Apache license usage (was Re: [PULL 04/15] hw/usb: Add CanoKey Implementation)

[Daniel P . Berrangé]

On Tue, Jun 14, 2022 at 02:15:59PM +0200, Gerd Hoffmann wrote:
> From: "Hongren (Zenithal) Zheng" <i@zenithal.me>
> 
> This commit added a new emulated device called CanoKey to QEMU.
> 
> CanoKey implements platform independent features in canokey-core
> https://github.com/canokeys/canokey-core, and leaves the USB implementation
> to the platform.
> 
> In this commit the USB part was implemented in QEMU using QEMU's USB APIs,
> therefore the emulated CanoKey can communicate with the guest OS using USB.
> 
> Signed-off-by: Hongren (Zenithal) Zheng <i@zenithal.me>
> Message-Id: <YoY6Mgph6f6Hc/zI@Sun>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
>  hw/usb/canokey.h |  69 +++++++++++
>  hw/usb/canokey.c | 300 +++++++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 369 insertions(+)
>  create mode 100644 hw/usb/canokey.h
>  create mode 100644 hw/usb/canokey.c
> 
> diff --git a/hw/usb/canokey.h b/hw/usb/canokey.h
> new file mode 100644
> index 000000000000..24cf30420346
> --- /dev/null
> +++ b/hw/usb/canokey.h
> @@ -0,0 +1,69 @@
> +/*
> + * CanoKey QEMU device header.
> + *
> + * Copyright (c) 2021-2022 Canokeys.org <contact@canokeys.org>
> + * Written by Hongren (Zenithal) Zheng <i@zenithal.me>
> + *
> + * This code is licensed under the Apache-2.0.
> + */

> diff --git a/hw/usb/canokey.c b/hw/usb/canokey.c
> new file mode 100644
> index 000000000000..6cb8b7cdb089
> --- /dev/null
> +++ b/hw/usb/canokey.c
> @@ -0,0 +1,300 @@
> +/*
> + * CanoKey QEMU device implementation.
> + *
> + * Copyright (c) 2021-2022 Canokeys.org <contact@canokeys.org>
> + * Written by Hongren (Zenithal) Zheng <i@zenithal.me>
> + *
> + * This code is licensed under the Apache-2.0.
> + */

In the process of auditing licensing in QEMU I found this patch
adding code that is Apache-2.0 licensed, and as such I don't
think we should have ever merged the patch as is.

QEMU as a combined work is GPLv2-only.

There is disagreement between the Apache foundation and FSF on this
topic[1], but FSF considered Apache 2.0 to be incompatible with the
GPL-v2. Fedora licensing follows the same view of Apache being GPLv2
incompatible.

More generally I think it is a little dubious to write new devices
while claiming a license that's different from normal QEMU code
license. I expect there is inevitably a degree of cut+paste from
existing QEMU code to handle the device boilerplate code which
would be sufficient to expect a GPLv2-or-later license to apply.

The two added files in this commit are the only occurrence of
Apache licensing in QEMU that I see.

Hongren, IIUC from the attribution above, you wrote the code but
Canokeys.org claims copyright. Could you report whether Canokeys.org
will agree to change the licensing on these files to QEMU's normal
GPLv2-or-later licensing.

With regards,
Daniel

[1] https://www.apache.org/licenses/GPL-compatibility.html
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|