Community mailing list archives

Re: access to code under AGPL v3

Andi Becker
- 01/08/2016 08:35:53
and Yves don't forget if someone has the module, than he can simply publish it by himself or even make it available for everyone for free.

Perhaps you should start thinking the FLOSS business scheme.

FREE does not mean free like free beer but more Free like the free in Freedom. People are able to distribute that piece of software with others - with or without any payment.

Lots of great Software Projects are actually GPL v.2 and newer once GPL v.3. But as more and more cloud hosters and software providers came up which did not share their enhancements with others anymore, the AGPL v. 3 had been created. 

At the beginning ODOO was (with other name) GPL v.3. and faced exactly that problem. ODOO S.A. wanted to get into the cloud business but was afraid that people could take the community ideas which than finally had been integrated in ODOO (or fomrer name solutions ) and get a huge advantage without sharing the code. ODOO S.A, knows much to good i guess that real masterminds are not at ODOO S.A, but in the community. So they changed to AGPL v.3.. Now everybody had to provide access again as soon as he made his website available publicly (intranets are quite difficult to check if they have no pubic access ;-) 

This brought them lots of more access and much more ideas to build up what is now ODOO 9. While the community alway followed brave ODOO S.A, they were able to go far ahead of them as they themselves don't need to provide data what they will do and share next ;-) or not share ;-(.

So the change to LGPL v.3 was a very logical step to secure their business and to get ODOO being more and more like SAP proprietary. 

The bad thing with LGPL v.3 for them is only that now people don't need to share the code again if they develop it for ODOO 9. But they don't worry about that as they will keep the community branch on its Version 9 status and will bring up all new enancements as proprietary code solutions.

i.e. mobile enhancements
many nice dashboards 

If that has been published also as LGPL you could actually use it also in Community projects and you could even publish it publicly for free which woud bring back the community to be not only the brainhead and mastermind for a proprietary software provider.

What many people until now did not realize is actually the following.

You can run GPL v.3 Code and AGPL v.3 Code and even LGPL v.3 Code in parallel and you can share it. It is diffferent in GPL v.2!!! there this was not possible.

If all Community contributors who love the community and like to empower the community would publish even their Version 9 Code under AGPL v.3 than also Odoo would need to share that code if they enhance the module and they would use it in their cloud solution i.e. and beside that they could NOT use that code in their proprietary software where the community will have absolut no access anymore to it.

If you don't want to share the code with others do what Yelizariev and some ofthers did already. If YOU are the one who initiated the module and YOU are the only one who contributed to it or if you know all those who contributed to it and they are OK with aLicense change than change it simply back to GPL v.3
 DON'T change it to LGPL v.3.

Why GPL v.3 and NOT LGPL v.3.:

Well it is very likely that at some point your module will be shared with others for free or against money or what however. i.e. you developped a site but you are no more in charge of it and now another company will take over your role, will find those modules and think it is a good idea to share all your modules with the community of others to bring in further enhancements. Than all your effort to hide your module will be gone immerdiately.

If you have published it under GPL v.3 you might here from those new enhancements never as ONLY AGPL will force the one enhancing your module to share it back to the community. But if this happens you can benefit from all those enhancements too - even for free! With GP: v.3 and AGPL v.3 it is always a win win situation.

With LGPL it is unfortunately complete different and it might be a WIN - LOOSE ALL solution or WIN - Get Stuck solution.

Why? example:

You publish your module under LGPL v.3 as you probably think you have to do so or you perhaps did not care and did not realize that the automatic module creator in ODOO put in the LGPL v.3 License by default and you did NOT change it - or have forgotte to change that back to AGPL or GPL!!

Now ODOO S.A, or any other guy or company can come who gets access to your code and they simply take it - throw it into their new proprietary code even they did only a small enhancement but all your effort will be gione immediately and you won't get back anything unless of course you buy the module for big money from that company which actually contains probably 90% of your effort and only 10% of theirs. Unfortunately you won't be able again to enhance their module (which is actually 90% based on your ideas). Very soon you will be out of business with that module!

If instead you would have published your code under AGPL or GPL this won't have happened as ONLY LGPL enables companies with proprietary code and business interests to take your code and share back absolut nothing anymore!


My advice would be:

NEVER EVER share your code under LGPL v.3!!1

If you still want to get something back from your efforts than publish your code still under AGPL v.3. Than even service providers need to republish their code which is based on yours.

