mon, 11 May 2015 09:26:36 +0000 Mike Gabriel wrote:

[...]
> As it seems, dxpc has been long ago relicensed to BSD-2-clause (for  

This is great news, indeed!

> the old licensing terms, then probably they did).

Yep, it's plausible...

> for nx-libs-lite to get the issue fully fixed?

If the fork has been performed before the DXPC re-licensing (as it's
likely), I see two possible strategies:

 (A) someone gets in touch with DXPC copyright owners and asks them
whether the re-licensing may be considered retroactive (applicable to
older versions of DXPC); in case the answer is negative, DXPC copyright
owners should be persuaded to make the re-licensing retroactive

 (B) nx-libs-lite upstream developers re-fork from scratch, basing the
new code on a BSD-licensed version of DXPC (I suspect this may turn out
to be somewhat painful...)

Obviously, the optimal solution is (A). I hope it may work...

Thanks for your time and for your prompt and kind replies.

-- 
 http://www.inventati.org/frx/
 There's not a second to spare! To the laboratory!
..................................................... Francesco Poli .
 GnuPG key fpr == CA01 1147 9CD2 EFDF FB82  3925 3E1C 27E1 1F69 BFFE

---

From: Mike Gabriel <[email-masked]>
Date: Tue, 12 May 2015 03:59:20 +0000

Hi Francesco,

> owners should be persuaded to make the re-licensing retroactive

This is the way to go, I will pull in Kevin Vigor (the upstream author  
of DXPC) into this thread with my next email.

> to be somewhat painful...)

Yeah, indeed painful.

> Thanks for your time and for your prompt and kind replies.

Also, Michael DePaulo, one of the upstream NX maintainers noted that  
DXPC simply used a previous version of the BSD license, see [1]. The  
weakness of that ancient license template is that modification is not  
explictily allowed, but neither forbidden.

I think, regarding the historical usage of the BSD license predecessor  
and the switch to BSD-2-clause should be fine already (I am not a  
lawyer, though). I will contact DXPC upstream nonetheless and ask for  
a statement.

Greets,
Mike

[1] http://en.wikipedia.org/wiki/BSD_licenses#Previous_license

-- 

DAS-NETZWERKTEAM

GnuPG Key ID 0x25771B31

freeBusy:

---

From: Mike Gabriel <[email-masked]>
Date: Tue, 12 May 2015 04:46:37 +0000

Dear Kevin,

(I Cc: several people involved in this, also the X2Go development  
mailing list...)

[If you feel unconfortable with discussing the details / the impact of  
the below in public, feel free to answer to me directly first with  
questions and concerns, before answering to all people who are listed  
in Cc:.]

Someone from the Debian legal team recently brought up a license issue  
discovered in nx-libs 3.x series.

TL;DR; Suggested by Francesco Poli from the Debian legal team: """
(A) someone gets in touch with DXPC copyright owners and asks them
whether the re-licensing [in 2002] may be considered retroactive  
(applicable to
older versions of DXPC); in case the answer is negative, DXPC copyright
owners should be persuaded to make the re-licensing retroactive
"""

The person contacting you about the above question is me. Mike  
Gabriel, Debian Developer and one of the current upstream maintainers  
of nx-libs 3.x (previously also know as  "NX redistributed" for X2Go)  
[1].

This issue requires some time of reading from you and (hopefully) a  
public statement, that the original DXPC code can be considered as  
BSD-2-clause (the current license) also for released versions prior  
2002 when the ancient BSD license template [2] was still shipped with  
DXPC.

For a complete follow-up, please check Debian bug #784565 [3].

We are aware that NoMachine forked DXPC at some early stage around the  
year 2000 and wrote their own commercial product around it. Obviously,  
this fork happened before 2002 (i.e., before DXPC release 3.8.1), as  
libxcomp3 in NoMachine's NX ships the previously used BSD license  
template. I am not sure, if that fork was easy for you or actually a  
nuisance. I may only guess at this point. I'd be happy to know more  
(maybe not in this mail thread, though).

NoMachine has stopped publishing NXv3 updates a couple of years ago  
(2011 IIRC), now. The maintenance has been moved into the hands of the  
currently available FLOSS projects "X2Go", "Arctica Project" [NEW] and  
"TheQVD". Some of us are running a business model on top of that  
(consultancy, support contracts, feature development contracts), some  
of us spend a lot of their free time on improving / maintaining  
nx-libs (as we call NoMachine's NXv3 at the moment).

To outline the impact of my mail clearly: If you say that it was not  
legal by NoMachine to fork DXPC at the given time (before 2002), then  
all FLOSS remote desktop / remote application would be in real  
trouble, because then the core component of their software projects  
could not be considered as free (as in DFSG, Debian free software  
guidelines[4]) anymore. Also the code changes originally performed by  
NoMachine might have been illegal in the first place. All current  
maintenance activities and also planned future development on nx-libs  
would become questionable.

