Re: Apache license usage (was Re: [PULL 04/15] hw/usb: Add CanoKey Implementation)

[Hongren (Zenithal) Zheng]

On Thu, Apr 27, 2023 at 11:11:42AM +0100, Daniel P. Berrangé wrote:
> On Tue, Jun 14, 2022 at 02:15:59PM +0200, Gerd Hoffmann wrote:
> > From: "Hongren (Zenithal) Zheng" <i@zenithal.me>
> > 
> > This commit added a new emulated device called CanoKey to QEMU.
> > 
> > CanoKey implements platform independent features in canokey-core
> > https://github.com/canokeys/canokey-core, and leaves the USB implementation
> > to the platform.
> > 
> > In this commit the USB part was implemented in QEMU using QEMU's USB APIs,
> > therefore the emulated CanoKey can communicate with the guest OS using USB.
> > 
> > Signed-off-by: Hongren (Zenithal) Zheng <i@zenithal.me>
> > Message-Id: <YoY6Mgph6f6Hc/zI@Sun>
> > Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> > ---
> >  hw/usb/canokey.h |  69 +++++++++++
> >  hw/usb/canokey.c | 300 +++++++++++++++++++++++++++++++++++++++++++++++
> >  2 files changed, 369 insertions(+)
> >  create mode 100644 hw/usb/canokey.h
> >  create mode 100644 hw/usb/canokey.c
> > 
> > diff --git a/hw/usb/canokey.h b/hw/usb/canokey.h
> > new file mode 100644
> > index 000000000000..24cf30420346
> > --- /dev/null
> > +++ b/hw/usb/canokey.h
> > @@ -0,0 +1,69 @@
> > +/*
> > + * CanoKey QEMU device header.
> > + *
> > + * Copyright (c) 2021-2022 Canokeys.org <contact@canokeys.org>
> > + * Written by Hongren (Zenithal) Zheng <i@zenithal.me>
> > + *
> > + * This code is licensed under the Apache-2.0.
> > + */
> 
> > diff --git a/hw/usb/canokey.c b/hw/usb/canokey.c
> > new file mode 100644
> > index 000000000000..6cb8b7cdb089
> > --- /dev/null
> > +++ b/hw/usb/canokey.c
> > @@ -0,0 +1,300 @@
> > +/*
> > + * CanoKey QEMU device implementation.
> > + *
> > + * Copyright (c) 2021-2022 Canokeys.org <contact@canokeys.org>
> > + * Written by Hongren (Zenithal) Zheng <i@zenithal.me>
> > + *
> > + * This code is licensed under the Apache-2.0.
> > + */
> 
> In the process of auditing licensing in QEMU I found this patch
> adding code that is Apache-2.0 licensed, and as such I don't
> think we should have ever merged the patch as is.
> 
> QEMU as a combined work is GPLv2-only.
> 
> There is disagreement between the Apache foundation and FSF on this
> topic[1], but FSF considered Apache 2.0 to be incompatible with the
> GPL-v2. Fedora licensing follows the same view of Apache being GPLv2
> incompatible.
> 
> More generally I think it is a little dubious to write new devices
> while claiming a license that's different from normal QEMU code
> license. I expect there is inevitably a degree of cut+paste from
> existing QEMU code to handle the device boilerplate code which
> would be sufficient to expect a GPLv2-or-later license to apply.
> 
> The two added files in this commit are the only occurrence of
> Apache licensing in QEMU that I see.
> 
> Hongren, IIUC from the attribution above, you wrote the code but
> Canokeys.org claims copyright. Could you report whether Canokeys.org
> will agree to change the licensing on these files to QEMU's normal
> GPLv2-or-later licensing.

I have discussed it internally with canokeys.org and they agreed
to re-license it under GPLv2+

I will send a patch modifying the license.

In the meantime, canokey.c was also modified by
MkfsSion <mkfssion@mkfssion.com>

I've Cc'ed MkfsSion for their attitude on this.

> 
> With regards,
> Daniel
> 
> [1] https://www.apache.org/licenses/GPL-compatibility.html
> -- 
> |: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
> |: https://libvirt.org         -o-            https://fstop138.berrange.com :|
> |: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|
>