Canonical Encounters Messy Legal Questions Bringing ZFS to Ubuntu
Most alleged violations of the GNU General Public License (GPL), free software’s most popular family of licenses, typically involve mixing GPL-licensed code with proprietary code.
But last month, when Canonical’s announced that its Ubuntu 16.04 Linux distribution, due to be shipped in April, will include a version of the ZFS filesystem, OpenZFS, the news sparked questions about the legality of mixing of the GPL with the Common Development and Distribution License (CDDL) — both of which are free licenses.
The situation is so unusual that expert opinion is divided, leaving the opinion of others often colored by preconceptions and loyalties.
The issue is not about technology.
Launched in 2004 by Sun Microsystems, open-sourced and now trademarked by Oracle, ZFS is a 128-bit filesystem with advanced tools for protecting data. It features logical volumes, continual integrity checks and automatic repairs using a checksum, as well as the ability to store backup snapshots and to clone file systems.
Although ZFS has limitations, such as incompatibility with many forms of RAID and a slowness to make repairs, the fact that btrfs, Linux’s main candidate for a next-generation file system, has been slow to become standard in many Linux distributions, causing many to look forward to using it.
Rather than the technology, the issue centers on the CDDL, a license once favored by Sun Microsystems and inherited by Oracle. Since the module must be used by the Linux kernel, it must be compatible with the second version of the GPL (GPLv2), which the kernel is licensed under.
Both CDDL and GPLv2 are copyleft licenses. That is, each gives users permission to copy, edit, and distribute code licensed it, but with some restrictions. The trouble is, Section 2b of GPLv2 states that any work that uses GPL-licensed code must also be licensed under some version of the GPL while Section 3.1 of the CDDL has essentially the same restriction.
Similarly, Section 6 of GPLv2 states that “you may not impose any further restrictions on the recipients’ exercise of the rights granted herein,” and Section 3.4 of the CDDL states that “You may not offer or impose any terms on any Covered Software in Source Code form that alters or restricts the applicable version of this License.”
Taken together, these sections indicate that the two licenses would require identical terms and conflicts in order not to conflict.
However, Section 3.6 of the CDDL allows binaries to be released under a different license — something that GPLv2 does not allow, and which therefore seems to indicate a basic incompatibility. In fact, CDDL author Danese Cooper is on record as saying that Sun deliberately wanted a license that was incompatible with GPLv2, presumably as a means to protect its intellectual property.
Whatever Sun’s motives, ever since the Debian folks argued in 2006 that it could not distribute cdrtools because the package’s build system was licensed under the CDDL, the consensus has been that the two licenses were not identical, and therefore not compatible.
The Open Source Initiative includes the CDDL as a possible license, but does not comment on its compatibility, but the Free Software Foundation lists the CDDL as an incompatible license and states that “a module covered by the GPL and a module covered by the CDDL cannot legally be linked together,” which for many settled the issue.
Now, however, Canonical’s assertion that, by co-mingling ZFS and the Linux kernel, “we are acting within the rights granted and in compliance with their terms of both of those licenses,” as Canonical Ubuntu product and strategy team member Dustin Kirkland stated in a blog post, the issue has been reopened.
The Arguments Pro and Con
The compatibility issue is complicated on both sides by strong emotions. For example, on Google+, noted CoreOS security developer Matthew Garrett, who has a history of criticizing Canonical, overacted so much that even Simon Phipps, himself no fan of the CDDL, was moved to ask him pointedly, “given that it’s 100 [percent] free software, why would a license incompatibility in this case provoke a fury usually reserved for proprietary abuse?”
On the other side, Kirkland simply stated, “As we have already reached the conclusion, we are not interested in debating license compatibility” — a statement that appears that Canonical refuses to acknowledge that anyone outside the company might have a stake in the matter.
So far as Kirkland does argue, his position is that “the CDDL applies to all files under the CDDL while the GPLv2 applies to derivative works,” an argument that is undermined by the fact that Section 3.6 of the CDDL discusses what sounds like derivative works. In the same way, his argument that ZFS is a self-contained module and “not a derivative work of the Linux kernel” but of OpenZFS and OpenSolaris ignores the fact that a port to Linux requires additional code for compatibility.
If anything, both sides are not arguing about incompatibility, so much as its consequences. For example, Bradley Kuhn and Karen Sandler of the Software Freedom Conservancy, argue the traditional view of the issue while going out of their way to express sympathy for Canonical’s position, while claiming — with some accuracy — to represent the viewpoint of the free software community. Kuhn and Sandler based their position on the wording of GPLv2 and the CDDL.
Perhaps even more notable is the analysis given by Eben Moglen and Mishi Choudhary of the Software Freedom Law Center. This is the opinion that Kirkland references in his blog, describing the Software Freedom Law Center as “the industry’s leading software freedom legal counsel,” a description with which few would disagree.
In fact, Moglen and Choudhary contradict several statements by Kirkland. They declare, for example, that “anything that was written with Linux in mind (whether it then also works on other operating systems or not) is clearly partially a derived work.” Moreover, they write, “anything that has knowledge of and plays with fundamental Linux behaviour is clearly a derived work. If you need to much around with core code, you’re derived, no question about it.” Moglen and Choudhary then go on to state that files available only under the CDDL are “inconsistent with the literal meaning of GPLv2.” None of their analysis contradicts that of Kuhn and Sandler in any way.
Moglen and Choudary, though, do not stop with the literal interpretation. They add that, if any formal objection is to be made, it needs to be made by the copyright holders of the code with which CDDL-derived code has been merged. The complaint would be “that their exclusive right to the copying and redistribution of their source code” is infringed.
What Moglen and Choudary do not mention is that dozens of developers have copyrighted code in the Linux kernel, many of whom are no longer active, so such a complaint is unlikely. However, they do say is that, until such a complaint is made, “an objectively reasonable good-faith belief that the conduct falls within the equity of the license should be made” and that the assumption should be that Canonical would respond reasonably to the complaint. Moreover, because the complaint would not involve lost sales or royalties, any damages would be “nominal.”
Side Issues
These differing opinions explain why the Free Software Foundation has yet to give an official statement. Both the Software Freedom Conservancy and the Software Freedom Law Center have a long history of association with the Foundation, yet they are offering conflicting opinions.
What also is clear is that there is a difference between the license compatibility claimed by Canonical and a violation that exists but is unlikely to be followed up and that involves no injury.
In the end, perhaps what matters is that Ubuntu users should be able to use ZFS without fear of consequences. However, morally they should be aware that ZFS in Ubuntu is a violation in the opinion of many the experts.
Canonical’s enthusiasm aside, it may be some time before we see ZFS on Linux.
Feature image via Pixabay.
