[Qemu-devel] An opinion on copyright-notice-less qemu files

[Richard Fontana]

Hi qemu developers,

WARNING: (1) I am not your lawyer; (2) this is not legal advice; (3)
this is a long post which you will probably find extremely boring
unless you happen to be a licensing geek, which I suspect is not true
of most if not all of you.

My colleague Paolo Bonzini was discussing with me the subject of what
the qemu project should do (if anything) about files in qemu that have
no copyright/license notice, in connection with the recent qemu-devel
subthread on "GPLv3 troubles". In a sense the underlying issue is what
the legal status of such files is.

Paolo correctly identified four possibilities (I am here paraphrasing
how Paolo put them):

1) Assume nothing about the file - therefore, to deal with the GPLv3
compatibility issue, ask all authors for permission to treat as GPLv2+
(GPLv2 or later).

2) Because qemu has a LICENSE file (which, importantly, I am assuming
has been in place more or less from the get-go) that says "QEMU as a
whole is released under the GNU General Public License", assume
noticeless files are GPL+ (that is, GPLv1 or later) unless evidence
suggests that the file is GPLv2-only (e.g. if it is from a
default-GPLv2-only project like the Linux kernel).

3) Because of the LICENSE file and the fact that qemu includes the
GPLv2 text in its COPYING file (which, importantly, I am assuming has
been the case more or less from the get-go), assume noticeless files
are GPLv2+ unless evidence suggests that they are GPLv2-only.

4) Because, despite what the LICENSE file says, qemu today contains a
number of files that "GPLv2 only" (either explicitly, or else where
noticeless code is already known to be taken from a GPLv2-only
project), with this appearing to represent conscious developer
preference in at least some cases, and because therefore qemu has been
in general a globally "GPLv2 only" project for some time, assume
noticeless files are GPLv2 only, and therefore you should ask all
authors of noticeless files for permission to treat as GPLv2+.

I told Paolo that I thought possibility 3 was the best interpretation
of the situation. At his request, I am posting my rationale here. 

We must reject possibility 1. That is to say, we cannot take the view
that *nothing* can be assumed about a noticeless file in qemu. To
argue otherwise would imply that one cannot safely assume anything
about a contribution to a free software project -- particularly one
with longstanding public information on its licensing -- that happens
not to contain a copyright or license notice, which for better or
worse happens to be the typical practice. This would have unthinkable
and absurd results, contrary to the expectations of developers,
distributors and users everywhere, and therefore cannot possibly be
correct. I suppose there is a weaker version of possibility 1, that
noticeless files are implicitly licensed under *some* terms, but we
can't possibly know what those are. I think however that any range of
possible interpretations of what such an implied license would be that
differs from what's captured by the other three possibilities are
equivalent to the stronger assumption that nothing can be known or
reasonably assumed about the legal status of the file (unless you want
to argue that the implied license is something more permissive than
the GPL, which I will not argue and which is not necessary to
address). So, possibility 1 is wrong.

Possibilities 2, 3 and 4 are all correct inasmuch as they reject the
assumption underlying possibility 1, and stand for the proposition
that a noticeless contribution to a globally-GPL-licensed project is,
by default, GPL-licensed by implication. I think it cannot seriously
be disputed that there are an enormous number of free software
projects that use the GPL yet which include at least some noticeless
source files, and that for such projects the prevailing understanding
relied upon by developers, distributors and users alike is that the
global GPL license applies to the noticeless file by
implication. Indeed, I am not even sure if "by implication" is
justifiable where, as with qemu, there is known global licensing
information. So which of possibilities 2, 3 and 4 represents the best
interpretation?

