[PHP-QA] Debian and the PHP license

[Ian Jackson]

There has been an ongoing and wholly unproductive conversation on
-legal about some difficulties with the PHP licence.

Would it be possible for us to obtain some proper legal advice ?
Do we have a relationship with the SFLC we could use for this ?

If so I would be happy to write up a summary of the facts and the
questions to put to our lawyers. I think this is likely to be
straightforward but I would send a draft to -legal and ftpmaster@ to
check that the answer would actually resolve the problem one way or
another.

Ian.

[Lucas Nussbaum]

Hi Ian,

Thanks for bringing this up.

Post by Ian Jackson
There has been an ongoing and wholly unproductive conversation on
-legal about some difficulties with the PHP licence.
Would it be possible for us to obtain some proper legal advice ?
Do we have a relationship with the SFLC we could use for this ?

Sure, we could ask for advice from SFLC about this.

Post by Ian Jackson
If so I would be happy to write up a summary of the facts and the
questions to put to our lawyers. I think this is likely to be
check that the answer would actually resolve the problem one way or
another.

I think that such a summary would be very useful, at least to increase
the awareness about the issue, and to improve the description of the
violation on ftpmasters' REJECT FAQ.

However, based on my own (possibly limited) understanding of the
issue[1], this is case of a license (the PHP License) with sub-optimal
wording that is misused by third parties, as it was initially designed
for PHP itself, and is used for random software written in PHP.
As a result, the license adds some restrictions for derivative works
that could prevent software under that license to meet the DFSG.

So I think that it is important to distinguish between two different
questions:
(1) Is there a legal risk for Debian to distribute such software?
(2) Does the Debian project want to tolerate and ignore this sad
situation, or try to make the world a better place by working
on fixing this mess?

[1] built on reading #728196, the thread starting at
https://lists.debian.org/debian-devel/2014/06/msg00493.html
and the one starting at
https://lists.debian.org/debian-legal/2014/07/msg00024.html

When you have a summary and questions ready, we can work together on
forwarding them to SFLC for legal advice.

Lucas

[Ian Jackson]

Post by Lucas Nussbaum

Post by Ian Jackson
Would it be possible for us to obtain some proper legal advice ?
Do we have a relationship with the SFLC we could use for this ?

Sure, we could ask for advice from SFLC about this.

OK, good.

Post by Lucas Nussbaum

Post by Ian Jackson
If so I would be happy to write up a summary of the facts and the
questions to put to our lawyers. I think this is likely to be
check that the answer would actually resolve the problem one way or
another.

I think that such a summary would be very useful, at least to increase
the awareness about the issue, and to improve the description of the
violation on ftpmasters' REJECT FAQ.

Yes.

Post by Lucas Nussbaum
However, based on my own (possibly limited) understanding of the
issue[1], this is case of a license (the PHP License) with sub-optimal
wording that is misused by third parties, as it was initially designed
for PHP itself, and is used for random software written in PHP.
As a result, the license adds some restrictions for derivative works
that could prevent software under that license to meet the DFSG.

That is the contention of the critics, yes.

Post by Lucas Nussbaum
So I think that it is important to distinguish between two different
(1) Is there a legal risk for Debian to distribute such software?

I would want to ask whether there is a risk for others, too.

Post by Lucas Nussbaum
(2) Does the Debian project want to tolerate and ignore this sad
situation, or try to make the world a better place by working
on fixing this mess?

If we have a piece of legal advice which says that the risk is
minimal, then surely that would be sufficient to make the world a
place.

It would surely be nice to fix this wrinkle in the PHP licence but if
it doesn't actually meaningfully prevent anyone from doing anything
they would want to, then no-one's actual freedom is impinged and
reacting to it by throwing this software out of the archive is quite
disproportionate.

On the other hand if it _does_ pose a legal risk, then a legal opinion
to say so would be very helpful in persuading the software's upstreams
that it needs to be fixed.

Post by Lucas Nussbaum
When you have a summary and questions ready, we can work together on
forwarding them to SFLC for legal advice.

I will get back to you.

Ian.

[Thorsten Glaser]

Post by Lucas Nussbaum
However, based on my own (possibly limited) understanding of the
issue[1], this is case of a license (the PHP License) with sub-optimal
wording that is misused by third parties, as it was initially designed
for PHP itself, and is used for random software written in PHP.

That, too. But AIUI that licence also forbids us from shipping
a modified version of PHP without rebranding (like Firefox(tm)).

bye,
//mirabilos

[Charles Plessy]

Post by Thorsten Glaser
That, too. But AIUI that licence also forbids us from shipping
a modified version of PHP without rebranding (like Firefox(tm)).

I think that we are ridiculing ourselves by ignoring the arguments that have
been given to us by the PHP developers in the past.

See, we are getting famous in Wikipedia:

https://en.wikipedia.org/wiki/PHP_License#Debian_packaging_controversy

Debian maintainers have had a long-standing discussion (since at least 2005)
about the validity of the PHP license.[4] Expressed concerns include that the
license "contains statements about the software it covers that are specific to
distributing PHP itself", which, for other software than PHP itself therefore
would be "false statements".

I think that the situation is different:

- It has been proposed by a developer to remove PHP modules licensed under the
PHP license, in application of a policy that had been neglected for years.
This proposition was eventually represented by release-critical bugs.

- For some PHP modules, the bugs have been closed, and there was no further
reaction.

- In the meantime the usual vocal people sending the majority of emails on our
mailing lists are giving the impression that removing PHP modules is a position
of Debian as a whole, while it is definitely not.

This drama can be ended by closing the remaining bugs and going back to work.
This has been done for packages that some people care most, like php-memcached,
and could be done for other packages. When things have cooled down, it can
be proposed to correct the REJECT-FAQ according to current practice of accepting
PHP-licensed code.

Back to the question of rebranding, the PHP developers have already explained
that because PHP is a three-letter word, they are not in a position to
protect their name with a trademark. Therefore, they do it with a license.

We can not take Mate and distribute it as “Gnome Plus”. We can not take a fork
of PHP and call it “BetterPhp”. People can not take a Debian CD, add non-free
software, and sell it as “Debian Enhanced”. We and other protect our names,
and PHP does it too. I do not see a problem.

Have a nice day,

[MJ Ray]

Post by Charles Plessy
Back to the question of rebranding, the PHP developers have already explained
that because PHP is a three-letter word, they are not in a position to
protect their name with a trademark. Therefore, they do it with a license.
We can not take Mate and distribute it as “Gnome Plus”. We can not take a fork
of PHP and call it “BetterPhp”. People can not take a Debian CD, add non-free
software, and sell it as “Debian Enhanced”. We and other protect our names,
and PHP does it too. I do not see a problem.

There are two problems with trying to use a copyright licence to do the job of a trademark. It's like trying to use a gun to cut your steak.

One, it doesn't affect people who write something without using your code. We could clean- room write the perfect hamster punisher and then distribute it as PHP, possibly harming their reputation, but their licence would do nothing to stop us. This is not a worry for Debian but it does show why the licence term is not much like a trademark.

Secondly, unless it says otherwise, a naming restriction in a copyright licence doesn't permit honest source attribution and all the other nominative and fair uses that a trademark would. This is more of a problem for Debian.

Isn't part of the reason why the name PHP cannot be trademarked that restricting use of such a simple name is obnoxious?

There are many ways this could be solved, but the ostrich approach of closing the bugs without fixing them and hiding this from users must be one of the worst. Please support another approach.