Thus, I hope you can chime in on this: Dear developers of nx-libs,  
please assume the BSD-2-license as retroactive and applicable to DXPC  
version earlier than 3.8.1. As the copyright holder, I agree with  
modifications of code bases that originate before the change to  
BSD-2-clause license got introduced in 3.8.1 of DXPC.

And... I will bring up that question later (but it is burning under my  
nails)... Be sure: The nx-libs maintainers would be happy to have the  
original DXPC author on the nx-libs developer team. But I will bring  
up that question later (when this very issue is settled). ;-)

Greets,
Mike

[1] https://github.com/ArcticaProject/nx-libs
[2] http://en.wikipedia.org/wiki/BSD_licenses#Previous_license
[3] http://bugs.debian.org/784565
[4] http://de.wikipedia.org/wiki/Debian_Free_Software_Guidelines

-- 

DAS-NETZWERKTEAM

GnuPG Key ID 0x25771B31

freeBusy:

---

From: Kevin Vigor <[email-masked]>
Date: Tue, 12 May 2015 08:55:00 -0600

Hi Mike, et al,

    I am not the original author of dxpc, that being Brian Pane. However, I took over maintenance circa 1999 and am still the primary maintainer (though the project has effectively been dead for most of a decade now).

    As you are aware, when I inherited the code, it was licensed under a variant of the BSD license that did not include the 'with modification' clause. To the best of my recollection, somebody from the FSF contacted me circa 2001 regarding this and as a result, subsequent releases were done under a standard 2-clause BSD license with the modification clause. Again, to the best of my recollection, I contacted Brian about this change and he offered no objection.

    Further, I recall distinctly that NoMachine contacted me and explicitly asked permission before including DXPC code in NX, which I happily granted with no new conditions beyond the BSD license already in play.

    It is possible, though by no means certain, that I could dig up ancient email to corroborate this account if necessary. However, I am more than willing to publicly state that I believe NoMachine's use of DXPC code to be both legal and ethical, and that my intent when changing the license to 2-clause BSD was simply to clarity the existing intent and that it ought therefore be considered retroactive.

    Yours,
       Kevin Vigor

On 05/11/15 22:46, Mike Gabriel wrote:
> Dear Kevin,
>
> (I Cc: several people involved in this, also the X2Go development mailing list...)
>
> [If you feel unconfortable with discussing the details / the impact of the below in public, feel free to answer to me directly first with questions and concerns, before answering to all people who are listed in Cc:.]
>
> Someone from the Debian legal team recently brought up a license issue discovered in nx-libs 3.x series.
>
> whether the re-licensing [in 2002] may be considered retroactive (applicable to
> The person contacting you about the above question is me. Mike Gabriel, Debian Developer and one of the current upstream maintainers of nx-libs 3.x (previously also know as  "NX redistributed" for X2Go) [1].
>
> This issue requires some time of reading from you and (hopefully) a public statement, that the original DXPC code can be considered as BSD-2-clause (the current license) also for released versions prior 2002 when the ancient BSD license template [2] was still shipped with DXPC.
>
> We are aware that NoMachine forked DXPC at some early stage around the year 2000 and wrote their own commercial product around it. Obviously, this fork happened before 2002 (i.e., before DXPC release 3.8.1), as libxcomp3 in NoMachine's NX ships the previously used BSD license template. I am not sure, if that fork was easy for you or actually a nuisance. I may only guess at this point. I'd be happy to know more (maybe not in this mail thread, though).
>
> NoMachine has stopped publishing NXv3 updates a couple of years ago (2011 IIRC), now. The maintenance has been moved into the hands of the currently available FLOSS projects "X2Go", "Arctica Project" [NEW] and "TheQVD". Some of us are running a business model on top of that (consultancy, support contracts, feature development contracts), some of us spend a lot of their free time on improving / maintaining nx-libs (as we call NoMachine's NXv3 at the moment).
>
> To outline the impact of my mail clearly: If you say that it was not legal by NoMachine to fork DXPC at the given time (before 2002), then all FLOSS remote desktop / remote application would be in real trouble, because then the core component of their software projects could not be considered as free (as in DFSG, Debian free software guidelines[4]) anymore. Also the code changes originally performed by NoMachine might have been illegal in the first place. All current maintenance activities and also planned future development on nx-libs would become questionable.
>
> Thus, I hope you can chime in on this: Dear developers of nx-libs, please assume the BSD-2-license as retroactive and applicable to DXPC version earlier than 3.8.1. As the copyright holder, I agree with modifications of code bases that originate before the change to BSD-2-clause license got introduced in 3.8.1 of DXPC.
>
> And... I will bring up that question later (but it is burning under my nails)... Be sure: The nx-libs maintainers would be happy to have the original DXPC author on the nx-libs developer team. But I will bring up that question later (when this very issue is settled). ;-)
>
> Greets,
> Mike
>

---

From: Mike Gabriel <[email-masked]>
Date: Tue, 12 May 2015 17:41:55 +0200

Hi Kevin,

thanks for your feedback. Let us wait for Francesco, our expert on license issues, and see what he thinks about your feedback.