If you don't care about, if the service provider can get a benefit with their enhancements and you not care if you get access to it by default, than publish it under GPL v.3.

GPL v.3. also enables you like LGPL v.3. to keep code you develop with you as long as you like - or at least until someone else will publish it ;-)

Many GPL v.3. developers actually like that model as they can release a module publicly AFTER they have earned already from that module. after they release it to the public others might contribute to it - or what is also possible with GPL or LGPL they simply take it - enhance it - and than don't publish there improvements so you now have to wait until they perhaps made their money with it or that feature is outdated and no more of use for them.

Only with AGPL v.3. you have the real chance to get something back for what you have put in.

Yves to your final questions:

1/ If I make an installation for a customer, he (the final customer) could get a mail from anyone requesting the code used in his instance?

Yes they have to provide the code. 

CASE 1 : you use the website module or provide access to the site in another way publicly or to a certain group of users.

A user is every one visiting your site - no need to login by the way! 

Therefore it is adviced to NOMORE use Version 8 of ODOO but instead use Version 9 which is LGPL OR

You rewrite ODOO 8 ;-) i.e. in setting it even in Python 3 and releasing it again under GPL v.3
2/ Is it correct that the code to be provided access to, would be only the modules used publicly on the website (and not a module that is used internally - only in the backend)?

You have to provide all code!! All code of modules used and distributed with ODOO 8. 

By the way ODOO 8 can have combined modules - modules which are AGPL but also modules which are GPL!!!. If the majority of code is AGPL the AGPL rule kicks in and you have to follow the AGPL rules, even your module is still GPL!! (as a stand alone)

If you now use LGPL this gets more interesting!

If you use ODOO 9 your module don't need to be republished even it is GPL v.3 (!!! no L in front!!!). If your module is now AGPL v.3. but the majority of code is LGPL like in ODOO 9 than you only would need to give access to it if people are actually uing that specific piece inside the LGPL site! which is usually not easy to figure out.

Depending in what country you are in this can be also another case. And this is IMHO the most interesting one as it would make ODOO Version 9 a AGPL actually even it is LGPL bydefault. This means when you simply insert a module which is AGPL or even better you use one ODOO S.A, module from Version 8 in Version 9 than all Version 9 would need to be made publicly available again as a whole. 

Still the code itself will contain their licenses, which means the ODOO Version 9 modules won't change to be AGPL again if they have been changed to LGPL and you are not using the AGPL version which came along with ODOO 8. Some modules of ODOO 8 still work in Version 9 ;-) or they are very easy to rewrite.

Your code does not get automatic to be LGPL by default as AGPL , GPL and LGPL can reside beside each other in version 3.
So when you want to avoid that your code gets used in proprietary software where you don't have access anymore, than still publish it still under AGPL or GPL v.3. If you create a module with the ODOO module create script change IMMEDIATE as first step the license to either GPL or AGPL and don't set a "L" in front.

Don't forget to fill in your copyright name and contact details!
3/ Who is responsible? the hoster? the implementer?

Responsible is the one providing access to the site, depending on which country you are in this could be even the hoster!

Making copies of the software for yourself is the main form of propagation that is not conveying. You might do this to install the software on multiple computers, or to make backups.

 If I give a copy of a GPLv3-covered program to a coworker at my company, have I “conveyed” the copy to him? (#v3CoworkerConveying)
As long as you're both using the software in your work at the company, rather than personally, then the answer is no. The copies belong to the company, not to you or the coworker. This copying is propagation, not conveying, because the company is not making copies available to others.


Finally the advide would be to release your code and modules NEVER under LGPL! but use simlpy the GPL if you don't like to get the benefits others put into your software. If you like to get those benefits simply publish it under AGPL!

If you already published modules and you followed blind what version Odoo was in, than have a look who contributed and change your module to that License you like most:

GPL - if you don't want to benefit from contributions your competitor has put into the module after he got access
AGPL - if you like to still benefit from each single enhancement of your module by others as soon as it gets used in a service i.e. a website which is publicly available.

Only use LGPL - if you like to feed those who will use your code for their own proprietary interests and won't give any enhancements back.

