Libre Software People's Front

Last month I’ve been working in the creation of a report with the aim of finding out code clones between two libre software projects. The method we used was basically the one that was detailed in the paper Code siblings: Technical and Legal Implications by German, D., Di Penta M., Gueheneuc Y. and Antoniol, G.

It is an interesting case and I’m pretty sure this kind of reports will be more and more interesting for entities that publish code using a libre software license. Imagine you are part of a big libre software project and your copyright and even money is there, it would be very useful to you knowing whether a project is using your code and respecting your copyright and the rights you gave to the users with the license. With the aim of identifying these scenarios we did in our study the following:

• extraction of clones with CCFinderX
• detection of license with Ninka
• detection of the copyright with shell scripts

The CCFinderX tool used in the first phase gives you information about common parts of the code, it detects a common set of tokens (by default it is 50) between two files, this parameter should be changed depending on what it is being looked for. In the following example the second and third column contain information about the file and the common code. The syntax is (id of the file).(source file tokens) so the example shows that the file with id 1974 contains common code with files with id 11, 13 and 14.

...
clone_pairs {
19108 11.85-139 1974.70-124
19108 13.156-210 1974.70-124
19108 14.260-314 1974.70-124
12065 17.1239-1306 2033.118-185
12065 17.1239-1306 2033.185-252
12065 17.1239-1306 2033.252-319
12065 17.1239-1306 2141.319-386
...


In the report we did we only wanted to estimate the percent of code used from the “original” project in the derivative work, but there are some variables that are necessary to take into account. First, code clones can appear among the files of the same project (btw this is clear sign of needing refactorization). Second, different parts of a file can have clones in different files (a 1:n relationship) in both projects. The ideal solution would be to study file by file the relationship with others and to remove the repeated ones.

Once the relationship among files is created is the turn of the license and copyright detection. In this phase the method just compares the output of the two detectors and finally you get a matrix where it is possible to detect whether the copyright holders were respected and the license was correctly used.

Daniel German’s team found interesting things in their study of the FreeBSD and Linux kernels. They found GPL code in FreeBSD in the xfs file system. The trick to distribute this code under a BSD license is to distribute it disabled (is not compiled into FreeBSD) and let the user the election of compiling it or not. If a developer compiles the kernel with xfs support, the resulting kernel must be distributed under the terms of the GPLx licence.

[This entry is part of the work I do in LibreSoft and it is also available in my blog at libresoft.es]

The debian-legal is a great source of knowledge about legal issues related to FLOSS. A couple of days ago one of the contributors sent a mail informing that a computer shop has taken the Debian logo and used it for his business.

The Debian Open User Logo without the word “Debian” (they call it DOUL-nd) is released under the terms of a license similar to MIT, as specified on http://www.debian.org/logos/

If the people from http://www.legendpc.co.nz/ copied the logo from Debian it could be a copyright infringement problem because there is no mention to the license. The violation is about the following statement:

“The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.”

If they do that, they would be in compliance with the license of the DOUL-nd

On the other hand, what if they just obtained it from scratch? According to a message in the debian-legal mailing list the swirl is just one of the defaults. Some contributors were discussing if that would be relevant for a trademark violation, in those cases what matters is whether the image is confusingly similar to an existing trademark. The point here is the swirl is not trademark, what Debian has under trademark is the Debian name and as a consequence the logo that contains the “Debian” label.

This morning Stefano Zacchiroli (the Debian leader) has forwarded the issue to the SPI lawyer, it seems that the idea is to send a letter to the domain owner requesting to come into compliance with the licensing term of the Debian swirl.

References:
http://lists.debian.org/debian-legal/2010/11/msg00056.html