Thank you very much for providing info and sharing pieces of nx-libs's history.

As you sent your reply to the Debian bug tracker already, this will public statement enough, I guess.

Thanks a lot,
Mike

-- 

DAS-NETZWERKTEAM
fon: +49 (1520) 1976148

GnuPG Key ID 0x25771B13

----- Original message -----
> Hi Mike, et al,
> 
>         I am not the original author of dxpc, that being Brian Pane.
> However, I took over maintenance circa 1999 and am still the primary
> maintainer (though the project has effectively been dead for most of a
> decade now).
> 
>         As you are aware, when I inherited the code, it was licensed under a
> variant of the BSD license that did not include the 'with modification'
> clause. To the best of my recollection, somebody from the FSF contacted
> me circa 2001 regarding this and as a result, subsequent releases were
> done under a standard 2-clause BSD license with the modification clause.
> Again, to the best of my recollection, I contacted Brian about this
> change and he offered no objection.
> 
>         Further, I recall distinctly that NoMachine contacted me and
> explicitly asked permission before including DXPC code in NX, which I
> happily granted with no new conditions beyond the BSD license already in
> play.
> 
>         It is possible, though by no means certain, that I could dig up
> ancient email to corroborate this account if necessary. However, I am
> more than willing to publicly state that I believe NoMachine's use of
> DXPC code to be both legal and ethical, and that my intent when changing
> the license to 2-clause BSD was simply to clarity the existing intent
> and that it ought therefore be considered retroactive.
> 
>         Yours,
>               Kevin Vigor
> 
> > (applicable to older versions of DXPC); in case the answer is
> > negative, DXPC copyright owners should be persuaded to make the
> > re-licensing retroactive """
> > 
> > > > I have no exact clue, if NoMachine forked prior to that (if they
> > > > quote the old licensing terms, then probably they did).
> > > 
> > > Yep, it's plausible...
> > > 
> > > > 
> > > > changed to BSD-2-clause a long time ago. What approach do you
> > > > propose for nx-libs-lite to get the issue fully fixed?
> > > 
> > > older versions of DXPC); in case the answer is negative, DXPC
> > > copyright owners should be persuaded to make the re-licensing
> > > retroactive
> > > 
> > > new code on a BSD-licensed version of DXPC (I suspect this may turn
> > > out to be somewhat painful...)
> > > 
> > >

---

From: Francesco Poli <[email-masked]>
Date: Tue, 12 May 2015 23:40:48 +0200

> Hi Kevin,

Hello Mike, hello Kevin, hello to all the other recipients.

First of all, I wish to express my gratitude to Kevin for his prompt,
kind and generous response.

> thanks for your feedback. Let us wait for Francesco, our expert on license issues, and see what he thinks about your feedback.

I think that this is an important first step to solve this issue for
the best.
Kevin Vigor is one of the copyright owners of the code that was forked
before the re-licensing.
We now know that he intended the re-licensing to be retroactive and
this is really good.

I think that now it would be useful to ascertain that the other
copyright owners (Brian Pane, Zachary Vonler, Gian Filippo Pinzari) are
also OK with this interpretation of the re-licensing operation.

Maybe Kevin is able to dig the original conversations (assuming they
were carried on by e-mail or similar archived means) or otherwise to
get in touch with them and check? Or, alternatively, Kevin could help
Mike to get in touch with them?

I hope everything may be settled for the best soon.
Thanks a lot to everyone involved.

---

From: Mike Gabriel <[email-masked]>
Date: Thu, 14 May 2015 04:58:09 +0000

Hi all,

there has been an off-list mail exchange between Francesco and Kevin  
(and me in Cc:) which I will quote at the end of this mail (as it was  
not meant to be private and we should fully document the flow on this  
issue).

@Kevin: I will take you off this mail thread's Cc: field with my next  
post. Feel free to follow-up via #784565 [1] on the Debian bug  
tracker. Thanks a lot for being so responsive and generous with  
providing information.

> also OK with this interpretation of the re-licensing operation.

As stated by Kevin, Gian Filippo worked/works on the NoMachine side. I  
will include him in Cc:.

For Brian Pane we also found and e-Mail address, for Zach Vonler, I  
will use the mail address provided in DXPC code (which might be  
outdated), but I think I actually have found his phone number on the  
web, so if that mail address bounces I will give him a ring.

> get in touch with them and check? Or, alternatively, Kevin could help

As stated in the forwarded messages below, Kevin was unable to dig out  
any mails from backups. So we switch to plan B: contact Brian, Zach  
and Gian Filippo.

> Mike to get in touch with them?

I will do that.

> Thanks a lot to everyone involved.

/me, too.

light+love
Mike

[1] http://bugs.debian.org/784565

----- Weitergeleitete Nachricht von Kevin Vigor <[email-masked]> -----
   Datum: Wed, 13 May 2015 09:01:27 -0600
     Von: Kevin Vigor <[email-masked]>
Betreff: Re: [pkg-x2go-devel] Bug#784565: nx-libs-lite: parts are  
derived from non-free code
      An: Francesco Poli <[email-masked]>
      Cc: Mike Gabriel <[email-masked]>

> Mike to get in touch with them?