Possibilities 2 and 3 are similar, being based on the notion that the
authors of a noticeless file specifically contributed to qemu must
have intended what was contributed to be licensed under the default
license of the project stated explicitly in the LICENSE file -- the
GPL. Under possibility 2, the argument is that we can't assume
anything about the version of the GPL because the LICENSE file
statement doesn't specify a version, and each version of the GPL has
had a provision saying, in essence, that if a version number is not
specified, the user can treat the code as being under any published
version of the license. Thus, the implied license under possibility 2
is "noticeless files can be treated as being under any version of the
GPL". Under possibility 3, the argument (as Paolo expressed it to me,
though I am paraphrasing) is that the implied license is that a
noticeless file can be treated as being GPLv2 or later, as the
inclusion of the GPLv2 text in COPYING suggests an intent to have
GPLv2 be the earliest possible version of the GPL one can legitimately
assume a noticeless file to be under, despite the more general
language in the LICENSE file statement.

Note that the difference between possibilities 2 and 3 is very
unimportant because (for the most part) GPLv1 is extinct.

Nevertheless, I think possibility 3 is the better interpretation, not
just because of the inclusion of the GPLv2 text, and not just because
qemu postdates the creation of GPLv2, but also because the earliest
license notices I see in source files from Fabrice Bellard state
"GPLv2 or later". I think his intent was for qemu to be a
GPLv2-or-later project, and I think it is reasonable to assume that
all subsequent noticeless contributions inherited this choice by
implication and are similarly licensed by default. I also think this
is suggested by common sense (given the moribundity of GPLv1 during
the entire time period that is relevant here) -- but the correctness
of possibility 3 over possibility 2 is really only of theoretical
interest.

This brings us to possibility 4, which is tempting but must be
rejected. 

Possibility 4 suggests that qemu started out being "GPLv2 or later"
but *became* "GPLv2 only" the moment the first copyrightable piece of
"GPLv2 only" code was included. While I will agree with that, if the
argument is that *explicit* "GPLv2 only" files cause noticeless files
to be GPLv2-only by default, it implies that prior to the point at
which the first *explicit* GPLv2-only code made its way into qemu, any
noticeless files (assuming there were any) were "GPLv2 or later" (or
maybe GPLv1 or later). The argument would have to be that the first
developer to use a "GPLv2 only" notice changed the default implied
licensing policy for noticeless files. In other words, the assumption
here is that possibilities 2 or 3 were once correct, but stopped being
correct at some date.

This might be a reasonable interpretation in some circumstances but I
don't think it's reasonable for qemu. Unlike the Linux kernel project,
qemu retained a global LICENSE file that refused to specify a
particular version of the GPL as a default license. Qemu developers
presumably made no effort to revise or clarify the contents of that
file in a way that would change the appearance of such a
policy. Moreover, it is my understanding that *after* the point in
time at which the first qemu developer placed the first explicitly
"GPLv2 only" code into the project, some other developers continued to
use explicit "GPLv2 or later" notices for subsequently-contributed
code. 

Thus, if that is right, there was no universal perception that qemu
had been magically transformed into a "default GPLv2 only" project in
some maximal sense, affecting the legal status of noticeless files,
*merely* because a subset of developers began to use "GPLv2 only"
notices for *their* code, even though it is true that the inclusion of
explicit "GPLv2 only" code prevented qemu from being globally "GPLv2
or later".  While the "GPLv2 only" developers may have affected the
license of qemu as a whole, they had no legitimate authority to affect
the implied license under which qemu users could reasonably assume
applied to individual portions of code contributed by *other* qemu
developers who chose not to include *any* license notice. Had they had
some intention of doing so, they can only blame themselves for failing
to revise the LICENSE file (written, I believe, by someone who had
used "GPLv2 or later" notices on *his* code) or to otherwise make
clear to the world that qemu had changed from being "v2 or later" (or
"GPL+") to "GPLv2 only" (however, I suspect they never thought about
that issue). I therefore reject possibility 4.

In conclusion, for the foregoing reasons, I believe possibility 3 is
correct. Noticeless files in qemu should be assumed to be implicitly
licensed by their authors under "GPLv2 or later" unless there is
extrinsic evidence to suggest some other licensing policy was intended
by their authors.

Richard Fontana
Open Source Licensing and Patent Counsel
Red Hat, Inc.