Re: State of PostgreSQL's drivers in Python

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Nicholas Bastin wrote:
> On Mon, Feb 8, 2010 at 10:31, Marko Kreen <[email protected]> wrote:
> 
>> Well, Josh collected bunch of anecdotes and added spin to them,
>> good for getting clicks but bad for PR...
>>
>> - Calling licence "bizarre-hacked-up" is over the top, GPL+exception
>>  is pretty common - Linux, GCC, Java.  And the OpenSSL situation
>>  even requires it.
>>
> 
> GPL + Exception is reasonably common, but usually the exception is written
> with some understanding of the law in various jurisdictions, while the
> Pyscopg license literally reads like some hacked up text without a legal
> framework.  The OpenSSL exception is troubling enough:
> 
> "As a special exception, specific permission is granted for the GPLed
> code in this distribition to be linked to OpenSSL and PostgreSQL libpq
> without invoking GPL clause 2(b)."
> 
> The OpenSSL license is at least in conflict with section 6 of the GPL (v2),
> if not a number of other sections - merely eliding 2(b) isn't going to be
> sufficient.  That is then followed by a clause that says, in essence, "we
> want this license to behave like the GPL in the ways that we like, and
> ignore it in the ways that we don't", without being clear (in a legal
> context) about what that means:
> 
> "Note that the GPL was chosen to avoid proprietary adapters based on
> psycopg code. Using psycopg in a proprietary product (even bundling
> psycopg with the proprietary product) is fine as long as:
> 
>  1. psycopg is called from Python only using only the provided API
>     (i.e., no linking with C code and no C modules based on it); and
> 
>  2. all the other points of the GPL are respected (you offer a copy
>     of psycopg's source code, and so on.)"
> 
> Given the fact that these new rights are not expressly enumerated, and the
> remaining valid provisions of the GPL are also not enumerated, we are left
> quite in the air as to what the license means.  You might be left thinking
> that (1) is controlling, but then the license ends with:
> 
> "A non-exclusive license is available for companies that want to include
> psycopg in their proprietary products without respecting the spirit of the
> GPL."
> 
> What is the "spirit" of the GPL that is remaining?  This license fails to
> explicitly lay out what is permitted and what is not.  Even though you state
> that "Even if the GPL does not work that way when importing Python modules",
> I think there are probably a lot of Python module developers out there who
> rather think the GPL *does* stop people from using their modules in the way
> that psycopg seems to be attempting to allow (the FSF is very clear in their
> supporting documentation that shared code linked into the same memory space
> taints non-GPL code).

That isn't quite so clear:  RMS has said that it is up to the courts to
determine whether the kind of dynamic link which occurs when importing a
Python moudle constitutes a "derived work" under copyright law:  the GPL
itself cannot impose restrictions beyond those which copyright allows.

I once explained what actually happened during an import to a very
bright software IP lawyer who had initially assumed that importing
created a derived work:  once I made the mechanism clear enough, he just
shook his head, and said he would never take on such a case trying to
enforce the GPL.

His argument went something like so:  nearly any C application which
does dynamic linking uses #include to get the API, and therefore copies
code into the dependent module, making it a derived work. Python
imports, on the other hand, do the equivalent of 'dlopen' and runtime
dispatch to API functions and global objects.  The code doing the import
is thus dependent only on non-protectable elements of the imported module.

IANAL, get your own legal advice, etc. ;)


Tres.
- --
===================================================================
Tres Seaver          +1 540-429-0999          [email protected]
Palladion Software   "Excellence by Design"    http://palladion.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAktwYIAACgkQ+gerLs4ltQ4GUACfR8MoyM3cWXzW0BfMGgQLqztB
DoQAoKquvbipzhFJQgRGJtbsgQodnS6v
=hmHg
-----END PGP SIGNATURE-----