I'm afraid I was not able to dig anything out of old backups last  
night. I still have a stack of CDs to look through, but don't hold  
your breath. Sorry about that.

I have never had any contact with Zachary Vonler or Gian Filippo  
Pinzari, and have not spoken with Brian Pane in many years, so I have  
no recent contact information for any of them. However, a quick google  
turns up:

https://www.linkedin.com/profile/view?id=728859
http://www.brianp.net/contact/

which is almost certainly the right Brian Pane (he was at CNet at the  
proper time).

    Good luck,
          Kevin

----- Ende der weitergeleiteten Nachricht -----

----- Weitergeleitete Nachricht von Francesco Poli  
<[email-masked]> -----
   Datum: Wed, 13 May 2015 19:43:44 +0200
     Von: Francesco Poli <[email-masked]>
Betreff: Re: [pkg-x2go-devel] Bug#784565: nx-libs-lite: parts are  
derived from non-free code
      An: Kevin Vigor <[email-masked]>
      Cc: Mike Gabriel <[email-masked]>

On Wed, 13 May 2015 09:01:27 -0600 Kevin Vigor wrote:

> On 05/12/15 15:40, Francesco Poli wrote:
>
> I'm afraid I was not able to dig anything out of old backups last  
> night. I still have a stack of CDs to look through, but don't hold  
> your breath. Sorry about that.

Thanks a lot for searching: this is really appreciated, at least from
my side.

>
> I have never had any contact with Zachary Vonler or Gian Filippo Pinzari,

Then I wonder how it was possible to re-license DXPC in 2002...
:-|

> and have not spoken with Brian Pane in many years, so I have no recent
contact information for any of them. However, a quick google turns up:
>
> https://www.linkedin.com/profile/view?id=728859
> http://www.brianp.net/contact/
>
> which is almost certainly the right Brian Pane (he was at CNet at  
> the proper time).

This could be really useful, thank you very much!

Mike, I hope the search may go on from there: Brian should be asked
about the retroactive nature of the re-licensing of DXPC and maybe he
also knows how to get in touch with Zachary and/or Gian Filippo...

P.S.: Kevin, any special reason why you dropped several addresses from
the Cc list? Should this part of our conversation be kept private for
the time being? Please clarify. Thanks!

----- Ende der weitergeleiteten Nachricht -----

----- Weitergeleitete Nachricht von Kevin Vigor <[email-masked]> -----
   Datum: Wed, 13 May 2015 14:08:48 -0600
     Von: Kevin Vigor <[email-masked]>
Betreff: Re: [pkg-x2go-devel] Bug#784565: nx-libs-lite: parts are  
derived from non-free code
      An: Francesco Poli <[email-masked]>
      Cc: Mike Gabriel <[email-masked]>

On 05/13/15 11:43, Francesco Poli wrote:
> On Wed, 13 May 2015 09:01:27 -0600 Kevin Vigor wrote:

>> I have never had any contact with Zachary Vonler or Gian Filippo Pinzari,
>
> Then I wonder how it was possible to re-license DXPC in 2002...
> :-|
>

I believe Gian worked on the NoMachine code; he has never contributed  
to DXPC directly.

Zachary Vonler was allegedly the maintainer of DXPC for a while circa  
1999, but never responded to any email when I attempted to contact  
him, which is how I came to take over maintenance.

> P.S.: Kevin, any special reason why you dropped several addresses from
> the Cc list? Should this part of our conversation be kept private for
> the time being? Please clarify. Thanks!

No, I was just trying to keep from spamming email lists unnecessarily.  
I do not consider any part of this conversation private.

----- Ende der weitergeleiteten Nachricht -----

----- Weitergeleitete Nachricht von Francesco Poli  
<[email-masked]> -----
   Datum: Wed, 13 May 2015 22:50:32 +0200
     Von: Francesco Poli <[email-masked]>
Betreff: Re: [pkg-x2go-devel] Bug#784565: nx-libs-lite: parts are  
derived from non-free code
      An: Kevin Vigor <[email-masked]>
      Cc: Mike Gabriel <[email-masked]>

On Wed, 13 May 2015 14:08:48 -0600 Kevin Vigor wrote:

> On 05/13/15 11:43, Francesco Poli wrote:
> > On Wed, 13 May 2015 09:01:27 -0600 Kevin Vigor wrote:
>
> >> I have never had any contact with Zachary Vonler or Gian Filippo Pinzari,
> >
> > Then I wonder how it was possible to re-license DXPC in 2002...
> > :-|
> >
>
> I believe Gian worked on the NoMachine code; he has never  
> contributed to DXPC directly.

Good, then only Zachary has to be tracked down.

>
> Zachary Vonler was allegedly the maintainer of DXPC for a while  
> circa 1999, but never responded to any email when I attempted to  
> contact him, which is how I came to take over maintenance.