In GPLv3 and AGPLv3, what does it mean when it says “notwithstanding any other provision of this License”? (#v3Notwithstanding)
This simply means that the following terms prevail over anything else in the license that may conflict with them. For example, without this text, some people might have claimed that you could not combine code under GPLv3 with code under AGPLv3, because the AGPL's additional requirements would be classified as “further restrictions” under section 7 of GPLv3. This text makes clear that our intended interpretation is the correct one, and you can make the combination.
This text only resolves conflicts between different terms of the license. When there is no conflict between two conditions, then you must meet them both. These paragraphs don't grant you carte blanche to ignore the rest of the license—instead they're carving out very limited exceptions.

In AGPLv3, what counts as “interacting with [the software] remotely through a computer network?” (#AGPLv3InteractingRemotely)
If the program is expressly designed to accept user requests and send responses over a network, then it meets these criteria. Common examples of programs that would fall into this category include web and mail servers, interactive web-based applications, and servers for games that are played online.
If a program is not expressly designed to interact with a user through a network, but is being run in an environment where it happens to do so, then it does not fall into this category. For example, an application is not required to provide source merely because the user is running it over SSH, or a remote X session.

If some network client software is released under AGPLv3, does it have to be able to provide source to the servers it interacts with?(#AGPLv3ServerAsUser)
This should not be required in any typical server-client relationship. AGPLv3 requires a program to offer source code to “all users interacting with it remotely through a computer network.” In most server-client architectures, it simply wouldn't be reasonable to argue that the server operator is a “user” interacting with the client in any meaningful sense.
Consider HTTP as an example. All HTTP clients expect servers to provide certain functionality: they should send specified responses to well-formed requests. The reverse is not true: servers cannot assume that the client will do anything in particular with the data they send. The client may be a web browser, an RSS reader, a spider, a network monitoring tool, or some special-purpose program. The server can make absolutely no assumptions about what the client will do—so there's no meaningful way for the server operator to be considered a user of that software.

Under AGPLv3, when I modify the Program under section 13, what Corresponding Source does it have to offer? (#AGPLv3CorrespondingSource)
“Corresponding Source” is defined in section 1 of the license, and you should provide what it lists. So, if your modified version depends on libraries under other licenses, such as the Expat license or GPLv3, the Corresponding Source should include those libraries (unless they are System Libraries). If you have modified those libraries, you must provide your modified source code for them.
The last sentence of the first paragraph of section 13 is only meant to reinforce what most people would have naturally assumed: even though combinations with code under GPLv3 are handled through a special exception in section 13, the Corresponding Source should still include the code that is combined with the Program this way. This sentence does not mean that you only have to provide the source that's covered under GPLv3; instead it means that such code is not excluded from the definition of Corresponding Source.

Does the LGPL have different requirements for statically vs dynamically linked modules with a covered work? (#LGPLStaticVsDynamic)
For the purpose of complying with the LGPL (any extant version: v2, v2.1 or v3): 
(1) If you statically link against an LGPL'd library, you must also provide your application in an object (not necessarily source) format, so that a user has the opportunity to modify the library and relink the application.
(2) If you dynamically link against an LGPL'd library already present on the user's computer, you need not convey the library's source. On the other hand, if you yourself convey the executable LGPL'd library along with your application, whether linked with statically or dynamically, you must also convey the library's sources, in one of the ways for which the LGPL provides. 


If I distribute a proprietary program that links against an LGPLv3-covered library that I've modified, what is the “contributor version” for purposes of determining the scope of the explicit patent license grant I'm making—is it just the library, or is it the whole combination?(#LGPLv3ContributorVersion)
The “contributor version” is only your version of the library.

the same you can actually argue with your AGPL v.3 and GPL v.3 Code used in LGPL projects.


@W. Martin Borgert

Fabien, just to be sure: If I run Odoo 9, but with a least one AGPLv3
module (e.g. by 3rd party), the AGPLv3 does apply again, right?
Thanks in advance!

Yes and simply have a look to most ODOO 9 sites that you will realise that the AGPL hooks in again here!

A clear answer from Fabien or ODOO S.A. about all those licensing did still not happen. this is why this discussion won't stop and will come up over and over again. One reason actually why OCA should stand up finally and build up their own roadmap with their own goals - call it community goals - instead of blind following the ODOO S.A. roadmap always way behind as they usually don't release it in advance - you usually will hear about it when it just already happened, but that is usually much to late!