Let's hope Brian is able to help Mike in getting in touch with
Zachary...

>
>
> > P.S.: Kevin, any special reason why you dropped several addresses from
> > the Cc list? Should this part of our conversation be kept private for
> > the time being? Please clarify. Thanks!
>
> No, I was just trying to keep from spamming email lists  
> unnecessarily. I do not consider any part of this conversation  
> private.
>

OK, thanks for clarifying.

----- Ende der weitergeleiteten Nachricht -----

-- 

DAS-NETZWERKTEAM

GnuPG Key ID 0x25771B31

freeBusy:

---

From: Mike Gabriel <[email-masked]>
Date: Thu, 14 May 2015 05:55:42 +0000

Dear Brian, dear Zachary, dear Gian Filippo,

(Find a TL;DR; at the end of this mail...)

I am contacting you on a licensing issue related to the DXPC code that  
you worked on at the end of the nineties. I'd highly appreciate it if  
you could take a little time to read this mail and get back to me,  
either privately or in public.
[I have actually Cc:ed quite a number of people in this mail (thread).  
All of them will be affected by the outcome of this license issue to  
some lesser or greater extent. If you feel inconvenient with replying  
to so many people you don't know, really don't hesitate to get back to  
me in private first, so that we can sort things out. Thank you.]

Before I continue, let me shortly introduce myself. My name is Mike  
Gabriel, I work for the Debian project [1.1, 1.2] (which brings forth  
one of the major GNU/Linux distributions world-wide. I am also the  
upstream code maintainer of a software project called nx-libs [2]. The  
nx-libs code has been derived from several of NoMachine's NXv3 [11]  
components (namely: nx-X11, nxagent, nxcomp, nxcompext and nxcompshad).

A member of the Debian legal team [3] (Francesco Poli) made us (i.e.,  
the nx-libs developers, users, package maintainers) aware of an issue  
[4] in the nx-libs component NXCOMP (which has been derived from DXPC  
[5]). Please read Message #5 of the brought up issue on the Debian bug  
tracker (#784565) [4] before you continue reading. Thanks.

I will now jump into the below quoted mail and continue inline...

>> thanks for your feedback. Let us wait for Francesco, our expert on  
>> license issues, and see what he thinks about your feedback.
>

We are currently in the process of contacting all DXPC related  
copyright holders mentioned in the NXCOMP license file [6]. We already  
received some feedback from Kevin Vigor [7], but we also need to  
address you (Brian, Zachary, Gian Filippo) with this. (The mail  
address I have from Zachary may be outdated, so any current contact  
address is highly welcome, in case the mail address being used will  
bounce back).

At the moment, NXCOMP (and thus nx-libs, but also NoMachine's NXv3  
code) cannot be considered as fully free software, until this issue is  
settled. The DXPC license before DXPC v3.8.1 was an ancient BSD style  
license that failed in explicitly mentioning, that it is allowed to  
modify the DXPC code in derivative works. In 2002, DXPC 3.8.1 got  
released [12], using a more compliant license (BSD-2-clause). As Kevin  
told us, this license change [8,9] was done after the FSF [10] had  
contacted the DXPC developers.

However, the NXCOMP code in NXv3 got forked from DXPC before 2002, as  
it seems. So unfortunately, the modifications of DXPC as found in  
NoMachine's NXCOMP product are not compliant with the pre-3.8.1  
license of DXPC.

> also OK with this interpretation of the re-licensing operation.

TL;DR; So here comes my actual question: are you (Brian Pane, Zachary  
Vonler, Gian Filippo Pinzari) ok with retroactively regarding  
pre-3.8.1 code of DXPC (that you probably all worked on at that time)  
as BSD-2-clause? Are you ok with others having taken or taking the  
pre-3.8.1 DXPC code and distribute it in a modified form?

A yes from all of you as DXPC copyright holders is essential for the  
continuation of nx-libs development under a free license. This may  
also possibly be an issue for NXv4 in case parts of it have been  
derived from DXPC.

Thanks to all of you for taking your time.

light+love
Mike

[1.1] http://www.debian.org
[1.2] https://qa.debian.org/developer.php?login=sunweaver%40debian.org
[2] https://github.com/ArcticaProject/nx-libs
[3] https://www.debian.org/legal/
[4] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784565#5
[5] http://www.vigor.nu/dxpc/
[6] https://github.com/ArcticaProject/nx-libs/blob/3.6.x/nxcomp/LICENSE#L32
[7] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784565#40
[8] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=72020
[9] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=142028
[10] http://www.fsf.org/
[11] https://www.nomachine.com/version-3
[12] http://www.vigor.nu/dxpc/CHANGES
-- 

DAS-NETZWERKTEAM

GnuPG Key ID 0x25771B31

freeBusy:

---

From: Mike Gabriel <[email-masked]>
Date: Thu, 14 May 2015 06:20:18 +0000

Hi again,

On  Do 14 Mai 2015 07:55:42 CEST, Mike Gabriel wrote:

> [...] (The mail address I have from Zachary may be outdated, so any  
> current contact address is highly welcome, in case the mail address  
> being used will bounce back).

As it seems, the publicly known mail address of Zachary Vonler at  
austin.utexas.edu is outdated.

@Brian: if you happen to have a recent mail address of Zachary, could  
you please provide it to me privately? Thanks.

Mike
-- 

DAS-NETZWERKTEAM

GnuPG Key ID 0x25771B31

freeBusy:

---

From: Mike Gabriel <[email-masked]>
Date: Sat, 16 May 2015 09:19:12 +0000

Hi all, esp. Kevin,

On  Do 14 Mai 2015 06:58:09 CEST, Mike Gabriel wrote:

I looked at dxpc releases (I obtained upstream tarballs from  
snapshot.debian.org).

I currently have:

"""
[mike@minobo dxpc.nxrebase (upstream-nxrebase)]$ git log
commit 0676a768a96383641a73a72ecd2e1083322e6abe
Author: Mike Gabriel <[email-masked]>
Date:   Sat May 16 10:52:24 2015 +0200

     Imported Upstream version 3.9.2

commit 4ccf34b2c4763dfb01dceb8588b204b0d029cc3d
Author: Mike Gabriel <[email-masked]>
Date:   Sat May 16 10:51:04 2015 +0200

     Imported Upstream version 3.9.1

commit dd8f60ce63c70ed605a2e1717feb7128e59fb8e6
Author: Mike Gabriel <[email-masked]>
Date:   Sat May 16 10:49:19 2015 +0200

     Imported Upstream version 3.9.0

commit 01c990099aea802405f8d39c0b819ee1742c185c
Author: Mike Gabriel <[email-masked]>
Date:   Sat May 16 10:32:06 2015 +0200

     Imported Upstream version 3.8.2

commit 48df60b3b946a08541ee48371634f074e875adda
Author: Mike Gabriel <[email-masked]>
Date:   Sat May 16 10:31:57 2015 +0200

     Imported Upstream version 3.8.0

commit 11d81444d0f86a67f9b8483cbfa33343714b26e9
Author: Mike Gabriel <[email-masked]>
Date:   Sat May 16 10:31:53 2015 +0200

     Imported Upstream version 3.7.0

commit e4f550abd4cd49ecc2381e717a55a9940087a376
Author: Mike Gabriel <[email-masked]>
Date:   Sat May 16 10:31:44 2015 +0200

     Imported Upstream version 3.5.0
"""

> @Kevin: I will take you off this mail thread's Cc: field with my  
> next post. Feel free to follow-up via #784565 [1] on the Debian bug  

With this post I actually reincluded you because it becomes technical  
from here on and I probably will need your expertise on DXPC. Not sure  
if you have time or prio or are willing to provide that. Would you be  
open for answering technical questions on DXPC and esp. the changes  
between 3.7.0 and 3.8.1/3.8.2? I'd highly appreciate that.

As I have not heard back neither from Brian Pane, Zachary Vonler nor  
Gian Filippo Pinzari (we had Ascension Day and maybe a prolonged  
weekend that people used for going on VAC), I will try looking at the  
DXPC changes between 3.7.0 and 3.8.1. Obviously, NoMachine forked  
NXCOMP from DXPC some time between DXPC 3.7.0 and DXPC 3.8.0.

Questions to Kevin:

   o Is there any SVN upstream repo still online
     (I saw it in one of the tarballs, that SVN was
     used for 3.9.0).
   o Do you have any tarballs documenting the
     changes between 3.7.0 and 3.8.0? Do you also
     have the 3.8.1 tarball?
   o Did the 3.8.0 version of DXPC break proto
     compatibility (i.e., you could not use client
     3.7.0 and server 3.8.0 and vice versa with
     each other)?

Any help on this is appreciated. Thanks.

Mike

-- 

DAS-NETZWERKTEAM

GnuPG Key ID 0x25771B31

freeBusy:

---

From: Kevin Vigor <[email-masked]>
Date: Mon, 18 May 2015 14:38:25 -0600

On 05/16/15 03:19, Mike Gabriel wrote:
  As I have not heard back neither from Brian Pane, Zachary Vonler nor Gian Filippo Pinzari (we had Ascension Day and maybe a prolonged weekend that people used for going on VAC), I will try looking at the DXPC changes between 3.7.0 and 3.8.1. Obviously, NoMachine forked NXCOMP from DXPC some time between DXPC 3.7.0 and DXPC 3.8.0.
>      (I saw it in one of the tarballs, that SVN was

I'm afraid not. There was never an online repo available, and if I used one personally it is lost to the mists of time.

>      changes between 3.7.0 and 3.8.0? Do you also

I have the source tarballs to each of those (including the 3.8.1 version). The 3.8.0 release includes a README-3.8.0 file which documents the changes between 3.7.0 and 3.8.0 reasonably well.

As will be (unfortunately) obvious from examining the deltas between 3.7.0 (the last release by Brian and/or Zachary) and 3.8.0 (the first release by me), I inherited a significant majority of the code.

>      3.7.0 and server 3.8.0 and vice versa with

Yes, minor version number bumps were used to indicate compatibility. 3.8.x was incompatible with 3.7.x (and also with 3.9.x).

---

From: Kevin Vigor <[email-masked]>
Date: Mon, 18 May 2015 15:11:42 -0600

By the way, poking around the interwebs I find there is an archive of the old DXPC mailing list available at:

http://marc.info/?l=dxpc&r=1&w=2

I think you will find this of particular interest:

http://marc.info/?l=dxpc&m=93093790813555&w=2

List:       dxpc
Subject:    Re: future tecnologies
From:       Brian Pane <brianp () cnet ! com>
Date:       1999-07-02 16:42:18
[Download message RAW]

Kevin Vigor <[email-masked]> wrote:
> On 01-Jul-99 [email-masked] wrote:
> > Speaking of licensing, are you putting your 3.8.0 changes to the dxpc
> > code itself under GPL, or are they going to use the original dxpc's
> > licensing?
>
> No, as you can probably guess, I am no fan of the GPL. For stuff on
> this level, where my hacking is pretty simple and probably devoid of
> commercial value, I'll just release my changes to the public domain and
> give up even a copyright interest in them.
>
> Your and Zach's copyrights still stand, of course.
>
> I *think* that fact that we use the LZO library and API, but do not
> directly incorporate the code, allows us to escape the clutch of the GPL
> virus.
>
> btw, is there an original dxpc license? I haven't seen anything but a
> copyright notice, which to my non-lawyerly mind translates as "free to
> all the world as is, negotiate with copyright owner if modifying or
> including in some other product".

The copyright banner in the Readme is all the documentation there's ever
been.  My intent was to allow _any_ distribution, use, and modification
of the source, without imposing restrictions on the licensing style of
any system into which others might incorporate the code.  We probably
should start stating this clearly in the distributions.

-brian

[prev in list] [next in list] [prev in thread] [next in thread]

---

From: Mike Gabriel <[email-masked]>
Date: Mon, 18 May 2015 23:48:51 +0200

Hi Kevin, hi Zach, hi Francesco, hi all,

@Francesco, please review the recent posts and sum up what to do next.

----- Original message -----

> > directly incorporate the code, allows us to escape the clutch of the
> > GPL virus.
> > 

@Kevin: You are very awesome!

@Francesco: that old post from Brian should be the statement we need, right? As Brian has not answered back, so far, does that post suffice?

I also had a mail from Zach in my mailbox this morning. I managed to get hold of him via phone over the weekend. He posted his agreement to this Debian bug (as message #77) [1] earlier today. @Zach: thanks a lot for that!!!

@Francesco: by looking at [2], I cannot see any hint for Gian Filippo Pinzari being a copyright holder of DXPC. This is stated in the NoMachine files at at least one place, but not in the latest DXPC upstream release. I am on my mobile right now, need to check old versions of DXPC, but if Gian Filippo Pinzari is not listed in the DXPC 3.7.0 release (where nxcomp obviously got forked from), then I think that we don't require his feedback, right?

To my opinion, this issue can be settled. We have direct feedback from Kevin and Zach and Kevin dug out an old post from Brian stating the retroactive nature of the BSD-2-clause while Gian Filippo probably not being a real copyright holder of the original DXPC code. Right?

light+love,
Mike

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=77;att=0;bug=784565
[2] http://www.vigor.nu/dxpc/README

-- 

DAS-NETZWERKTEAM

GnuPG Key ID 0x25771B13

---

From: Francesco Poli <[email-masked]>
Date: Tue, 19 May 2015 00:14:08 +0200

On Mon, 18 May 2015 23:48:51 +0200 Mike Gabriel wrote:

[...]
> @Francesco: that old post from Brian should be the statement we need,
> right? As Brian has not answered back, so far, does that post suffice?

Yes, I am under the impression that it may be considered as evidence
that Brian had always meant to grant permission to modify, despite not
being overly clear until DXPC version 3.8.1.
In other words, it seems that the re-licensing was more intended to be
a clarification, rather than a change of mind.

> 
> I also had a mail from Zach in my mailbox this morning. I managed to
> get hold of him via phone over the weekend. He posted his agreement
> to this Debian bug (as message #77) [1] earlier today. @Zach: thanks
> a lot for that!!!

This is really great!

> 
> @Francesco: by looking at [2], I cannot see any hint for Gian Filippo
> Pinzari being a copyright holder of DXPC. This is stated in the
> NoMachine files at at least one place, but not in the latest DXPC
> upstream release. I am on my mobile right now, need to check old
> versions of DXPC, but if Gian Filippo Pinzari is not listed in
> the DXPC 3.7.0 release (where nxcomp obviously got forked from),
> then I think that we don't require his feedback, right?

If it is confirmed that Gian Filippo contributed to the forking of DXPC
within the NoMachine project, but not directly to DXPC, then I think
that he made his contributions available under the terms of the GPL v2
of the NoMachine project.
If this is the case, no feedback should be required from his side.

> 
> To my opinion, this issue can be settled. We have direct feedback
> from Kevin and Zach and Kevin dug out an old post from Brian stating
> the retroactive nature of the BSD-2-clause while Gian Filippo probably
> not being a real copyright holder of the original DXPC code. Right?

Yes, I agree with this analysis.
The only missing check is the one about Gian Filippo's involvement (as
explained above).

Thanks a lot to everyone involved in this license fixing effort!
Bye.

---

From: Kevin Vigor <[email-masked]>
Date: Mon, 18 May 2015 19:16:25 -0600

On 5/18/2015 4:14 PM, Francesco Poli wrote:
> If it is confirmed that Gian Filippo contributed to the forking of 
> DXPC within the NoMachine project, but not directly to DXPC, then I 
> think that he made his contributions available under the terms of the 
> GPL v2 of the NoMachine project. If this is the case, no feedback 
> should be required from his side.
I can confirm that Gian Fillippo never contributed directly to DXPC. 
You'll note his name does not appear in the DXPC README, and never has.

---

From: Mike Gabriel <[email-masked]>
Date: Tue, 19 May 2015 08:15:12 +0000

Hi Kevin, hi Frederico,

On  Di 19 Mai 2015 03:16:25 CEST, Kevin Vigor wrote:

>> think that he made his contributions available under the terms of  
>> the GPL v2 of the NoMachine project. If this is the case, no  
>> feedback should be required from his side.

> You'll note his name does not appear in the DXPC README, and never  

@Kevin: This is again good news for sorting out this issue. Thanks a  
lot for your help, Kevin.

@Frederico: I guess we are through then. Thanks for helping with  
clarifying the situation (and bringing it up in the first place).

For fixing this issue (in terms of closing the bug), I propose this  
for downstream (i.e., Debian):

   o copy bug_784565.mbox [1] into the debian/ folder of the  
nx-libs-lite package
   o upload some latest release of nx-libs-lite 3.5.0.x to unstable
   o update debian/copyright accordingly
   o close this bug via debian/changelog

For upstream, I propose this:

   o copy bug_784565.mbox into the docs/ folder
   o update copyright information in nxcomp/ subfolder
   o provide some README or such that shortly explains our last weeks' process
   o this will be for the upcoming 3.6.x release series of nx-libs

   o this should also be backported to the 3.5.x release series

Once the mbox file and README are upstreamed, I will drop that content  
from the debian/ folder in the Debian package nx-libs-lite (as it will  
be in the upstream tarball of nx-libs-lite).

Feedback (esp. from Frederico), concerns, other suggestions?

Greets,
Mike

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?mbox=yes;bug=784565
-- 

DAS-NETZWERKTEAM

GnuPG Key ID 0x25771B31

freeBusy:

---

From: Francesco Poli <[email-masked]>
Date: Wed, 20 May 2015 20:03:25 +0200

On Tue, 19 May 2015 08:15:12 +0000 Mike Gabriel wrote:

[...]
> @Frederico: I guess we are through then.

Yes, it seems so (I'm assuming you meant to direct this question to
me...).

> Thanks for helping with  

You're welcome!
Thanks to you and all the involved people for helping to solve this
issue.

>    o copy bug_784565.mbox [1] into the debian/ folder of the  

Maybe the entire bug log is an overkill...
I would include the relevant replies only. For instance:
https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=40;mbox=yes;bug=784565
https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=77;mbox=yes;bug=784565
https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=87;mbox=yes;bug=784565
https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=102;mbox=yes;bug=784565

>    o update debian/copyright accordingly

In the debian/copyright file the license for the original DXPC code
should be replaced with the 2-clause BSD license (currently adopted for
DXPC) with a comment saying something like:

  The original DXPC code used to be available under a license which
  failed to explicitly grant the permission to modify, but was later
  retroactively re-licensed under the 2-clause BSD license (see
  debian/bug_784565_*.mbox for the copyright owners' statements; see
  <https://bugs.debian.org/784565> for more details)

Moreover, the copyright notice of Gian Filippo Pinzari should be
documented in some more appropriate part of the debian/copyright file,
associated with the NoMachine license (GPL v2 or later).

>    o copy bug_784565.mbox into the docs/ folder

Again, I would not include the entire bug log, but only the relevant
messages (see above)...

>    o this should also be backported to the 3.5.x release series

Thanks to everyone involved!
Bye.

---

From: Mike Gabriel <[email-masked]>
Date: Thu, 21 May 2015 09:35:30 +0000

Control: forwarded -1 https://github.com/ArcticaProject/nx-libs/issues/30

Hi Francesco,

> Yes, it seems so (I'm assuming you meant to direct this question to

Yes. :-)

> https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=102;mbox=yes;bug=784565

ACK.

>>    o this should also be backported to the 3.5.x release series

Doing all the above now.

Thanks to all,
Mike

-- 

DAS-NETZWERKTEAM

GnuPG Key ID 0x25771B31

freeBusy: